# Detect outliers in non timeline based data

**URL:** <https://discuss.elastic.co/t/detect-outliers-in-non-timeline-based-data/201952>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [October 2, 2019, 12:39pm UTC](https://discuss.elastic.co/t/detect-outliers-in-non-timeline-based-data/201952 "2019-10-02T12:39:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![chesini](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@chesini](https://discuss.elastic.co/u/chesini)\
**Post date:** [October 2, 2019, 12:39pm UTC](https://discuss.elastic.co/t/detect-outliers-in-non-timeline-based-data/201952/1 "2019-10-02T12:39:35Z")

</div>

Is it possible to detect outliers in non timeline based data with Elastic ?

I have a data set with lots of fields, in which timestamps/timelines are not relevant.  
The goal is to find field value patterns that do not match desired patterns. The desired patterns should be definable in a quick and easy way, then letting the machine learning find outliers in the population. A further option even would be the machine learning find outliers / anomalies without the help of any predefined desired patterns.

And the reporting then plotting an outlier grid.

Regards.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [October 2, 2019, 1:18pm UTC](https://discuss.elastic.co/t/detect-outliers-in-non-timeline-based-data/201952/2 "2019-10-02T13:18:05Z")

</div>

Yes, as of v7.3 it is possible with an `outlier_detection` job. In v7.4, we have added a UI so that you don't need to create/run it via the API.

See [https://www.elastic.co/guide/en/elastic-stack-overview/current/ecommerce-outliers.html](https://www.elastic.co/guide/en/elastic-stack-overview/current/ecommerce-outliers.html) for an example that uses the [built-in demo data in Kibana](https://www.elastic.co/guide/en/kibana/current/add-sample-data.html).

---

<div class="post-metadata">

**Author:** ![chesini](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@chesini](https://discuss.elastic.co/u/chesini)\
**Post date:** [October 2, 2019, 1:51pm UTC](https://discuss.elastic.co/t/detect-outliers-in-non-timeline-based-data/201952/3 "2019-10-02T13:51:14Z")

</div>

I see it's limited to numeric fields (in 7.4.0). Will non-numerics be supported in the future ?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [October 2, 2019, 4:42pm UTC](https://discuss.elastic.co/t/detect-outliers-in-non-timeline-based-data/201952/4 "2019-10-02T16:42:30Z")

</div>

Perhaps it will be supported in the future - and if you could describe your use-case and requirements in more depth, that might help guide future development work! Like, for example, sample field values, examples of what you would consider an outlier value, etc. Thanks in advance!

---

<div class="post-metadata">

**Author:** ![chesini](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@chesini](https://discuss.elastic.co/u/chesini)\
**Post date:** [October 3, 2019, 12:01pm UTC](https://discuss.elastic.co/t/detect-outliers-in-non-timeline-based-data/201952/5 "2019-10-03T12:01:30Z")

</div>

We manage lots of assets (workstations, servers, peripherals), applications, servers, users, services, etc. All have a lot of attribute fields. Most of these fields are non-numeric.

The use case is to get outliers e.g. from user view point e.g. users that do not have the correct authorizations to run a service, don't have correct workstation resources, registry settings, application/driver versions installed etc. The expanded user attribute field list may content a couple 100s of fields. The use case is to define/select a set of correct users with correct attribute field lists to run that service, then let the machine learning get the outliers.

Regards.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2019, 12:01pm UTC](https://discuss.elastic.co/t/detect-outliers-in-non-timeline-based-data/201952/6 "2019-10-31T12:01:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
