@cryptotaxi247 / netdata-1 / commits / 31b5e8891

ML: Add documentation for Netdata Insights (#20425)

Co-authored-by: ilyam8 <ilya@netdata.cloud>

Kanela committed Jun 5, 2025 at 19:04 UTC 31b5e8891bd7ab333f058cb85c44b657d1fab330
4 files changed +296 -158
docs/metric-correlations.md
+18 -15
@@ -46,24 +46,27 @@ When you notice an anomaly in your system, use Metric Correlations with the **An
46 ### How to Use Together
47
48 ```mermaid
49 -flowchart TD
50 - %% Node styling
51 - classDef neutral fill:#f9f9f9,stroke:#000000,color:#000000,stroke-width:2px
52 - classDef success fill:#4caf50,stroke:#000000,color:#000000,stroke-width:2px
53 - classDef warning fill:#ffeb3b,stroke:#000000,color:#000000,stroke-width:2px
54 - classDef danger fill:#f44336,stroke:#000000,color:#000000,stroke-width:2px
49 +flowchart LR
50 + A("**STEP 1**<br/><br/>**Detection**<br/><br/>Spot a spike in the<br/>node anomaly <br/>rate chart<br/><br/>")
51 + B("**STEP 2**<br/><br/>**Selection**<br/><br/>Highlight specific<br/>time period<br/><br/><br/>")
52 + C("**STEP 3**<br/><br/>**Configuration**<br/><br/>Select **Anomaly Rate<br/>as data type** and<br/>**Volume as method**<br/><br/>")
53 + D("**STEP 4**<br/><br/>**Execute**<br/><br/>Click on<br/> **Find Correlations**<br/>to start analysis<br/><br/>")
54 + E("**STEP 5**<br/><br/>**Analysis**<br/><br/>Review metrics<br/>with<br/>highest anomaly rates<br/><br/>")
55 + F("**STEP 6**<br/><br/>**Resolution**<br/><br/>Examine metrics<br/> to determine<br/>root cause<br/><br/>")
56
56 - A[Spot a spike in the<br/>node anomaly rate chart] --> B[Highlight that<br/>time period]
57 - B --> C[Select Anomaly Rate<br/>as data type<br/>and Volume as method]
58 - C --> D[Click Find Correlations]
59 - D --> E[Review metrics with<br/>highest anomaly rates]
60 - E --> F[Examine these metrics<br/>in detail to determine<br/>root cause]
57 + A --> B --> C --> D --> E --> F
58 +
59 + %% Style definitions
60 + classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:4px,color:#000000,font-size:22px
61 + classDef process fill:#ffeb3b,stroke:#000000,stroke-width:4px,color:#000000,font-size:22px
62 + classDef complete fill:#4caf50,stroke:#000000,stroke-width:4px,color:#000000,font-size:22px
63 + classDef anomaly fill:#f44336,stroke:#000000,stroke-width:4px,color:#000000,font-size:22px
64
65 %% Apply styles
66 class A,B neutral
64 - class C,D warning
65 - class E success
66 - class F danger
67 + class C,D process
68 + class E complete
69 + class F anomaly
70 ```
71
72 :::tip
@@ -294,4 +297,4 @@ Choose the **`Volume`** algorithm for sparse metrics (e.g., request latency with
297
298 Combine **`Volume`** and **`Anomaly Rate`** to identify the most anomalous metrics within your selected timeframe. Expand the anomaly rate chart to visualize results more clearly.
299
297 -:::
300 +:::
\ No newline at end of file
docs/netdata-assistant.md
+138 -35
@@ -1,8 +1,46 @@
1 -# Alert Troubleshooting with Netdata Assistant
1 +# Netdata AI: Alert Assistant & Infrastructure Insights
2
3 -**The Netdata Assistant leverages large language models and community knowledge** to simplify alert troubleshooting and root cause analysis.
3 +**Netdata AI provides intelligent assistance for both immediate alert response and strategic infrastructure analysis** using advanced AI to help you understand incidents quickly and synthesize high-resolution metrics into actionable intelligence.
4
5 -This AI-powered tool helps you understand alerts quickly, **especially during critical situations**.
5 +This comprehensive system combines **real-time alert assistance** for emergency troubleshooting with **strategic infrastructure insights** for long-term planning, helping you both respond to immediate incidents and make informed decisions about your infrastructure's future.
