I create a job in 6.3.1, with categorization_field_name set to "message", and try to count by mlcategory. When I Validate Job I get the error message in the title. However, I am able to save and run the job. The job looks like this
{
"job_id": "the-unusual-suspects",
"description": "",
"groups": [],
"analysis_config": {
"bucket_span": "15m",
"influencers": [
"beat.hostname.keyword"
],
"detectors": [
{
"function": "count",
"by_field_name": "mlcategory"
}
],
"categorization_field_name": "message"
},
"data_description": {
"time_field": "@timestamp"
},
"datafeed_config": {
"query": {
"match_all": {}
},
"indices": [
"logstash-production*"
],
"types": []
}
}