Creating ML using saved search

Elastic Stack Kibana
1

Hi elastic team,
My job is to create a ML job in file beat when the message has error in it . For example
DSL query is : "query" : { " match" : { "message" : "error"}}.

Can you give me an example of how saved search is used in creating an advanced ML Job

2

Easiest way to do this is via a Kibana saved search (shown using v6.4 below):

  1. create the desired search in Kibana, and then click Save:

    image
    image.png915×462 54 KB

  2. Name the search:
    image

  3. when creating an ML job - select the name of your saved search from the right hand side:

    image
    image.png790×321 21.9 KB

  4. Configure the rest of your job.

  5. Notice that once you've created the job - the saved search can be seen in the datafeed config:

image