I have a similar issue to this thread (Anomaly detection - Elastic Jobs failing to start).
When I try to start the job packetbeat_dns_tunneling, I get the error [datafeed-packetbeat_dns_tunneling] cannot retrieve field [dns.question.etld_plus_one] because it has no mappings
I ran this command
GET _ml/datafeeds/datafeed-packetbeat_dns_tunneling
and under indices, got the output
"indices": [
"packetbeat-",
"logs-"
],
Is this what the job is supposed to map to, or is it supposed to map to something else? packetbeat and logs are where we are getting our logs from.