Putting it all together

The two-step process of first categorizing then counting the message-based log lines is implemented as a single configuration step in the ML job. However, two key pieces of the ML job configuration need to exist:

  • The definition of categorization_field_name as the field within the Elasticsearch document that contains the text to be categorized by ML
  • The use of the mlcategory field as part of the detector configuration

Note that the mlcategory field is not part of the actual document of the raw data being analyzed; it is similar to a scripted field that only comes into existence if categorization_field_name is defined as part of the job configuration.

Let's have a look at the following steps:

  1. Given a set of example ...

Get Machine Learning with the Elastic Stack now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.