# Applying ml jobs on raw data without installing network packet beats or other beats

**URL:** https://discuss.elastic.co/t/applying-ml-jobs-on-raw-data-without-installing-network-packet-beats-or-other-beats/373402
**Category:** Elasticsearch
**Created:** [January 20, 2025, 12:47pm UTC](https://discuss.elastic.co/t/applying-ml-jobs-on-raw-data-without-installing-network-packet-beats-or-other-beats/373402 "2025-01-20T12:47:21Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Snow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/snow/32/139864_2.png) [@Snow](https://discuss.elastic.co/u/Snow)
#### Post date: [January 20, 2025, 12:47pm UTC](https://discuss.elastic.co/t/applying-ml-jobs-on-raw-data-without-installing-network-packet-beats-or-other-beats/373402/1 "2025-01-20T12:47:21Z")

</div>

I have forwarded my raw log to elastic (custom udp integration), i have not installed beats(eg: packetbeat and other). I could see some of rules like below,

**DNS Tunneling**

"query": {  
"bool": {  
"filter": [  
{  
"term": {  
"agent.type": "packetbeat"  
}  
}  
],  
"should": [  
{  
"term": {  
"event.dataset": "dns"  
}  
},  
{  
"term": {  
"event.dataset": "network\_traffic.dns"  
}  
}  
],  
"minimum\_should\_match": 1,  
"must\_not": [  
{  
"bool": {  
"filter": {  
"term": {  
"destination.ip": "169.254.169.254"  
}  
}  
}  
}  
]  
}  
},

how to apply this ml to my log?