-
Notifications
You must be signed in to change notification settings - Fork 509
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
49 changed files
with
5,323 additions
and
118 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,158 @@ | ||
| --- | ||
| layout: default | ||
| title: Median absolute deviation | ||
| parent: Metric aggregations | ||
| grand_parent: Aggregations | ||
| nav_order: 65 | ||
| redirect_from: | ||
| - /query-dsl/aggregations/metric/median-absolute-deviation/ | ||
| --- | ||
|
|
||
| # Median absolute deviation aggregations | ||
|
|
||
| The `median_absolute_deviation` metric is a single-value metric aggregation that returns a median absolute deviation field. Median absolute deviation is a statistical measure of data variability. Because the median absolute deviation measures dispersion from the median, it provides a more robust measure of variability that is less affected by outliers in a dataset. | ||
|
|
||
| Median absolute deviation is calculated as follows:<br> | ||
| median_absolute_deviation = median(|X<sub>i</sub> - Median(X<sub>i</sub>)|) | ||
|
|
||
| The following example calculates the median absolute deviation of the `DistanceMiles` field in the sample dataset `opensearch_dashboards_sample_data_flights`: | ||
|
|
||
|
|
||
| ```json | ||
| GET opensearch_dashboards_sample_data_flights/_search | ||
| { | ||
| "size": 0, | ||
| "aggs": { | ||
| "median_absolute_deviation_DistanceMiles": { | ||
| "median_absolute_deviation": { | ||
| "field": "DistanceMiles" | ||
| } | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
| {% include copy-curl.html %} | ||
|
|
||
| #### Example response | ||
|
|
||
| ```json | ||
| { | ||
| "took": 35, | ||
| "timed_out": false, | ||
| "_shards": { | ||
| "total": 1, | ||
| "successful": 1, | ||
| "skipped": 0, | ||
| "failed": 0 | ||
| }, | ||
| "hits": { | ||
| "total": { | ||
| "value": 10000, | ||
| "relation": "gte" | ||
| }, | ||
| "max_score": null, | ||
| "hits": [] | ||
| }, | ||
| "aggregations": { | ||
| "median_absolute_deviation_distanceMiles": { | ||
| "value": 1829.8993624441966 | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ### Missing | ||
|
|
||
| By default, if a field is missing or has a null value in a document, it is ignored during computation. However, you can specify a value to be used for those missing or null fields by using the `missing` parameter, as shown in the following request: | ||
|
|
||
| ```json | ||
| GET opensearch_dashboards_sample_data_flights/_search | ||
| { | ||
| "size": 0, | ||
| "aggs": { | ||
| "median_absolute_deviation_distanceMiles": { | ||
| "median_absolute_deviation": { | ||
| "field": "DistanceMiles", | ||
| "missing": 1000 | ||
| } | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
| {% include copy-curl.html %} | ||
|
|
||
| #### Example response | ||
|
|
||
| ```json | ||
| { | ||
| "took": 7, | ||
| "timed_out": false, | ||
| "_shards": { | ||
| "total": 1, | ||
| "successful": 1, | ||
| "skipped": 0, | ||
| "failed": 0 | ||
| }, | ||
| "hits": { | ||
| "total": { | ||
| "value": 10000, | ||
| "relation": "gte" | ||
| }, | ||
| "max_score": null, | ||
| "hits": [] | ||
| }, | ||
| "aggregations": { | ||
| "median_absolute_deviation_distanceMiles": { | ||
| "value": 1829.6443646143355 | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ### Compression | ||
|
|
||
| The median absolute deviation is calculated using the [t-digest](https://github.com/tdunning/t-digest/tree/main) data structure, which balances between performance and estimation accuracy through the `compression` parameter (default value: `1000`). Adjusting the `compression` value affects the trade-off between computational efficiency and precision. Lower `compression` values improve performance but may reduce estimation accuracy, while higher values enhance accuracy at the cost of increased computational overhead, as shown in the following request: | ||
|
|
||
| ```json | ||
| GET opensearch_dashboards_sample_data_flights/_search | ||
| { | ||
| "size": 0, | ||
| "aggs": { | ||
| "median_absolute_deviation_DistanceMiles": { | ||
| "median_absolute_deviation": { | ||
| "field": "DistanceMiles", | ||
| "compression": 10 | ||
| } | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
| {% include copy-curl.html %} | ||
|
|
||
| #### Example response | ||
|
|
||
| ```json | ||
| { | ||
| "took": 1, | ||
| "timed_out": false, | ||
| "_shards": { | ||
| "total": 1, | ||
| "successful": 1, | ||
| "skipped": 0, | ||
| "failed": 0 | ||
| }, | ||
| "hits": { | ||
| "total": { | ||
| "value": 10000, | ||
| "relation": "gte" | ||
| }, | ||
| "max_score": null, | ||
| "hits": [] | ||
| }, | ||
| "aggregations": { | ||
| "median_absolute_deviation_DistanceMiles": { | ||
| "value": 1836.265614211182 | ||
| } | ||
| } | ||
| } | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
18 changes: 18 additions & 0 deletions
18
_data-prepper/pipelines/configuration/processors/write_json.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| --- | ||
| layout: default | ||
| title: write_json | ||
| parent: Processors | ||
| grand_parent: Pipelines | ||
| nav_order: 56 | ||
| --- | ||
|
|
||
| # write_json | ||
|
|
||
|
|
||
| The `write_json` processor converts an object in an event into a JSON string. You can customize the processor to choose the source and target field names. | ||
|
|
||
| | Option | Description | Example | | ||
| | :--- | :--- | :--- | | ||
| | source | Mandatory field that specifies the name of the field in the event containing the message or object to be parsed. | If `source` is set to `"message"` and the input is `{"message": {"key1":"value1", "key2":{"key3":"value3"}}`, then the `write_json` processor generates `{"message": "{\"key1\":\"value`\", \"key2\":"{\"key3\":\"value3\"}"}"`. | ||
| | target | An optional field that specifies the name of the field in which the resulting JSON string should be stored. If `target` is not specified, then the `source` field is used. | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.