Detector field "mlcategory" is not an aggregatable field

machine-learning

#1

I create a job in 6.3.1, with categorization_field_name set to "message", and try to count by mlcategory. When I Validate Job I get the error message in the title. However, I am able to save and run the job. The job looks like this

{
  "job_id": "the-unusual-suspects",
  "description": "",
  "groups": [],
  "analysis_config": {
    "bucket_span": "15m",
    "influencers": [
      "beat.hostname.keyword"
    ],
    "detectors": [
      {
        "function": "count",
        "by_field_name": "mlcategory"
      }
    ],
    "categorization_field_name": "message"
  },
  "data_description": {
    "time_field": "@timestamp"
  },
  "datafeed_config": {
    "query": {
      "match_all": {}
    },
    "indices": [
      "logstash-production*"
    ],
    "types": []
  }
}

(Walter Rafelsberger) #2

Thanks for reporting this. It's a known issue and will be fixed with the release of 6.4. (Here's the corresponding issue on github: https://github.com/elastic/kibana/issues/20867)


(Mark Walkom) #3