While somewhat obscured from the user when configuring anything but an Advanced job (or configuring a job via the API), the user does indeed have complete control over the query being made to the raw data index to feed the ML job. This is the Query parameter of the ML job config:
The default is {"match_all":{}} (return every record in the index), but just about any valid Elasticsearch DSL is supported for filtering the data. Free-form composing Elasticsearch DSL into this text field is a little error-prone. Therefore, a more intuitive way would be to approach this from Kibana via saved searches.
For example, let's ...
