There are many cases where we have a handful (10 - 2000) past examples of text data and we want to see if new text is close to these saved examples. Machine learning techniques like classification are not appropriate because we don’t have enough data to train an accurate model.
This operator builds a model for each group in the dataset so during matching we find best matches from the same group.
- Click + on the parent node.
- Enter the Build Term Corpus Per Group operator in the search field and select the operator from the Results to open the operator form.
- In the Table drop-down, enter or select a table to create the model.
- In the Model Name field, enter the name of a model.
- In the Grouping Column drop-down, enter or select a column.
- In the Column drop-down, enter or select the column name that contains the text to extract TF-IDF features.
- In the Columns to Keep drop-down, select a column or a list of columns to keep. The drop-down shows the data based on the table selected in the TABLE field.
- Optional. Click Add More to add values for minimum and maximum TF parameters.
- Click Run to view the result.
- Click Save to add the operator to the playbook.
- Click Cancel to discard the operator form.
We then want to match them against an incoming stream of events to determine how close they are to what we've already observed and retrieve some enrichment about those past examples.
buildTermCorpus(table: TableReference, modelName: String, groupName:String, column:String, columnsToKeep:String, parameters:Double*)
table (TableReference) - The table to create a model
modelName (String) - name of a model
groupName (String) - group column to build individual models
column (String) - Column name that contains the text to extract TF-IDF features
columnsToKeep (String) - list of columns to store with the corpus as enrichment to retrieve when used in matchSimilarFromCorpus
parameters (Double) - minDF and minTF parameters, default values for both is 1.0 (include 100% of terms). First parameter will be always set for minTF. e.g.
buildTermCorpus(table, model, corpus, [columnsToKeep], 0.5, 0.4) // minDF = 0.5, minTF=0.4
If the operator successfully run, it will return success message of model being stored.
table = github_logs
|machine1||a b c, d e f, g, h, i, j||x|
|machine1||aa b, c, d ee, ff, gg, hh, i, jj||y|
|machine2||k, l, m, n, o, p, q||z||apple|
buildModelFromCorpus(inputTable, "corpusModel", "server", "corpus", ["label", "domain"]) // table = inputTable // text to train model = corpus // columns to keep so they will be added after match is found = label and domain // minDF and minTF are default
|'Successfully created model and stored into <|
Updated almost 2 years ago