mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 17:59:23 -04:00
68 lines
3.2 KiB
Text
68 lines
3.2 KiB
Text
[role="xpack"]
|
|
[[ml-jobs]]
|
|
== Creating machine learning jobs
|
|
|
|
Machine learning jobs contain the configuration information and metadata
|
|
necessary to perform an analytics task.
|
|
|
|
{kib} provides the following wizards to make it easier to create jobs:
|
|
|
|
[role="screenshot"]
|
|
image::ml/images/ml-create-job.jpg[Create New Job]
|
|
|
|
A _single metric job_ is a simple job that contains a single _detector_. A
|
|
detector defines the type of analysis that will occur and which fields to
|
|
analyze. In addition to limiting the number of detectors, the single metric job
|
|
creation wizard omits many of the more advanced configuration options.
|
|
|
|
A _multi-metric job_ can contain more than one detector, which is more efficient
|
|
than running multiple jobs against the same data.
|
|
|
|
A _population job_ detects activity that is unusual compared to the behavior of
|
|
the population. For more information, see
|
|
{stack-ov}/ml-configuring-pop.html[Performing population analysis].
|
|
|
|
An _advanced job_ can contain multiple detectors and enables you to configure all
|
|
job settings.
|
|
|
|
{kib} can also recognize certain types of data and provide specialized wizards
|
|
for that context. For example, if you use {filebeat-ref}/index.html[{filebeat}]
|
|
to ship access logs from your
|
|
http://nginx.org/[Nginx] and https://httpd.apache.org/[Apache] HTTP servers to
|
|
{es}, the following wizards appear:
|
|
|
|
[role="screenshot"]
|
|
image::ml/images/ml-data-recognizer-filebeat.jpg[A screenshot of the {filebeat} job creation wizards]
|
|
|
|
Likewise, if you use {auditbeat-ref}/index.html[{auditbeat}] to audit process
|
|
activity on your systems, the following wizards appear:
|
|
|
|
[role="screenshot"]
|
|
image::ml/images/ml-data-recognizer-auditbeat.jpg[A screenshot of the {auditbeat} job creation wizards]
|
|
|
|
These wizards create {ml} jobs, dashboards, searches, and visualizations that
|
|
are customized to help you analyze your {auditbeat} and {filebeat} data.
|
|
|
|
If you are not certain which type of job to create, you can use the
|
|
*Data Visualizer* to learn more about your data and to identify possible fields
|
|
for {ml} analysis.
|
|
|
|
[NOTE]
|
|
===============================
|
|
* If your index pattern does not contain a time field, you cannot use the *Data Visualizer*.
|
|
* If your data is located outside of {es}, you cannot use {kib} to create
|
|
your jobs and you cannot use {dfeeds} to retrieve your data in real time.
|
|
Machine learning analysis is still possible, however, by using APIs to
|
|
create and manage jobs and post data to them. For more information, see
|
|
{ref}/ml-apis.html[Machine Learning APIs].
|
|
===============================
|
|
|
|
Ready to get some hands-on experience? See
|
|
{stack-ov}/ml-getting-started.html[Getting Started with Machine Learning].
|
|
|
|
The following video tutorials also demonstrate single metric, multi-metric, and
|
|
advanced jobs:
|
|
|
|
* https://www.elastic.co/videos/machine-learning-tutorial-creating-a-single-metric-job[Machine Learning for the Elastic Stack: Creating a single metric job]
|
|
* https://www.elastic.co/videos/machine-learning-tutorial-creating-a-multi-metric-job[Machine Learning for the Elastic Stack: Creating a multi-metric job]
|
|
* https://www.elastic.co/videos/machine-learning-lab-3-detect-outliers-in-a-population[Machine Learning for the Elastic Stack: Detect Outliers in a Population]
|