6 +
7 +## Two Complementary Approaches
8 +
9 +Netdata Insights serves different moments in your engineering workflow through two distinct but complementary capabilities:
10 +
11 +| Aspect | **Real-time Alert Assistant** | **Strategic Insights Reports** |
12 +|----------------------|-----------------------------------|--------------------------------------------------------------------------------------------------|
13 +| **Primary Use** | **Immediate incident response** | Strategic planning & analysis |
14 +| **When You Use It** | During active alerts | Post-incident, planning sessions |
15 +| **Mindset** | "The building is on fire" | "Let's understand and plan better" |
16 +| **Response Time** | **Instant contextual help** | **2-3 minutes for comprehensive analysis** |
17 +| **Scope** | Single alert or immediate issue | Infrastructure-wide trends and patterns |
18 +| **Output** | Quick explanations and next steps | Detailed reports with embedded visualizations, **downloadable as PDFs**, **shareable via email** |
19 +| **Typical Scenario** | 3 AM emergency response | Monday morning incident review |
20 +
21 +:::tip
22 +
23 +These serve fundamentally different moments in an engineer's workflow. The **Assistant** is for high-stress situations when you need immediate context, while **Insights Reports** are for when you have time to think strategically about your infrastructure's health and future needs.
24 +
25 +:::
26 +
27 +:::note
28 +
29 +**Netdata Insights is currently in beta as a research preview:**
30 +
31 +- Available in Netdata Cloud for Business users and Free Trial participants
32 +- Works with any infrastructure where you've deployed Netdata agents
33 +- No additional configuration or new pipelines required
34 +- Everyone gets 10 reports to generate for free
35 +- Community users can get early access via Discord or email to product@netdata.cloud
36 +
37 +:::
38 +
39 +## Real-time Alert Assistant
40 +
41 +**Get immediate context and guidance when alerts fire** - exactly when you need it most, especially during critical situations.
42 +
43 +The Assistant provides instant explanations and troubleshooting steps directly within your alert workflow, helping you understand what's happening without leaving the Netdata interface.
44
45 | Feature | Benefit |
46 |---------------------------|-----------------------------------------------------------------------------------------------------------------------|
@@ -12,7 +50,7 @@ This AI-powered tool helps you understand alerts quickly, **especially during cr
50 | **Time-Saving** | Eliminates the need for searches across multiple documentation sources or community forums. |
51 | **Non-Intrusive** | Provides helpful guidance without taking control away from you - you remain in charge of the troubleshooting process. |
52
15 -## Using Netdata Assistant
53 +### Using the Alert Assistant
54
55 <details>
56 <summary><strong>Accessing the Assistant</strong></summary><br/>
@@ -47,47 +85,112 @@ When you open the Assistant, you'll see:
85
86 </details>
87
50 -## How Netdata Assistant Helps You
88 +### Real-World Alert Response
89
52 -:::tip
53 -
54 -Netdata Assistant is designed to reduce your troubleshooting time by providing contextual information exactly when you need it.
55 -
56 -:::
57 -
58 -- 🔍 **Immediate Alert Context** - Get clear explanations of alerts without searching documentation or forums
59 -- ⚠️ **Impact Assessment** - Understand the severity and potential consequences of issues on your system's performance and stability.
60 -- 🛠️ **Guided Troubleshooting** - Receive customized steps for your specific situation.
61 -- 📚 **Curated Resources** - Access relevant documentation for deeper investigation.
62 -- 🔄 **Persistent Assistance**- Keep the Assistant window with you throughout your troubleshooting journey.
