{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/stack-docs/pulls/comments/204473756","pull_request_review_id":139556058,"id":204473756,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIwNDQ3Mzc1Ng==","diff_hunk":"@@ -0,0 +1,39 @@\n+[role=\"xpack\"]\n+[[ml-rules]]\n+=== Machine learning rules and filters\n+++++\n+<titleabbrev>Rules and filters</titleabbrev>\n+++++\n+\n+By default, as described in <<ml-analyzing>>, anomaly detection is unsupervised \n+and the {ml} models have no awareness of the domain of your data. As a result, \n+{ml} jobs might identify events that are statistically significant but are \n+uninteresting when you know the larger context. Machine learning rules enable \n+you to customize anomaly detection. \n+\n+_Rules_ instruct anomaly detectors to change their behavior based on \n+domain-specific knowledge that you provide. When you create a rule, you can  \n+specify conditions, scope, and actions. By default, the scope of a rule is \n+unlimited and you must specify at least one condition. When the conditions of a \n+rule are satisfied, its action is triggered. \n+\n+For example, if you have an anomaly detector that is analyzing CPU usage, you \n+might decide you are only interested in abnormally high usage. You can define a ","path":"docs/en/stack/ml/rules.asciidoc","position":21,"original_position":21,"commit_id":"e71c92c967a740170361e522ac7d4b49be6ab048","original_commit_id":"e71c92c967a740170361e522ac7d4b49be6ab048","user":{"login":"dimitris-athanasiou","id":9351617,"node_id":"MDQ6VXNlcjkzNTE2MTc=","avatar_url":"https://avatars3.githubusercontent.com/u/9351617?v=4","gravatar_id":"","url":"https://api.github.com/users/dimitris-athanasiou","html_url":"https://github.com/dimitris-athanasiou","followers_url":"https://api.github.com/users/dimitris-athanasiou/followers","following_url":"https://api.github.com/users/dimitris-athanasiou/following{/other_user}","gists_url":"https://api.github.com/users/dimitris-athanasiou/gists{/gist_id}","starred_url":"https://api.github.com/users/dimitris-athanasiou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dimitris-athanasiou/subscriptions","organizations_url":"https://api.github.com/users/dimitris-athanasiou/orgs","repos_url":"https://api.github.com/users/dimitris-athanasiou/repos","events_url":"https://api.github.com/users/dimitris-athanasiou/events{/privacy}","received_events_url":"https://api.github.com/users/dimitris-athanasiou/received_events","type":"User","site_admin":false},"body":"`abnormally high usage` takes my mind to simply using a `high` variant of a function. I think it might be better to say something like \"you might decide you are only interested in anomalies where the CPU usage is greater than a certain threshold\".","created_at":"2018-07-23T16:36:46Z","updated_at":"2018-07-23T16:38:07Z","html_url":"https://github.com/elastic/stack-docs/pull/84#discussion_r204473756","pull_request_url":"https://api.github.com/repos/elastic/stack-docs/pulls/84","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/comments/204473756"},"html":{"href":"https://github.com/elastic/stack-docs/pull/84#discussion_r204473756"},"pull_request":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/84"}}},"pull_request":{"url":"https://api.github.com/repos/elastic/stack-docs/pulls/84","id":202412192,"node_id":"MDExOlB1bGxSZXF1ZXN0MjAyNDEyMTky","html_url":"https://github.com/elastic/stack-docs/pull/84","diff_url":"https://github.com/elastic/stack-docs/pull/84.diff","patch_url":"https://github.com/elastic/stack-docs/pull/84.patch","issue_url":"https://api.github.com/repos/elastic/stack-docs/issues/84","number":84,"state":"open","locked":false,"title":"[DOCS] Adds overview for machine learning rules and filters","user":{"login":"lcawl","id":26471269,"node_id":"MDQ6VXNlcjI2NDcxMjY5","avatar_url":"https://avatars0.githubusercontent.com/u/26471269?v=4","gravatar_id":"","url":"https://api.github.com/users/lcawl","html_url":"https://github.com/lcawl","followers_url":"https://api.github.com/users/lcawl/followers","following_url":"https://api.github.com/users/lcawl/following{/other_user}","gists_url":"https://api.github.com/users/lcawl/gists{/gist_id}","starred_url":"https://api.github.com/users/lcawl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lcawl/subscriptions","organizations_url":"https://api.github.com/users/lcawl/orgs","repos_url":"https://api.github.com/users/lcawl/repos","events_url":"https://api.github.com/users/lcawl/events{/privacy}","received_events_url":"https://api.github.com/users/lcawl/received_events","type":"User","site_admin":false},"body":"Related to https://github.com/elastic/elasticsearch/pull/32013\r\n\r\nThis PR adds a brief conceptual introduction of machine learning rules and filters in the Stack