Before we get into the detail of where the results are stored and what they look like at a document level, we need to understand that the results from ML jobs are presented at three different levels of abstraction:
- The bucket level: This level summarizes the results of the entirety of the ML job per time bucket. Essentially, it is a representation of how unusual that time bucket is, given the configuration of your job. If your job has multiple detectors, or splits in the analysis resulting in results for possibly many entities simultaneously, then each bucket level result is an aggregated representation of all of those things.
- The record level: This is the most detailed information about each and every anomalous occurrence or anomalous entity within a time bucket. Again, depending on the job configuration (multiple detectors, splits, and so on), there can...