63 -
64 -## Practical Example
65 -
66 -Here's how Netdata Assistant can help in a real-world scenario:
90 +Here's how the Alert Assistant helps in a critical situation:
91
92 ```mermaid
93 flowchart LR
70 - %% Node styling
71 - classDef neutral fill:#f9f9f9,stroke:#000000,color:#000000,stroke-width:2px
72 - classDef success fill:#4caf50,stroke:#000000,color:#000000,stroke-width:2px
73 - classDef warning fill:#ffeb3b,stroke:#000000,color:#000000,stroke-width:2px
74 - classDef danger fill:#f44336,stroke:#000000,color:#000000,stroke-width:2px
94 + A("**3 AM Alert**<br/><br/>load average 15<br/><br/>Emergency Response")
95 +
96 + B("**Without Assistant**<br/><br/>Google searches<br/><br/>Manual Research")
97
76 - A["🕒 3 AM Alert<br/>load average 15"] --> B["Without Assistant:<br/>🔍 Google searches"]
77 - A --> C["With Assistant:<br/>🤖 Click Assistant button"]
98 + C("**With Assistant**<br/><br/>Click Assistant button<br/><br/>Instant Help")
99
79 - B --> D["🕰️ Time wasted<br/>Stress increased"]
100 + D("**Time wasted<br/><br/>Stress increased<br/><br/>Delayed Resolution**")
101
81 - subgraph AssistantProcess ["Assistant Process"]
82 - direction LR
83 - E["📊 Explanation of<br/>system load cause"] --> F["🛠️ Specific troubleshooting<br/>steps provided"] --> G["🔄 Assistant follows as<br/>you check metrics"] --> H["📚 Quick access to<br/>additional resources"] --> I["⚡ Issue resolved faster<br/>with confidence"]
84 - end
102 + E("**Explanation of<br/><br/>system load cause<br/><br/>Immediate Context**")
103
104 + F("**Specific troubleshooting<br/><br/>steps provided<br/><br/>Guided Actions**")
105 +
106 + G("**Assistant follows as<br/><br/>you check metrics<br/><br/>Continuous Support**")
107 +
108 + H("**Quick access to<br/><br/>additional resources<br/><br/>Extended Learning**")
109 +
110 + I("**Issue resolved faster<br/><br/>with confidence<br/><br/>Successful Resolution**")
111 +
112 + A --> B
113 + A --> C
114 + B --> D
115 C --> E
116 + E --> F
117 + F --> G
118 + G --> H
119 + H --> I
120 +
121 + %% Style definitions
122 + classDef alert fill:#ffeb3b,stroke:#000000,stroke-width:3px,color:#000000,font-size:18px
123 + classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:3px,color:#000000,font-size:18px
124 + classDef complete fill:#4caf50,stroke:#000000,stroke-width:3px,color:#000000,font-size:18px
125 + classDef problem fill:#f44336,stroke:#000000,stroke-width:3px,color:#000000,font-size:18px
126
127 %% Apply styles
89 - class A,B,D danger
90 - class C,E,F,G,H,I success
128 + class A alert
129 + class B,C neutral
130 + class D problem
131 + class E,F,G,H,I complete
132 ```
133
93 -By using Netdata Assistant, you can resolve issues faster and with more confidence, even during stressful situations.
134 +## Strategic Insights Reports
135 +
136 +**Generate comprehensive infrastructure analysis** that synthesizes days, weeks, or months of high-resolution data into actionable intelligence for strategic decision-making.
137 +
138 +**Insights Reports transform your raw telemetry data into structured narratives** that help you understand trends, plan capacity, optimize performance, and conduct thorough post-incident analysis.
139 +
140 +### Four Types of Strategic Analysis
141 +
142 +| Report Type | What It Provides | Key Capabilities | Best Used For |
143 +|------------------------------|-----------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
144 +| **Infrastructure Summary** | Complete timeline of incidents, performance changes, and system behavior | **What happened**: Timeline reconstruction **Impact assessment**: Affected services **Current status**: Action items | Weekend incident recovery, executive updates, team handoffs |
145 +| **Capacity Planning** | Data-driven projections with concrete recommendations | **Trend analysis**: Resource utilization patterns **Bottleneck prediction**: Inflection-point dates **Scaling recommendations**: Hardware suggestions | Quarterly planning, budget justification, infrastructure roadmaps |
146 +| **Performance Optimization** | Synthesized analysis of system inefficiencies and improvement opportunities | **Contention patterns**: Resource conflicts **Optimization opportunities**: Tuning recommendations **Impact prioritization**: Biggest improvement areas | Performance debugging, system tuning, SRE optimization projects |
147 +| **Anomaly Analysis** | Context-aware detection and explanation of unusual infrastructure behavior | **Pattern recognition**: Abnormal behavior **Root cause analysis**: Why anomalies occurred **Trend correlation**: Cross-infrastructure connections | Post-incident analysis, proactive issue detection, system health assessment |
148 +
149 +:::tip
150 +
151 +**Simply request the analysis you need and get comprehensive reports** that turn months of raw telemetry data into clear, actionable intelligence that helps you make better infrastructure decisions faster.
