Putting it all together

The two-step process of first categorizing then counting the message-based log lines is implemented as a single configuration step in the ML job. However, two key pieces of the ML job configuration need to exist:

  • The definition of categorization_field_name as the field within the Elasticsearch document that contains the text to be categorized by ML
  • The use of the mlcategory field as part of the detector configuration

Note that the mlcategory field is not part of the actual document of the raw data being analyzed; it is similar to a scripted field that only comes into existence if categorization_field_name is defined as part of the job configuration.

Let's have a look at the following steps:

  1. Given a set of example ...

Get Machine Learning with the Elastic Stack now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.