# Custom Job Management

**URL:** <https://discuss.elastic.co/t/custom-job-management/207646>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [November 13, 2019, 7:37am UTC](https://discuss.elastic.co/t/custom-job-management/207646 "2019-11-13T07:37:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sudhanshu\_Tiwari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhanshu_tiwari/32/47746_2.png) [@Sudhanshu\_Tiwari](https://discuss.elastic.co/u/Sudhanshu_Tiwari)\
**Post date:** [November 13, 2019, 7:37am UTC](https://discuss.elastic.co/t/custom-job-management/207646/1 "2019-11-13T07:37:55Z")

</div>

Hi Team,

I am new in ELK and I am trying to work on Machine Learning feature of Kibana .I have some field related to sip call like start\_time , cause\_code , calling\_party, called\_party.  
My requirement is to create a job that alert me when a particular cause\_code (e.g 404) came within some time spam (e.g. 10m).  
Kibana version 7.4.1  
elasticsearch version 7.4.1  
logstash version 7.4.1  
thanks  
.2019-11-13T07:30:00Z

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [November 13, 2019, 2:49pm UTC](https://discuss.elastic.co/t/custom-job-management/207646/2 "2019-11-13T14:49:23Z")

</div>

1. Create a Multi-metric job.

2. Use "Count (Event rate)" as the feature to have ML track.

3. Choose to "split" the analysis on your `cause_code` field.

4. Choose the "bucket span" to be 10m

Then you will have a job that looks for spikes/dips in documents over 10 minute increments, for every type of `cause_code`.

Voila!

---

<div class="post-metadata">

**Author:** ![Sudhanshu\_Tiwari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhanshu_tiwari/32/47746_2.png) [@Sudhanshu\_Tiwari](https://discuss.elastic.co/u/Sudhanshu_Tiwari)\
**Post date:** [November 14, 2019, 6:13am UTC](https://discuss.elastic.co/t/custom-job-management/207646/3 "2019-11-14T06:13:32Z")

</div>

Hi @richcollier

```
    So what we will get right now, when I'm creating multi-metric job and Count(Event rate) as the feature I am not getting my field (cause_code) as an option in "Split field". so can you tell what is the reason for that.. thanks
```

---

<div class="post-metadata">

**Author:** ![sophie\_chang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sophie_chang/32/18008_2.png) [@sophie\_chang](https://discuss.elastic.co/u/sophie_chang)\
**Post date:** [November 14, 2019, 9:58am UTC](https://discuss.elastic.co/t/custom-job-management/207646/4 "2019-11-14T09:58:38Z")

</div>

Could you provide the mapping type for `cause_code`?

It is possible that the type is not `keyword` in which case it is not available as a split field in the multi-metric wizard.

Instead, please use the advanced wizard. Add a detector and select function `count` and partition field `cause_code` and set the bucket span to be 10m.

Hope this helps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2019, 9:58am UTC](https://discuss.elastic.co/t/custom-job-management/207646/5 "2019-12-12T09:58:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.