152 +
153 +:::
154 +
155 +## How Netdata Insights Works
156 +
157 +The system combines three key components to deliver infrastructure intelligence at scale:
158 +
159 +<details>
160 +<summary><strong>1. Data Pipeline</strong></summary><br/>
161 +
162 +Your Netdata agents continue collecting metrics every second, storing them locally as they always have. **When you request analysis, Insights queries relevant time ranges across your infrastructure**, pulling raw metrics, events, and anomaly detection results.
163 +
164 +</details>
165 +
166 +<details>
167 +<summary><strong>2. Context Compression</strong></summary><br/>
168 +
169 +Raw telemetry data is compressed into structured context bundles that include:
170 +
171 +- **Statistical summaries** (percentiles, trends, correlation coefficients)
172 +- **Detected anomalies** with confidence scores and affected metrics
173 +- **Event timelines** (alerts, deployments, configuration changes)
174 +- **Cross-node correlations** and dependency mappings
175 +- **Historical baselines** for comparison
176 +
177 +</details>
178 +
179 +<details>
180 +<summary><strong>3. AI Analysis</strong></summary><br/>
181 +
182 +**Advanced language models process the compressed context** to generate structured reports with natural-language explanations, relevant visualizations, and actionable recommendations.
183 +
184 +:::important
185 +
186 +Your infrastructure data is processed for your reports and then discarded. **We never use them for training or model improvement**.
187 +
188 +:::
189 +
190 +</details>
191 +
192 +## What's Coming Next
193 +
194 +The goal is building **an autonomous debugging partner, not just another chatbot**. A system that scales human decision-making using all the info that Netdata already collects about your infrastructure.
195 +
196 +For details on upcoming features and our product roadmap, [read our full announcement on the Netdata blog](https://www.netdata.cloud/blog/netdata-insights/).
\ No newline at end of file
src/ml/README.md
+49 -43
@@ -45,56 +45,62 @@ Netdata deliberately avoids using deep learning models, as they would introduce
45
46 ```mermaid
47 flowchart TD
48 - %% Node styling
49 - classDef neutral fill:#f9f9f9,stroke:#000000,color:#000000,stroke-width:2px
50 - classDef success fill:#4caf50,stroke:#000000,color:#000000,stroke-width:2px
51 - classDef warning fill:#ffeb3b,stroke:#000000,color:#000000,stroke-width:2px
52 - classDef danger fill:#f44336,stroke:#000000,color:#000000,stroke-width:2px
48 + Raw("**Raw Metrics**<br/><br/>Last 4 Hours")
49 + Preprocess("**Preprocess**<br/><br/>Feature Vectors")
50 + Train("**Train k-means<br/><br/>k=2**")
51 + Model("**Trained Model**")
52
54 - %% Training Process
55 - subgraph TrainingProcess["Training Process"]
56 - direction TB
57 - Raw["Raw Metrics<br/>(Last 4 Hours)"] --> Preprocess["Preprocess<br/>Feature Vectors"]
58 - Preprocess --> Train["Train k-means<br/>(k=2)"]
59 - Train --> Model["Trained Model"]
60 - end
53 + M1("Model 1<br/><br/>**Recent Data**")
54 + M2("Model 2<br/><br/>**Older Data**")
55 + M3("Model 3<br/><br/>**Even Older Data**")
56 + MN("Model N<br/><br/>**Up to 2 Days Old**")
57
62 - %% Multiple Models
63 - subgraph MultipleModels["Multiple Models Over Time"]
64 - direction TB
65 - M1["Model 1<br/>Recent Data"]
66 - M2["Model 2<br/>Older Data"]
67 - M3["Model 3<br/>Even Older Data"]
68 - MN["Model N<br/>Up to 2 Days Old"]
69 - end
58 + NewData("**New Metrics**")
59 + DistCalc("**Calculate**<br/><br/>Euclidean Distance<br/>to Cluster Centers")
60 + Threshold("**Distance > 99th**<br/><br/>Percentile?")
