creating-jobs.asciidoc

Creating machine learning jobs

Machine learning jobs contain the configuration information and metadata necessary to perform an analytics task.

{kib} provides the following wizards to make it easier to create jobs:

A single metric job is a simple job that contains a single detector. A detector defines the type of analysis that will occur and which fields to analyze. In addition to limiting the number of detectors, the single metric job creation wizard omits many of the more advanced configuration options.

A multi-metric job can contain more than one detector, which is more efficient than running multiple jobs against the same data.

A population job detects activity that is unusual compared to the behavior of the population. For more information, see {stack-ov}/ml-configuring-pop.html[Performing population analysis].

An advanced job can contain multiple detectors and enables you to configure all job settings.

{kib} can also recognize certain types of data and provide specialized wizards for that context. For example, if you use {filebeat-ref}/index.html[{filebeat}] to ship access logs from your Nginx and Apache HTTP servers to {es} and store it using fields and datatypes from the {ecs-ref}/ecs-reference.html[Elastic Common Schema (ECS)], the following wizards appear:

Likewise, if you use {auditbeat-ref}/index.html[{auditbeat}] to audit process activity on your systems, the following wizards appear:

These wizards create {ml} jobs, dashboards, searches, and visualizations that are customized to help you analyze your {auditbeat} and {filebeat} data.

If you are not certain which type of job to create, you can use the Data Visualizer to learn more about your data and to identify possible fields for {ml} analysis.

Note

If your index pattern does not contain a time field, you cannot use the Data Visualizer. If your data is located outside of {es}, you cannot use {kib} to create your jobs and you cannot use {dfeeds} to retrieve your data in real time. Machine learning analysis is still possible, however, by using APIs to create and manage jobs and post data to them. For more information, see {ref}/ml-apis.html[Machine Learning APIs].

Ready to get some hands-on experience? See {stack-ov}/ml-getting-started.html[Getting Started with Machine Learning].

The following video tutorials also demonstrate single metric, multi-metric, and advanced jobs:

• Machine Learning for the Elastic Stack: Creating a single metric job

• Machine Learning for the Elastic Stack: Creating a multi-metric job

• Machine Learning for the Elastic Stack: Detect Outliers in a Population