# Help with MachineLearning job **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-machine-learning\ **Created:** [November 9, 2018, 12:25pm UTC](https://discuss.elastic.co/t/help-with-machinelearning-job/156049 "2018-11-09T12:25:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Rohlik](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@Rohlik](https://discuss.elastic.co/u/Rohlik)\ **Post date:** [November 9, 2018, 12:25pm UTC](https://discuss.elastic.co/t/help-with-machinelearning-job/156049/1 "2018-11-09T12:25:48Z")
Hello there, We are currently playing with x-pack and mainly with Machine-learning. Can you, please, show me way how we can create Machine-learning job for our use case? Our logs contains many fields but there are two important for Machine-learning job: `name` (string) like AGENT1, AGENT2, .... `status` (string) like FAIL, SUCCESS, .... We want monitor `status` per `name`, watch if there is too many FAILs in `status`. Thank you for your time. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [November 9, 2018, 12:43pm UTC](https://discuss.elastic.co/t/help-with-machinelearning-job/156049/2 "2018-11-09T12:43:54Z")
Thomas - so this is likely count to leverage one of the `count` functions to track the occurrence rate of documents indexed over time. But, two questions: 1. How many possibilities are there for `name` (the cardinality)? 2. How many possibilities are there for `status` (again, the cardinality)? ---
**Author:** ![Rohlik](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@Rohlik](https://discuss.elastic.co/u/Rohlik)\ **Post date:** [November 9, 2018, 1:45pm UTC](https://discuss.elastic.co/t/help-with-machinelearning-job/156049/3 "2018-11-09T13:45:00Z")
There are around 10 posibilities for `name` and 3 for `status`. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [November 9, 2018, 2:22pm UTC](https://discuss.elastic.co/t/help-with-machinelearning-job/156049/4 "2018-11-09T14:22:07Z")
Ok great - then an Advanced Job where you select the following in the Detector would accomplish a double-split (as in "count by `name` and also for every `status`"): function: count by\_field\_name: name partition\_field\_name: status ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/956fa5d37f7b4ae5e7ef58d1f0b80f671d543abf.png) So, in this way, every unique combination of `user` and `status` is modeled independently (for example "AGENT1/FAIL", "AGENT1/SUCCESS", 'AGENT2/FAIL", etc.) Give it a go... ---
**Author:** ![Rohlik](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@Rohlik](https://discuss.elastic.co/u/Rohlik)\ **Post date:** [November 23, 2018, 1:34pm UTC](https://discuss.elastic.co/t/help-with-machinelearning-job/156049/5 "2018-11-23T13:34:08Z")
You save my day @richcollier, thank you. I have additional question about my use case. Is it possible to monitor critical statuses (like FAIL, ...) when the occurence rate is bigger then usual and in the same time monitor low occurence rate of wanted status (like SUCCESS) ? Basically I do not want monitor low occurrence FAIL statuses and high occurence for SUCCESS. Can be this done in one job? ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [November 24, 2018, 4:16pm UTC](https://discuss.elastic.co/t/help-with-machinelearning-job/156049/6 "2018-11-24T16:16:59Z")
Because the thing you care about is the _value_ of a field (in this case, `status`) - and since you want to "count" the occurrence rate of them over time (i.e. use one of ML's `count` functions) - you need to create two separate searches for the raw data and therefore you need to create 2 separate jobs. job1: search for only `status:FAIL` detector: `low_count` job2: search for only `status:SUCCESS` detector: `high_count` If there was a situation in which both conditions could be facilitated by one search, then you could have used two detectors in the same job (via the Advanced Job Wizard), but alas, you need two searches here to accomplish what you want (and thus need two jobs). For each job, just create a Saved Search in Kibana for the condition, and use that Saved Search as the basis for your ML jobs. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 22, 2018, 4:17pm UTC](https://discuss.elastic.co/t/help-with-machinelearning-job/156049/7 "2018-12-22T16:17:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.