elasticsearch/docs/reference/ml
Benjamin Trent 281ec58b8d
[ML] add new default char filter first_line_with_letters for machine learning categorization (#77457)
The char filter replaces the previous default of `first_non_blank_line`.

`first_non_blank_line` worked well to figure out what line had characters at all, but log lines 
like the following were handled poorly:
```
--------------------------------------------------------------------------------

Alias 'foo' already exists and this prevents setting up ILM for logs

--------------------------------------------------------------------------------
```
When combined with the `ml_standard` tokenizer, the first line was used:
```
--------------------------------------------------------------------------------
```
This has no valid tokens for our standard tokenizer. Consequently, no tokens were found by `ml_standard` tokenizer.


The new filter, `first_line_with_letters`, returns the first line with any letter character (e.g. `Character#isLetter` returns true).

Given the previously poorly handled log, when combining with our `ml_standard` tokenizer, we get the following, more appropriate, tokens:

```
"tokens" : ["Alias", "foo", "already", "exists", "and", "this", "prevents", "setting", "up", "ILM", "for", "logs"]
```
2021-09-09 10:09:57 -04:00
..
anomaly-detection [ML] add new default char filter first_line_with_letters for machine learning categorization (#77457) 2021-09-09 10:09:57 -04:00
df-analytics/apis [DOCS] Fixes admonition formatting (#77393) 2021-09-08 11:20:43 -07:00
images [DOCS] Adds anomaly job health alert type docs (#76659) 2021-08-30 16:11:34 +02:00
ml-shared.asciidoc [DOCS] Fixes model_prune_window property description. (#76711) 2021-08-19 16:16:37 +02:00