# Creating ML using saved search

**URL:** <https://discuss.elastic.co/t/creating-ml-using-saved-search/149570>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [September 22, 2018, 7:14pm UTC](https://discuss.elastic.co/t/creating-ml-using-saved-search/149570 "2018-09-22T19:14:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yeruvavasavi](https://avatars.discourse-cdn.com/v4/letter/y/258eb7/32.png) [@yeruvavasavi](https://discuss.elastic.co/u/yeruvavasavi)\
**Post date:** [September 22, 2018, 7:14pm UTC](https://discuss.elastic.co/t/creating-ml-using-saved-search/149570/1 "2018-09-22T19:14:25Z")

</div>

Hi elastic team,  
My job is to create a ML job in file beat when the message has error in it . For example  
DSL query is : "query" : { " match" : { "message" : "error"}}.

Can you give me an example of how saved search is used in creating an advanced ML Job

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [September 23, 2018, 12:21am UTC](https://discuss.elastic.co/t/creating-ml-using-saved-search/149570/2 "2018-09-23T00:21:20Z")

</div>

Easiest way to do this is via a Kibana saved search (shown using v6.4 below):

1. create the desired search in Kibana, and then click Save:  

2. Name the search:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d8a2829009ce0b706fdcb1f925ecb8713ae9f4a.png)

3. when creating an ML job - select the name of your saved search from the right hand side:  

4. Configure the rest of your job.

5. Notice that once you've created the job - the saved search can be seen in the datafeed config:

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bf5ea4655f0b5e4a218862fb3c18a45f3d794e3a.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 29, 2018, 10:04pm UTC](https://discuss.elastic.co/t/creating-ml-using-saved-search/149570/3 "2018-10-29T22:04:24Z")

</div>