# Check Forecast accuracy with scripted field

**URL:** https://discuss.elastic.co/t/check-forecast-accuracy-with-scripted-field/324650
**Category:** Kibana
**Tags:** elastic-stack-machine-learning
**Created:** [February 3, 2023, 1:31pm UTC](https://discuss.elastic.co/t/check-forecast-accuracy-with-scripted-field/324650 "2023-02-03T13:31:06Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![CHP93](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@CHP93](https://discuss.elastic.co/u/CHP93)
#### Post date: [February 3, 2023, 1:31pm UTC](https://discuss.elastic.co/t/check-forecast-accuracy-with-scripted-field/324650/1 "2023-02-03T13:31:06Z")

</div>

Hello community,

I have a quite challenging task and have not found a solution for my problem, yet.  
I created a multi-metric anomalies detection machine learning job which is running a forecast as well. My aim is now to compare the forecast results with the actual results to get a sense of the accuracy and quality of the calculated forecast. In my knowledge the only possible way of solving this task would be to create a scripted field. I am not sure if it is already possible within Kibana to compare fields from different index pattern. I hope someone is able to help me with that challenge!

Thank you!

Christoph

---

<div class="post-metadata">

### Author: ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)
#### Post date: [February 5, 2023, 5:00pm UTC](https://discuss.elastic.co/t/check-forecast-accuracy-with-scripted-field/324650/2 "2023-02-05T17:00:32Z")

</div>

I think you might be able to achieve this, but it will be kind of weird.

You might be able to achieve this using [transforms](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) and the [lookup runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-retrieving-fields.html#lookup-runtime-fields).

Concept, use transforms with the source index containing the actual data. Add a lookup runtime field that searches against the forecast index to add the forecast data to the actual data document. Transform will then index this result into a new index/document which will contain all of the needed information where you can then perform the comparison.

Note: You need to do this round-about transform method because of the limitations with the lookup runtime field not being able to be aggregated against directly.

---

<div class="post-metadata">

### Author: ![CHP93](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@CHP93](https://discuss.elastic.co/u/CHP93)
#### Post date: [February 10, 2023, 8:12am UTC](https://discuss.elastic.co/t/check-forecast-accuracy-with-scripted-field/324650/3 "2023-02-10T08:12:12Z")

</div>

Hello Ben,

thank you for your answer! The past days I tried to implement your solution. I can transform the actual data over into a separate index. Unfortunately I am struggling with the second transform from the forecast index pulling the data over to the new index. Is that possible with a transform as well or do I need to implement a runtime field. How could such a runtime lookup look like? Maybe you can help me with that. Thank you!

Christoph

---

<div class="post-metadata">

### Author: ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)
#### Post date: [February 10, 2023, 4:23pm UTC](https://discuss.elastic.co/t/check-forecast-accuracy-with-scripted-field/324650/4 "2023-02-10T16:23:20Z")

</div>

Hmm, so I think you should only need one transform. In that transform you should use your "real" data index, then add a lookup runtime field that queries your "forecast" index.

Maybe something like;

```auto
PUT _transform/asdf
{
  "source": {
    "index": [
      "metrics-kubernetes.container-private.kubernetes.development"
    ],
    "runtime_mappings": {
      "ml_forecast": {
	  	"type": "lookup",
	  	"target_index": ".ml-anomalies-custom-kubernetes_container_resource_regressions_development",
	  	"input_field": "kubernetes.pod.name"
	  	"target_field": "kubernetes.pod.name",
	  	"fetch_fields": ["forecast_*"]
	  }
    }
  },
  "pivot": {
    "group_by": {
      "kubernetes.pod.name": {
        "terms": {
          "field": "kubernetes.pod.name"
        }
      },
      "kubernetes.container.name": {
        "terms": {
          "field": "kubernetes.container.name"
        }
      },
      "ml_forecast": {
        "terms": {
          "field": "ml_forecast"
        }
      }
    },
    "aggregations": {
      "kubernetes.container.cpu.usage.nanocores.avg": {
        "avg": {
          "field": "kubernetes.container.cpu.usage.nanocores"
        }
      }
    }
  },
  "dest": {
    "index": "asdf"
  },
  "sync": {
    "time": {
      "field": "@timestamp"
    }
  }
}

```

This is just a theoretical example, I'm not 100% sure it will work. Just more to demonstrate the idea.

Note, it looks like you can't add lookup runtimes via the Kibana UI, I opened this [issue](https://github.com/elastic/kibana/issues/150914) about it. So, you'll need to create the transform via the Elasticsearch API.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 10, 2023, 4:23pm UTC](https://discuss.elastic.co/t/check-forecast-accuracy-with-scripted-field/324650/5 "2023-03-10T16:23:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
