Creating ML using saved search

Hi elastic team,
My job is to create a ML job in file beat when the message has error in it . For example
DSL query is : "query" : { " match" : { "message" : "error"}}.

Can you give me an example of how saved search is used in creating an advanced ML Job

Easiest way to do this is via a Kibana saved search (shown using v6.4 below):

  1. create the desired search in Kibana, and then click Save:

  2. Name the search:

  3. when creating an ML job - select the name of your saved search from the right hand side:

  4. Configure the rest of your job.

  5. Notice that once you've created the job - the saved search can be seen in the datafeed config: