Simple Log Service:Train a model with SQL-aggregated metric data

Create an intelligent inspection job

Go to job creation

1. Log on to the Simple Log Service console.

2. Go to the job creation page.

   1. In the Log Application section, click Intelligent Anomaly Analysis.

   2. In the list of instances, click the target instance.

   3. In the left-side navigation pane, click Intelligent Inspection.

   4. Click Real-time Inspection.

   5. In the Inspection Job section, click Create Now.

Basic information

In the Basic Information step of the Create Intelligent Inspection Job wizard, configure the following parameters and click Next.

Data feature configuration

If your time-series data contains anomaly labels, select Data Feature Settings. If not, select Anomaly injection.

1. For more information about query and analysis statements, see Query overview and Overview of query and analysis.

   Data feature

   • Query statement

     * | select (__time__ - __time__%60) as time, entity, count(*) as metric, if(count(*) > 1000, 1, 0) as label from log group by time, entity limit 1000000

   • Label name: label

   • Entity: entity

   • Feature: metric

     Parameter	Description
     Time	The field that identifies the time column in the source data.
     Granularity	The data observation interval, in seconds. The value must be from 5 to 3,600. An interval of 60 seconds or more is recommended.
     Entity	The field that identifies a specific entity. The intelligent inspection job aggregates data by this field to generate time series.
     Feature	The field that contains the feature data to be analyzed.
     Label name	The field that contains the anomaly labels. 1: Indicates that the data point is anomalous. 0: Indicates that the data point is normal.

   Anomaly injection

   • Query statement

     * | select (__time__ - __time__%60) as time, entity, count(*) as metric from log group by time, entity limit 1000000

   • Entity: entity

   • Feature: metric

   • Anomaly rate: 0.001

   Parameter	Description
   Time	The field that identifies the time column in the source data.
   Granularity	The data observation interval, in seconds. The value must be from 5 to 3,600. An interval of 60 seconds or more is recommended.
   Entity	The field that identifies a specific entity in the source data. The intelligent inspection job aggregates data based on entity identifiers to generate time series.
   Feature	The field that identifies specific feature data in the source data.
   Anomaly injection	Specifies whether to save the data after anomalies are injected.
   Anomaly rate	The proportion of anomalous data to inject. For example, a value of 0.001 means that 0.1% of the data points are injected as anomalies.
   Anomaly type	The types of anomalies to inject into the feature sequence.

Algorithm configuration

1. In the Algorithm configuration section, select an Algorithm. Only the supervised anomaly detection algorithm is supported.

2. In the Scheduling Settings section, configure the following parameters.

   Parameter	Description
   Start time	The start time of the time series to be processed by the model training job.
   End time	The end time of the time series to be processed by the model training job.
   End time of model learning	This parameter specifies the cutoff time for training data and must be between the Start time and the End time. The system uses data from the Start time to the End time of model learning for training, and data from the End time of model learning to the End time for validation.

Manage intelligent inspection jobs

In the left-side navigation pane of the Simple Log Service console, choose Intelligent Inspection > Real-time Inspection to open the job management page. From the Actions column, you can edit or delete jobs.

1. View a job: Find the model training job in the job list and click its ID to view details.

   1. In the Entity information list, click an entity ID.

   2. In the panel that appears, create a prediction task.

      Parameter	Description
      Task name	The name of the prediction task, which is also the real-time inspection task.
      Entity ID	The IDs of the entity sequences to inspect.
      Anomaly type to follow	The anomaly types to focus on within the feature sequence.
      Start time	The time from which the task starts reading and inspecting the time-series data.
      Data latency	The maximum expected latency for data to be written to Simple Log Service. The task waits for this duration before reading data to ensure data completeness.
      Send alert	Specifies whether to send alerts for detected anomalies.
      Alert policy	An alert policy combines, mutes, and suppresses generated alerts. If you set the alert policy to Simple Mode or Standard Mode, you do not need to configure an alert policy. Simple Log Service uses the built-in dynamic alert policy (sls.builtin.dynamic) by default. If you select Advanced Mode, you can select a built-in or custom alert policy. For more information about how to create an alert policy, see Create an alert policy.
      Action policy	An action policy controls the notification channels and frequency for alerts. If you set the alert policy to Simple Mode, you only need to configure an action group. After you configure the action group, Simple Log Service automatically creates an action policy named Rule Name-Action Policy. All alerts triggered by this rule are sent through this action policy. For more information about how to configure notification channels, see Notification methods. If you set Alert Policy to Standard Mode or Advanced Mode, you can select a built-in or custom action policy for alert notifications. For more information about how to create an action policy, see Action policies. When you set Alert Policy to Advanced Mode, you can also enable or disable Custom Action Policy. For more information, see Dynamic action policy mechanism.

2. Edit a job.

3. Delete a job.

   Important

   Deleted intelligent inspection jobs cannot be restored. Proceed with caution.