Learn how Sky leveraged the power of Elastic’s machine learning feature to process over seven billion documents and help discover trends, learn from real-time data, and generate alerts when anomalies occur. See the video: https://www.elastic.co/elasticon/tour/2019/london/monitoring-with-elastic-machine-learning-at-sky

1. Simon Quain & Jamie Lynch
Monitoring Solutions, Sky
Monitoring with Elastic
Machine Learning

2. 2
Agenda
Introduction1
How it started2
Projects – Sky Mobile3
Projects – OTT Targeted Advertising4
Lessons learned5

3. 3
Introduction
Who are Sky?
7
Countries
24m
Customers
£6bn
Content
investment
31,000+
Employees
100+
Original
productions
£11bn
Revenue

4. 4
Introduction
Who are Monitoring Solutions?

5. 5
Introduction
Who are Monitoring Solutions?
Service &
Performance
Monitoring

6. 6
Introduction
Who are Monitoring Solutions?
Data

7. 7
Introduction
Who are Monitoring Solutions?
Dashboards

8. 8
Introduction
Who are Monitoring Solutions?
Alerting

9. How it started
Why use Elastic?
• Collating data from multiple sources
• Troubleshooting and investigating issues
• Visualizing and presenting data

10. 10
Sources
Ingests
Application & Syslogs

11. 11
Moving to ECE
Machine
Learning
Users and
Roles
Watcher
Simplified
Upgrades
Cluster per
use case

12. 12
Synthetic Monitoring

13. 13
Network Monitoring

14. 14
Alerts Viewer

15. 15
Why Anomaly Detection

16. 16
Why Anomaly Detection

17. 17
Why Anomaly Detection

18. 18
Monitoring our mobile proposition

19. 19
Sky Mobile
Monitoring our mobile proposition

20. 20
Sky Mobile

21. 21
Sky Mobile

22. A few terms
• OTT – Over The Top
– Delivering TV over the internet (Sky Go, NOW TV,
Netflix etc)
• VOD – Video On Demand
– Streaming or downloading content on demand,
such as bingeing a Game of Thrones box set
• Linear
– Streaming live content as it plays out, such as
watching live football

23. 23
OTT Targeted Advertising
“Different ads can be shown to different households watching the same
programme. This means advertisers can promote on national channels,
but to relevant audiences.”

24. 24
OTT Targeted Advertising
The Data
Ad Insertion Engine
A
EventType R = Request
Read each log line with this parameter into cache and
record the Transaction ID
EventType I = Impression
Match these logs from around 20 minutes later to
previous using the ID
Insert into elastic
Add field ‘HasImpression` True/False depending
on whether EventType I turned up or not
B C D

25. 25
OTT Targeted Advertising
The Data
0
0.45
0.9
1.35
1.8
Feb Sep Feb Sep
Primary Storage (tb) Document Count (billion)

26. 26
OTT Targeted Advertising
The Process
data*
Elastic index where all of the
logs are stored
Datafeed
Datafeed
Datafeed
ML
Job
ML
Job
ML
Job
.ml_anomalies
Elastic index where all of the
generated anomalies are
stored

27. 27
The Process
.ml_anomalies
Elastic index where all of the
generated anomalies are
stored
breaks*
Elastic index where
information about ad
breaks is stored
Watcher
- Check for anomalies
- Check for breaks
- Query other sources
Central Alert
Gateway
Other data
Ticket
Orchestration
ServiceNowAlerting Config
Callout

28. 28
OTT Targeted Advertising
An Example Ticket
Anomalies found in: [job_name]
At around: 2019-03-24 14:40:00
The following anomalies were found:
SiteSection: Linear:Android:Devices
observed value=2000 (expected=100)
[http://somelink.com]
SiteSection: Linear:iOS:Devices:
observed value=500 (expected=20)
[http://somelink.com]
Elastic job: [job_id]
Dashboard Link: [http://somelink.com]
Support Page: [http://relevant_support_page.com]

29. 29
OTT Targeted Advertising
The Issues

30. 30
OTT Targeted Advertising
The Successes

31. 31
OTT Targeted Advertising
The Successes

32. Lessons learned
• ML isn’t a magic bullet
• Understand your data
• Alerting is hard!
• Consistent data makes your life easier

33. We’re hiring!
Search for Monitoring at workforsky.com