This topic describes the anomaly types that are available in the results of text analysis.
The results of text analysis are all stored in a Logstore named internal-ml-log. You can use the result.type and result.anomaly_type fields in the results to analyze anomaly types. For more information, see Result fields.
| Judgment condition | Anomaly type |
|---|
- The value of the result.type field is anomaly_info.
- The value of the result.anomaly_type field is N_CLUSTER_EVENT_ANOMALY.
| The number of logs in a log category is abnormal. |
- The value of the result.type field is anomaly_info.
- The value of the result.anomaly_type field is NEW_CLUSTER_ANOMALY.
| A new log category appears. A new log category appears in the following scenarios: - The log category appears for the first time.
- The log category appears once but does not appear within the maximum silence time after the first appearance. You can specify the maximum silence time by using algorithm parameters.
|
- The value of the result.type field is anomaly_info.
- The value of the result.anomaly_type field is RARE_CLUSTER_ANOMALY.
| The log category rarely appears. |