How to start a machine learning job to check if a user starts an application they normally do not use with Kibana

Elastic Stack Kibana
7

I think the misunderstanding here is that you do not search for rare by related.user in the actual Elasticsearch query language, you accomplish that bit using an ML job (see rarity analysis article)

So, you need to:

  1. Create a filtered search to come up with a version of the data set that you want - it seems that you've done this part. Save this search as a "Saved Search"
  2. Use that "Saved Search" as the basis of your ML job
  3. Configure your ML job to do rarity analysis using the appropriate fields in the data.

I hope this helps