Overview. ","created_at":"2018-07-19T00:05:37Z","updated_at":"2018-07-23T16:38:07Z","closed_at":null,"merged_at":null,"merge_commit_sha":"12be9a5538607847e040ebc8df962581ff230027","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":954190794,"node_id":"MDU6TGFiZWw5NTQxOTA3OTQ=","url":"https://api.github.com/repos/elastic/stack-docs/labels/:ml","name":":ml","color":"0e8a16","default":false},{"id":913469884,"node_id":"MDU6TGFiZWw5MTM0Njk4ODQ=","url":"https://api.github.com/repos/elastic/stack-docs/labels/v6.4.0","name":"v6.4.0","color":"ffffff","default":false},{"id":837392074,"node_id":"MDU6TGFiZWw4MzczOTIwNzQ=","url":"https://api.github.com/repos/elastic/stack-docs/labels/v7.0.0","name":"v7.0.0","color":"ffffff","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/elastic/stack-docs/pulls/84/commits","review_comments_url":"https://api.github.com/repos/elastic/stack-docs/pulls/84/comments","review_comment_url":"https://api.github.com/repos/elastic/stack-docs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/stack-docs/issues/84/comments","statuses_url":"https://api.github.com/repos/elastic/stack-docs/statuses/e71c92c967a740170361e522ac7d4b49be6ab048","head":{"label":"lcawl:lcawley-rules","ref":"lcawley-rules","sha":"e71c92c967a740170361e522ac7d4b49be6ab048","user":{"login":"lcawl","id":26471269,"node_id":"MDQ6VXNlcjI2NDcxMjY5","avatar_url":"https://avatars0.githubusercontent.com/u/26471269?v=4","gravatar_id":"","url":"https://api.github.com/users/lcawl","html_url":"https://github.com/lcawl","followers_url":"https://api.github.com/users/lcawl/followers","following_url":"https://api.github.com/users/lcawl/following{/other_user}","gists_url":"https://api.github.com/users/lcawl/gists{/gist_id}","starred_url":"https://api.github.com/users/lcawl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lcawl/subscriptions","organizations_url":"https://api.github.com/users/lcawl/orgs","repos_url":"https://api.github.com/users/lcawl/repos","events_url":"https://api.github.com/users/lcawl/events{/privacy}","received_events_url":"https://api.github.com/users/lcawl/received_events","type":"User","site_admin":false},"repo":{"id":130920607,"node_id":"MDEwOlJlcG9zaXRvcnkxMzA5MjA2MDc=","name":"stack-docs","full_name":"lcawl/stack-docs","owner":{"login":"lcawl","id":26471269,"node_id":"MDQ6VXNlcjI2NDcxMjY5","avatar_url":"https://avatars0.githubusercontent.com/u/26471269?v=4","gravatar_id":"","url":"https://api.github.com/users/lcawl","html_url":"https://github.com/lcawl","followers_url":"https://api.github.com/users/lcawl/followers","following_url":"https://api.github.com/users/lcawl/following{/other_user}","gists_url":"https://api.github.com/users/lcawl/gists{/gist_id}","starred_url":"https://api.github.com/users/lcawl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lcawl/subscriptions","organizations_url":"https://api.github.com/users/lcawl/orgs","repos_url":"https://api.github.com/users/lcawl/repos","events_url":"https://api.github.com/users/lcawl/events{/privacy}","received_events_url":"https://api.github.com/users/lcawl/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/lcawl/stack-docs","description":"Elastic Stack Documentation","fork":true,"url":"https://api.github.com/repos/lcawl/stack-docs","forks_url":"https://api.github.com/repos/lcawl/stack-docs/forks","keys_url":"https://api.github.com/repos/lcawl/stack-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/lcawl/stack-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/lcawl/stack-docs/teams","hooks_url":"https://api.github.com/repos/lcawl/stack-docs/hooks","issue_events_url":"https://api.github.com/repos/lcawl/stack-docs/issues/events{/number}","events_url":"https://api.github.com/repos/lcawl/stack-docs/events","assignees_url":"https://api.github.com/repos/lcawl/stack-docs/assignees{/user}","branches_url":"https://api.github.com/repos/lcawl/stack-docs/branches{/branch}","tags_url":"https://api.github.com/repos/lcawl/stack-docs/tags","blobs_url":"https://api.github.com/repos/lcawl/stack-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/lcawl/stack-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/lcawl/stack-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/lcawl/stack-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/lcawl/stack-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/lcawl/stack-docs/languages","stargazers_url":"https://api.github.com/repos/lcawl/stack-docs/stargazers","contributors_url":"https://api.github.com/repos/lcawl/stack-docs/contributors","subscribers_url":"https://api.github.com/repos/lcawl/stack-docs/subscribers","subscription_url":"https://api.github.com/repos/lcawl/stack-docs/subscription","commits_url":"https://api.github.com/repos/lcawl/stack-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/lcawl/stack-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/lcawl/stack-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/lcawl/stack-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/lcawl/stack-docs/contents/{+path}","compare_url":"https://api.github.com/repos/lcawl/stack-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/lcawl/stack-docs/merges","archive_url":"https://api.github.com/repos/lcawl/stack-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/lcawl/stack-docs/downloads","issues_url":"https://api.github.com/repos/lcawl/stack-docs/issues{/number}","pulls_url":"https://api.github.com/repos/lcawl/stack-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/lcawl/stack-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/lcawl/stack-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/lcawl/stack-docs/labels{/name}","releases_url":"https://api.github.com/repos/lcawl/stack-docs/releases{/id}","deployments_url":"https://api.github.com/repos/lcawl/stack-docs/deployments","created_at":"2018-04-24T22:28:45Z","updated_at":"2018-07-19T19:36:18Z","pushed_at":"2018-07-19T19:40:14Z","git_url":"git://github.com/lcawl/stack-docs.git","ssh_url":"git@github.com:lcawl/stack-docs.git","clone_url":"https://github.com/lcawl/stack-docs.git","svn_url":"https://github.com/lcawl/stack-docs","homepage":null,"size":18363,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"elastic:master","ref":"master","sha":"40cc86cf9449a15b650270e19e04b2212d0fc044","user":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":71835381,"node_id":"MDEwOlJlcG9zaXRvcnk3MTgzNTM4MQ==","name":"stack-docs","full_name":"elastic/stack-docs","owner":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/elastic/stack-docs","description":"Elastic Stack Documentation","fork":false,"url":"https://api.github.com/repos/elastic/stack-docs","forks_url":"https://api.github.com/repos/elastic/stack-docs/forks","keys_url":"https://api.github.com/repos/elastic/stack-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/stack-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/stack-docs/teams","hooks_url":"https://api.github.com/repos/elastic/stack-docs/hooks","issue_events_url":"https://api.github.com/repos/elastic/stack-docs/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/stack-docs/events","assignees_url":"https://api.github.com/repos/elastic/stack-docs/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/stack-docs/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/stack-docs/tags","blobs_url":"https://api.github.com/repos/elastic/stack-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/stack-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/stack-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/stack-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/stack-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/stack-docs/languages","stargazers_url":"https://api.github.com/repos/elastic/stack-docs/stargazers","contributors_url":"https://api.github.com/repos/elastic/stack-docs/contributors","subscribers_url":"https://api.github.com/repos/elastic/stack-docs/subscribers","subscription_url":"https://api.github.com/repos/elastic/stack-docs/subscription","commits_url":"https://api.github.com/repos/elastic/stack-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/stack-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/stack-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/stack-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/stack-docs/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/stack-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/stack-docs/merges","archive_url":"https://api.github.com/repos/elastic/stack-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/stack-docs/downloads","issues_url":"https://api.github.com/repos/elastic/stack-docs/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/stack-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/stack-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/stack-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/stack-docs/labels{/name}","releases_url":"https://api.github.com/repos/elastic/stack-docs/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/stack-docs/deployments","created_at":"2016-10-24T21:52:57Z","updated_at":"2018-07-20T21:18:24Z","pushed_at":"2018-07-20T21:18:21Z","git_url":"git://github.com/elastic/stack-docs.git","ssh_url":"git@github.com:elastic/stack-docs.git","clone_url":"https://github.com/elastic/stack-docs.git","svn_url":"https://github.com/elastic/stack-docs","homepage":null,"size":16323,"stargazers_count":3,"watchers_count":3,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":11,"mirror_url":null,"archived":false,"open_issues_count":15,"license":null,"forks":11,"open_issues":15,"watchers":3,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/84"},"html":{"href":"https://github.com/elastic/stack-docs/pull/84"},"issue":{"href":"https://api.github.com/repos/elastic/stack-docs/issues/84"},"comments":{"href":"https://api.github.com/repos/elastic/stack-docs/issues/84/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/84/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/84/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/stack-docs/statuses/e71c92c967a740170361e522ac7d4b49be6ab048"}},"author_association":"COLLABORATOR"}}
{"actor":{"display_login":"dimitris-athanasiou"}}