61 + FlagA("**Flag as Anomalous**<br/><br/>in This Model")
62 + FlagN("**Flag as Normal**<br/><br/>in This Model")
63
71 - %% Detection Process
72 - subgraph DetectionProcess["Detection Process"]
73 - direction TB
74 - NewData["New Metrics"] --> DistCalc["Calculate Euclidean Distance<br/>to Cluster Centers"]
75 - DistCalc --> Threshold{"Distance > 99th<br/>Percentile?"}
76 - Threshold -->|Yes| FlagA["Flag as Anomalous<br/>in This Model"]
77 - Threshold -->|No| FlagN["Flag as Normal<br/>in This Model"]
78 - end
64 + AllResults("**Results from All Models**")
65 + AllAgree("**All Models<br/><br/>Agree it's<br/><br/>Anomalous?**")
66 + SetBit("**Set Anomaly Bit = 100**<br/><br/>True")
67 + ClearBit("**Set Anomaly Bit = 0**<br/><br/>False")
68
80 - %% Consensus
81 - subgraph Consensus["Consensus Decision"]
82 - direction TB
83 - AllResults["Results from All Models"] --> AllAgree{"All Models<br/>Agree it's<br/>Anomalous?"}
84 - AllAgree -->|Yes| SetBit["Set Anomaly Bit = 100<br/>(True)"]
85 - AllAgree -->|No| ClearBit["Set Anomaly Bit = 0<br/>(False)"]
86 - end
69 + Raw --> Preprocess
70 + Preprocess --> Train
71 + Train --> Model
72 + Model --> M1
73 + Model --> M2
74 + Model --> M3
75 + Model --> MN
76
88 - %% Flow between subgraphs
89 - TrainingProcess --> MultipleModels
90 - MultipleModels --> DetectionProcess
91 - DetectionProcess --> Consensus
77 + M1 --> NewData
78 + M2 --> NewData
79 + M3 --> NewData
80 + MN --> NewData
81 +
82 + NewData --> DistCalc
83 + DistCalc --> Threshold
84 + Threshold -->|Yes| FlagA
85 + Threshold -->|No| FlagN
86 +
87 + FlagA --> AllResults
88 + FlagN --> AllResults
89 + AllResults --> AllAgree
90 + AllAgree -->|Yes| SetBit
91 + AllAgree -->|No| ClearBit
92 +
93 + %% Style definitions
94 + classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
95 + classDef process fill:#ffeb3b,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
96 + classDef complete fill:#4caf50,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
97 + classDef anomaly fill:#f44336,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
98
99 %% Apply styles
100 class Raw,Preprocess,NewData,AllResults neutral
95 - class Train,Model,M1,M2,M3,MN,DistCalc success
96 - class Threshold,FlagA,FlagN,AllAgree warning
97 - class SetBit,ClearBit danger
101 + class Train,Model,M1,M2,M3,MN,DistCalc,Threshold,AllAgree process
102 + class FlagN,ClearBit complete
103 + class FlagA,SetBit anomaly
104 ```
105
106 ### Training & Detection
@@ -175,4 +181,4 @@ With Netdata ML, you get reliable, real-time anomaly detection with minimal fals
181 For more information:
182
183 - [Anomaly Advisor](/docs/dashboards-and-charts/anomaly-advisor-tab.md)
178 -- [ML Configuration Guide](/src/ml/ml-configuration.md)
184 +- [ML Configuration Guide](/src/ml/ml-configuration.md)
\ No newline at end of file
src/ml/ml-configuration.md
+91 -65
@@ -19,21 +19,24 @@ Netdata implements machine learning using the lightweight [dlib](https://github.
