# ELastic ML jobs

**URL:** <https://discuss.elastic.co/t/elastic-ml-jobs/346217>\
**Category:** Logs\
**Created:** [November 1, 2023, 4:43pm UTC](https://discuss.elastic.co/t/elastic-ml-jobs/346217 "2023-11-01T16:43:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vee/32/55759_2.png) [@vee](https://discuss.elastic.co/u/vee)\
**Post date:** [November 1, 2023, 4:43pm UTC](https://discuss.elastic.co/t/elastic-ml-jobs/346217/1 "2023-11-01T16:43:55Z")

</div>

I've been researching around the different types of ML anamoly detection jobs in Elasticsearch. Would like to get a second opinion as to what might be the best bet for a particular use case am working on:

1. 100's of hosts - host is a keyword field
2. Each host has tens of services running on them - service name is a keyword field
3. Each service logs the service response times in elasticsearch - responseTime is a 'numeric value'

I'm trying to create a job that would model the **average response times of each service on a given host** and alert if it's trending higher than the median value of the same metric compared to historical occurences.

I don't see an option of creating this in multi-metric as they all have "distinct count" of the hostname/services - which does not help.

Thanks!

---

<div class="post-metadata">

**Author:** ![Sunile\_Manjee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunile_manjee/32/111461_2.png) [@Sunile\_Manjee](https://discuss.elastic.co/u/Sunile_Manjee)\
**Post date:** [November 2, 2023, 3:50am UTC](https://discuss.elastic.co/t/elastic-ml-jobs/346217/2 "2023-11-02T03:50:00Z")

</div>

If you want to compute average response times of each service on a given host - use transform

And then the median value of the same metric compared to historical occurrences. Create an anomaly detection job using the avg field from the transform output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2023, 3:51am UTC](https://discuss.elastic.co/t/elastic-ml-jobs/346217/3 "2023-11-30T03:51:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.