The two-step process of first categorizing then counting the message-based log lines is implemented as a single configuration step in the ML job. However, two key pieces of the ML job configuration need to exist:
- The definition of categorization_field_name as the field within the Elasticsearch document that contains the text to be categorized by ML
- The use of the mlcategory field as part of the detector configuration
Note that the mlcategory field is not part of the actual document of the raw data being analyzed; it is similar to a scripted field that only comes into existence if categorization_field_name is defined as part of the job configuration.
Let's have a look at the following steps:
- Given a set of example ...
