# Cant' import Machine Learning Anomaly Jobs - I have Enterprise Cloud Subscription **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-machine-learning\ **Created:** [January 23, 2021, 2:26am UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970 "2021-01-23T02:26:56Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![opiedrah](https://avatars.discourse-cdn.com/v4/letter/o/5f9b8f/32.png) [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Post date:** [January 23, 2021, 2:26am UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/1 "2021-01-23T02:26:56Z")
Hi, We are an Elastic Cloud Enterprise customer. The machine learning jobs that are to be prebuilt are missing. ![ML-screenshot](https://us1.discourse-cdn.com/elastic/original/3X/4/4/444167adde84eaaa34f1ea13db11e4d139d8ea8a.png) I have a ML node assigned to the cluster, i can't find where to import them. Cluster is running 7.10.2 Thank you ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 23, 2021, 3:08am UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/2 "2021-01-23T03:08:36Z")
Hi @opiedrah So if this is a brand new cluster there will be no jobs until a) You ingest data via an integration or a beat they will be created during the setup process example Metrics, APM etc... b) You manually create one Which Job were you expecting to see? ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [January 25, 2021, 1:26pm UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/3 "2021-01-25T13:26:26Z")
There are indeed some "pre-built" jobs for the SIEM app and APM, but you need to enable/import those jobs from those apps - not from the general ML UI. For example, reference: [https://www.elastic.co/guide/en/siem/guide/current/machine-learning.html](https://www.elastic.co/guide/en/siem/guide/current/machine-learning.html) ---
**Author:** ![opiedrah](https://avatars.discourse-cdn.com/v4/letter/o/5f9b8f/32.png) [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Post date:** [January 26, 2021, 7:48pm UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/4 "2021-01-26T19:48:15Z")
When i click under SIEM, ML job Settings it shows everything failed, and when i click on each one it shows no job. ![ml-job-settings](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4f5e101d76ee8147bc18d7bb9727a4e05d20a495.png) **No Job** ![NoJob](https://us1.discourse-cdn.com/elastic/original/3X/0/b/0b9eb0f22dbb068fc9806c02c0cc44e062e11ce7.png) ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [January 26, 2021, 9:12pm UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/5 "2021-01-26T21:12:40Z")
The error message indicates that there is no data in your cluster that these ML jobs require in order to install and run. Refer to the job definitions which show the required data necessary: [https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html](https://www.elastic.co/guide/en/siem/guide/current/prebuilt-ml-jobs.html) For example, you can see that the `linux_anomalous_network_url_activity_ecs` requires data collected by from `Auditbeat (Linux)`. And, as you can imagine, the ML jobs whose names begin with `windows` requires data collected via `winlogbeat`. Unless you've collected that kind of data using those beats, the product is working as expected by not allowing you to enable jobs on data that doesn't yet exist. ---
**Author:** ![opiedrah](https://avatars.discourse-cdn.com/v4/letter/o/5f9b8f/32.png) [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Post date:** [February 2, 2021, 5:58pm UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/6 "2021-02-02T17:58:10Z")
> [@richcollier](#): > > efer to the job definitions which show the required data necessa Interesting... We are currently using fleet with the endpoint security integration, this captures security events , network, process etc. So what you are saying is that the ML jobs currently do not work with data from fleet+ElasticEndpoint. One would also have to install winlogbeat for the ML jobs to work? Thanks ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [February 3, 2021, 11:50am UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/7 "2021-02-03T11:50:28Z")
Thank you for the additional information. Yes, there was a compatibility issue with built-in ML jobs not recognizing the indices if the data was collected via the new, consolidated Elastic Agent (since the names of the indices are different than if collected with legacy Beats). Word is that this is fixed in v7.11 due out next week. ---
**Author:** ![opiedrah](https://avatars.discourse-cdn.com/v4/letter/o/5f9b8f/32.png) [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Post date:** [February 3, 2021, 7:41pm UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/8 "2021-02-03T19:41:35Z")
Thank you @richcollier I'll mark it as resolved and hope for the best for 7.11 or 7.12. Do you have any insights on this, or know someone that does? > [@Filebeat o365 module - Parsing o365.audit.data field](https://discuss.elastic.co/t/filebeat-o365-module-parsing-o365-audit-data-field/261591/2): > > I think that using a script processor for this fields is not a bad idea. You can give a try to JSON processor (ingest node): [https://www.elastic.co/guide/en/elasticsearch/reference/current/json-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/json-processor.html) Thanks again ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 3, 2021, 7:42pm UTC](https://discuss.elastic.co/t/cant-import-machine-learning-anomaly-jobs-i-have-enterprise-cloud-subscription/261970/9 "2021-03-03T19:42:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.