There are many cases where we have a handful (10 - 2000) past examples of text data and we want to see if new text is close to these saved examples. Machine learning techniques like classification are not appropriate because we don’t have enough data to train an accurate model.
- Click + on the parent node.
- Enter the Build Term Corpus operator in the search field and select the operator from the Results to open the operator form.
- In the Table drop-down, enter or select a table to create the model.
- In the Model Name field, enter the name of a model.
- In the Column field, enter a column name that contains the text to extract TF-IDF features.
- In the Columns to Keep drop-down, select a column name to store with the corpus as enrichment to retrieve when used in matchSimilarFromCorpus.
- Optional. Click Add More to add values for minimum and maximum TF parameters.
- Click Run to view the result.
- Click Save to add the operator to the playbook.
- Click Cancel to discard the operator form.
We then want to match them against an incoming stream of events to determine how close they are to what we've already observed and retrieve some enrichment about those past examples.
buildTermCorpus(table: TableReference, modelName: String, column:String, columnsToKeep:String, parameters:Double*)
table (TableReference) - The table to create a model
modelName (String) - name of a model
column (String) - Column name that contains the text to extract TF-IDF features
columnsToKeep (String) - list of columns to store with the corpus as enrichment to retrieve when used in matchSimilarFromCorpus
parameters (Double) - minDF and minTF parameters, default values for both is 1.0 (include 100% of terms). First parameter will be always set for minTF. e.g.
buildTermCorpus(table, model, corpus, [columnsToKeep], 0.5, 0.4) // minDF = 0.5, minTF=0.4
If the operator successfully run, it will return success message of model being stored.
table = github_logs
|a b c, d e f, g, h, i, j||x|
|aa b, c, d ee, ff, gg, hh, i, jj||y|
|k, l, m, n, o, p, q||z||apple|
buildModelFromCorpus(inputTable, "corpusModel", "corpus", ["label", "domain"]) // table = inputTable // text to train model = corpus // columns to keep so they will be added after match is found = label and domain // minDF and minTF are default
|'Successfully created model and stored into <|
Updated almost 3 years ago