19
20 ```mermaid
21 flowchart TD
22 - %% Node styling
23 - classDef neutral fill:#f9f9f9,stroke:#000000,color:#000000,stroke-width:2px
24 - classDef success fill:#4caf50,stroke:#000000,color:#000000,stroke-width:2px
25 - classDef warning fill:#ffeb3b,stroke:#000000,color:#000000,stroke-width:2px
26 - classDef danger fill:#f44336,stroke:#000000,color:#000000,stroke-width:2px
22 + Dlib("dlib C++ Library<br/><br/>Implementation")
23
28 - Dlib[dlib C++ Library Implementation]
24 + Efficiency("Run efficiently on<br/><br/>any system without<br/><br/>heavy dependencies")
25 + Resources("Minimize resource usage<br/><br/>while maintaining<br/><br/>high accuracy")
26 + Codebase("Operate within the<br/><br/>constraints of agent's<br/><br/>C/C++ codebase")
27
30 - Dlib --> Efficiency[Run efficiently on<br/>any system without<br/>heavy dependencies]
31 - Dlib --> Resources[Minimize resource usage<br/>while maintaining<br/>high accuracy]
32 - Dlib --> Codebase[Operate within the<br/>constraints of agent's<br/>C/C++ codebase]
28 + Dlib --> Efficiency
29 + Dlib --> Resources
30 + Dlib --> Codebase
31 +
32 + %% Style definitions
33 + classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
34 + classDef process fill:#ffeb3b,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
35 + classDef complete fill:#4caf50,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
36
37 %% Apply styles
35 - class Dlib warning
36 - class Efficiency,Resources,Codebase success
38 + class Dlib process
39 + class Efficiency,Resources,Codebase complete
40 ```
41
42 :::note
@@ -92,51 +95,74 @@ When your system detects a potential anomaly:
95
96 ```mermaid
97 flowchart TD
95 - %% Node styling
96 - classDef neutral fill:#f9f9f9,stroke:#000000,color:#000000,stroke-width:2px
97 - classDef success fill:#4caf50,stroke:#000000,color:#000000,stroke-width:2px
98 - classDef warning fill:#ffeb3b,stroke:#000000,color:#000000,stroke-width:2px
99 - classDef danger fill:#f44336,stroke:#000000,color:#000000,stroke-width:2px
100 -
101 - %% Input data
102 - NewData[New Metric Data Point] --> M1 & M2 & M3 & M4
103 -
104 - %% Models
105 - subgraph Models[Multiple Time-Scale Models]
106 - M1[Model 1<br/>Recent 3h]
107 - M2[Model 2<br/>3-6h ago]
108 - M3[Model 3<br/>6-9h ago]
109 - M4[Model N<br/>Older periods]
110 - end
111 -
112 - %% Decisions
113 - M1 --> D1{Anomalous?}
114 - M2 --> D2{Anomalous?}
115 - M3 --> D3{Anomalous?}
116 - M4 --> D4{Anomalous?}
117 -
118 - %% Results
119 - D1 -->|Yes| R1[Model 1: Anomaly]
120 - D1 -->|No| N1[Model 1: Normal]
121 - D2 -->|Yes| R2[Model 2: Anomaly]
122 - D2 -->|No| N2[Model 2: Normal]
123 - D3 -->|Yes| R3[Model 3: Anomaly]
124 - D3 -->|No| N3[Model 3: Normal]
125 - D4 -->|Yes| R4[Model N: Anomaly]
126 - D4 -->|No| N4[Model N: Normal]
127 -
128 - %% Consensus
129 - R1 & R2 & R3 & R4 --> AllYes{All<br/>Models<br/>Agree?}
130 - N1 & N2 & N3 & N4 ---> AllNo[Set Anomaly Bit = 0<br/>Normal]
131 - AllYes -->|Yes| AllAnom[Set Anomaly Bit = 1<br/>Anomalous]
98 + NewData("**New Metric<br/><br/>Data Point**")
99 +
100 + M1("**Model 1<br/><br/>Recent 3h**")
101 + M2("**Model 2<br/><br/>3-6h ago**")
102 + M3("**Model 3<br/><br/>6-9h ago**")
103 + M4("**Model N<br/><br/>Older periods**")
104 +
105 + D1("**Anomalous?**")
106 + D2("**Anomalous?**")
107 + D3("**Anomalous?**")
108 + D4("**Anomalous?**")
109 +
110 + R1("**Model 1:<br/><br/>Anomaly**")
111 + N1("**Model 1:<br/><br/>Normal**")
112 + R2("**Model 2:<br/><br/>Anomaly**")
113 + N2("**Model 2:<br/><br/>Normal**")
114 + R3("**Model 3:<br/><br/>Anomaly**")
115 + N3("**Model 3:<br/><br/>Normal**")
116 + R4("**Model N:<br/><br/>Anomaly**")
117 + N4("**Model N:<br/><br/>Normal**")
118 +
119 + AllYes("**All<br/><br/>Models<br/><br/>Agree?**")
