# How Create a machine learning job depends a particular value in a field?

**URL:** <https://discuss.elastic.co/t/how-create-a-machine-learning-job-depends-a-particular-value-in-a-field/142185>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [July 30, 2018, 1:22pm UTC](https://discuss.elastic.co/t/how-create-a-machine-learning-job-depends-a-particular-value-in-a-field/142185 "2018-07-30T13:22:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [July 30, 2018, 1:22pm UTC](https://discuss.elastic.co/t/how-create-a-machine-learning-job-depends-a-particular-value-in-a-field/142185/1 "2018-07-30T13:22:22Z")

</div>

Hi All ,

In my log there is a filed named "Log\_Type" . This field had multiple values. It may be consist INFORMATION , ERROR or DEBUG etc. I want create a ML job with respect to the distinct count of ERROR in filed "Log\_Type" . Is it possible ? . I think it is possible by advanced job and detector . How to configure this advanced job for this purpose.

Sample data

"Log\_Type": "ERROR"  
"Log\_Type": "INFO"  
"Log\_Type": "DEBUG"

Purpose is , I want to draw the distinct count pattern of ERROR in Log\_Type field.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [July 30, 2018, 8:04pm UTC](https://discuss.elastic.co/t/how-create-a-machine-learning-job-depends-a-particular-value-in-a-field/142185/2 "2018-07-30T20:04:57Z")

</div>

Just do count, partitioned on the field Log\_Type:

 ![count_Log_Type](https://us1.discourse-cdn.com/elastic/original/3X/4/5/4598f9357be16c623154948fae02f3e07e60d2d1.png)

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [August 9, 2018, 10:07am UTC](https://discuss.elastic.co/t/how-create-a-machine-learning-job-depends-a-particular-value-in-a-field/142185/3 "2018-08-09T10:07:49Z")

</div>

Thank you @richcollier

This solution is working well .

Can you give me an overview of all the options in this advanced Detector.

Meaning of function , field\_name , over\_field\_name etc ..

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [August 9, 2018, 11:20am UTC](https://discuss.elastic.co/t/how-create-a-machine-learning-job-depends-a-particular-value-in-a-field/142185/4 "2018-08-09T11:20:08Z")

</div>

Here you go: [https://www.elastic.co/guide/en/elasticsearch/reference/6.2/ml-job-resource.html#ml-detectorconfig](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/ml-job-resource.html#ml-detectorconfig)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 29, 2018, 10:04pm UTC](https://discuss.elastic.co/t/how-create-a-machine-learning-job-depends-a-particular-value-in-a-field/142185/5 "2018-10-29T22:04:20Z")

</div>