Learn about the key system and data modeling challenges for performing anomaly detection on large complex systems in near real time. You'll see how Elastic approaches these problems as we illustrate how the specific modeling choices affect the quality of results. We'll also briefly survey other popular time series modeling techniques and assess their suitability for anomaly detection.

1. 1
Operationally Useful
Anomaly Detection
Tom Veasey
Principal Engineer, ML

2. 2
This presentation and the accompanying oral presentation contain forward-looking statements, including statements
concerning plans for future offerings; the expected strength, performance or benefits of our offerings; and our future
operations and expected performance. These forward-looking statements are subject to the safe harbor provisions
under the Private Securities Litigation Reform Act of 1995. Our expectations and beliefs in light of currently
available information regarding these matters may not materialize. Actual outcomes and results may differ materially
from those contemplated by these forward-looking statements due to uncertainties, risks, and changes in
circumstances, including, but not limited to those related to: the impact of the COVID-19 pandemic on our business
and our customers and partners; our ability to continue to deliver and improve our offerings and successfully
develop new offerings, including security-related product offerings and SaaS offerings; customer acceptance and
purchase of our existing offerings and new offerings, including the expansion and adoption of our SaaS offerings;
our ability to realize value from investments in the business, including R&D investments; our ability to maintain and
expand our user and customer base; our international expansion strategy; our ability to successfully execute our
go-to-market strategy and expand in our existing markets and into new markets, and our ability to forecast customer
retention and expansion; and general market, political, economic and business conditions.
Additional risks and uncertainties that could cause actual outcomes and results to differ materially are included in
our filings with the Securities and Exchange Commission (the “SEC”), including our Annual Report on Form 10-K for
the most recent fiscal year, our quarterly report on Form 10-Q for the most recent fiscal quarter, and any
subsequent reports filed with the SEC. SEC filings are available on the Investor Relations section of Elastic’s
website at ir.elastic.co and the SEC’s website at www.sec.gov.
Any features or functions of services or products referenced in this presentation, or in any presentations, press
releases or public statements, which are not currently available or not currently available as a general availability
release, may not be delivered on time or at all. The development, release, and timing of any features or functionality
described for our products remains at our sole discretion. Customers who purchase our products and services
should make the purchase decisions based upon services and product features and functions that are currently
available.
All statements are made only as of the date of the presentation, and Elastic assumes no obligation to, and does not
currently intend to, update any forward-looking statements or statements relating to features or functions of services
or products, except as required by law.
Forward-Looking Statements

3. Background1
Summary
Key engineering and modelling ingredients2
3

4. • Provide sharp tools for system monitoring
• Provide relevant, understandable and scalable modelling
Goals

5. Background1
Summary
Key engineering and modelling ingredients2
3

6. • Regularly occurring events are usually not interesting
• Handling change is very important
• Bias/variance tradeoff is very important
• Not after just point estimates: need to characterize system noise
• Alert overload is first class consideration and absolute ranking is
important
What matters?

7. • Cloudwatch
– Performance monitoring, CPU and Network bytes
– 2 wk, 15 min polled, 156 time series, 140MB
– Variously sparse, non-seasonal and seasonal stationary time series
• Site
– Site traffic data
– 6 mth, 16 time series, 6MB (presumarised)
– Seasonal, mainly stationary with shocks
• Temperature
– Sensor data
– 1 yr, 1hr polled, 1 time series, 380KB
– 1 time series, time varying seasonality, non-stationary
Data Sets

8. • Demo
Example: Change, Bias/Variance, Alert Overload

9. Background1
Summary
Key engineering and modelling ingredients2
3

10. • Automation of modelling choices allows scalability
• Handling changes in data characteristics is critical for relevance
• Knowing what not to model is important
• Allow users to control key aspects of the data preparation and
modelling without overburdening them
• Tackle alert overload by careful aggregation of input data or anomaly
results
• Anomaly detection is a great tool for root cause analysis
Some Take Homes

11. 11
Thank You!