This topic describes the anomaly types that are available in the results of text analysis.

The results of text analysis are all stored in a Logstore named internal-ml-log. You can use the result.type and result.anomaly_type fields in the results to analyze anomaly types. For more information, see Result fields.

Judgment conditionAnomaly type
  • The value of the result.type field is anomaly_info.
  • The value of the result.anomaly_type field is N_CLUSTER_EVENT_ANOMALY.
The number of logs in a log category is abnormal.
  • The value of the result.type field is anomaly_info.
  • The value of the result.anomaly_type field is NEW_CLUSTER_ANOMALY.
A new log category appears.
A new log category appears in the following scenarios:
  • The log category appears for the first time.
  • The log category appears once but does not appear within the maximum silence time after the first appearance. You can specify the maximum silence time by using algorithm parameters.
  • The value of the result.type field is anomaly_info.
  • The value of the result.anomaly_type field is RARE_CLUSTER_ANOMALY.
The log category rarely appears.