120 + AllNo("**Set Anomaly Bit = 0**<br/><br/>Normal")
121 + AllAnom("**Set Anomaly Bit = 1**<br/><br/>Anomalous")
122 +
123 + NewData --> M1
124 + NewData --> M2
125 + NewData --> M3
126 + NewData --> M4
127 +
128 + M1 --> D1
129 + M2 --> D2
130 + M3 --> D3
131 + M4 --> D4
132 +
133 + D1 -->|Yes| R1
134 + D1 -->|No| N1
135 + D2 -->|Yes| R2
136 + D2 -->|No| N2
137 + D3 -->|Yes| R3
138 + D3 -->|No| N3
139 + D4 -->|Yes| R4
140 + D4 -->|No| N4
141 +
142 + R1 --> AllYes
143 + R2 --> AllYes
144 + R3 --> AllYes
145 + R4 --> AllYes
146 + N1 --> AllNo
147 + N2 --> AllNo
148 + N3 --> AllNo
149 + N4 --> AllNo
150 +
151 + AllYes -->|Yes| AllAnom
152 AllYes -->|No| AllNo
153
154 + %% Style definitions
155 + classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
156 + classDef process fill:#ffeb3b,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
157 + classDef complete fill:#4caf50,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
158 + classDef anomaly fill:#f44336,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
159 +
160 %% Apply styles
161 class NewData neutral
136 - class M1,M2,M3,M4 success
137 - class D1,D2,D3,D4,AllYes warning
138 - class R1,R2,R3,R4,AllAnom danger
139 - class N1,N2,N3,N4,AllNo neutral
162 + class M1,M2,M3,M4 complete
163 + class D1,D2,D3,D4,AllYes process
164 + class R1,R2,R3,R4,AllAnom anomaly
165 + class N1,N2,N3,N4,AllNo complete
166 ```
167
168 :::note
@@ -159,24 +185,24 @@ This example assumes three child nodes [streaming](/docs/observability-centraliz
185
186 ```mermaid
187 flowchart BT
162 - %% Node styling
163 - classDef neutral fill:#f9f9f9,stroke:#000000,color:#000000,stroke-width:2px
164 - classDef success fill:#4caf50,stroke:#000000,color:#000000,stroke-width:2px
165 - classDef warning fill:#ffeb3b,stroke:#000000,color:#000000,stroke-width:2px
166 - classDef danger fill:#f44336,stroke:#000000,color:#000000,stroke-width:2px
167 -
168 - C1["Netdata Child 0<br/>ML enabled"]
169 - C2["Netdata Child 1<br/>ML enabled"]
170 - C3["Netdata Child 2<br/>ML disabled"]
171 - P1["Netdata Parent<br/>(ML enabled for itself<br/>and Child 1 & 2)"]
188 + C1("**Netdata Child 0**<br/><br/>ML enabled")
189 + C2("**Netdata Child 1**<br/><br/>ML enabled")
190 + C3("**Netdata Child 2**<br/><br/>ML disabled")
191 + P1("**Netdata Parent**<br/><br/>(ML enabled for itself<br/><br/>and Child 1 & 2)")
192 +
193 C1 --> P1
194 C2 --> P1
195 C3 --> P1
196
197 + %% Style definitions
198 + classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
199 + classDef process fill:#ffeb3b,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
200 + classDef complete fill:#4caf50,stroke:#000000,stroke-width:3px,color:#000000,font-size:16px
201 +
202 %% Apply styles
177 - class C1,C2 success
203 + class C1,C2 complete
204 class C3 neutral
179 - class P1 warning
205 + class P1 process
206 ```
207
208 ```text
@@ -248,4 +274,4 @@ For resource-constrained systems, consider these adjustments:
274 | | `anomaly detection grouping duration` | `1m` - `15m` | Time window for calculating anomaly rates. Default `5m` calculates over a 5-minute rolling window. |
275 | **Skipping Hosts and Charts** | `hosts to skip from training` | - | Excludes specific child hosts from training. Default `!*` means no hosts are skipped. |
276 | | `charts to skip from training` | - | Excludes charts from anomaly detection. By default, Netdata-related charts are excluded. |
251 -| **Model Retention** | `delete models older than` | `1d` - `7d` | How long old models are stored. Default `7d` removes unused models after seven days. |
277 +| **Model Retention** | `delete models older than` | `1d` - `7d` | How long old models are stored. Default `7d` removes unused models after seven days. |
\ No newline at end of file