The intelligent inspection feature of Log Service allows you to inspect data such as logs and metrics and identify exceptions in the data in an automated, intelligent, and adaptive manner. This topic describes how to view the results generated by an intelligent inspection task.

Prerequisites

An intelligent inspection task is created, and the results generated by the task are written to the Logstore named internal-ml-log. For more information, see Create an intelligent inspection task to inspect a metric or Create an intelligent inspection task to inspect log data.

Procedure

  1. Log on to the Log Service console.
  2. In the Projects section, click the name of the project that you want to view.
  3. In the left navigation sidebar, click Log Storage. On the Logstores tab, click the Logstore named internal-ml-log.
  4. On the Raw Logs tab of the page that appears, view the results generated by the intelligent inspection task.
    View the results generated by an intelligent inspection task

Fields in logs

Field Description
__tag__:__apply_time__ The point in time when the algorithm model starts to inspect the current batch of samples.
__tag__:__batch_id__ The ID of the current batch of samples. Samples in the same batch are identified by the same batch ID.

The ID of a batch is the same as the IDs of the alerts that are triggered by exceptions identified in the batch. After the intelligent inspection task analyzes the current batch of samples, the task determines whether to send alerts.

__tag__:__instance_name__ The name of the intelligent inspection instance that is created in the intelligent inspection task. The instance ID consists of a project ID and a schedule ID.

Each task is associated with an instance name on the background server.

__tag__:__schedule_id__ The ID of the intelligent inspection instance that is created in the intelligent inspection task.

Each task is associated with an instance ID on the background server.

__tag__:__job_name__ The name of the intelligent inspection task. Each task must have a unique name in the project to which the task belongs.
__tag__:__model_name__ The name of the algorithm model. An algorithm model is created for each entity in the intelligent inspection task. Each algorithm model is associated with an entity name.
__tag__:__region__ The region to which the intelligent inspection task belongs.
entity The JSON string that consists of one or more fields. These fields are used to identify the entity that you want to inspect. The information about the entity is obtained from the source data.
meta The JSON string that consists of the configuration items of the intelligent inspection task.
meta.project_name The project to which the source data belongs.
meta.logstore_name The Logstore to which the source data belongs.
meta.parent_keys The keywords of the parent nodes. The keywords are obtained from the source data.

If exceptions occur, you can use this field to analyze the causes of the exceptions. In common use scenarios, you can ignore this field.

meta.child_keys The keywords of the child nodes. The keywords are obtained from the source data.

If exceptions occur, you can use this field to analyze the causes of the exceptions. In common use scenarios, you can ignore this field.

result The inspection result of the current sample.
result.dim_name The name of the dimension in which the generated inspection result is presented. The name is obtained from the source data.

Each inspection result in the value of the result field is presented only in a single dimension regardless of whether one or more dimensions are specified.

result.value The value of the generated inspection result in the specified dimension. The value is obtained from the source data. The dimension is specified by the result.dim_name parameter.
result.score The score of the identified exception. Valid values: 0 to 1. A higher score indicates a higher degree of exception.
result.is_anomaly Indicates whether an exception occurs.
  • If the value of the result.score field is greater than 0.5, the exception is considered true.
  • If the value of the result.score field is greater than 0.75, the exception is considered true and an alert is triggered.
result.anomaly_type The type of the identified exception. Log Service divides exceptions into the following types: Stab exceptions, Shrift exceptions, Variance exceptions, Lack exceptions, and OverThreshold exceptions. For more information, see the "Exception types" section of this topic.

Exception types

Exception type Label Description
Stab Stab The values of the inspected metric abruptly increase and then restore to normal during off-peak hours, or the values of the inspected metric change before a Shift exception occurs. Stab
Shift Shift The values of the inspected metric are out of the value range that you specify and remain stable. In most cases, Shrift exceptions occur before and after your business data changes. Shift
Variance Variance The average value of the inspected metric does not significantly change. However, the variance of the metric changes. Variance
Lack Lack Some samples of the inspected metric are missing. Lack
OverThreshold OverThreshold The values of the inspected metric exceed the threshold that you specify. If this situation occurs, Log Service generates alerts regardless of the results that are generated by algorithm models. OverThreshold