# How to start a machine learning job to check if a user starts an application they normally do not use with Kibana

**URL:** <https://discuss.elastic.co/t/how-to-start-a-machine-learning-job-to-check-if-a-user-starts-an-application-they-normally-do-not-use-with-kibana/304094>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 6, 2022, 6:26am UTC](https://discuss.elastic.co/t/how-to-start-a-machine-learning-job-to-check-if-a-user-starts-an-application-they-normally-do-not-use-with-kibana/304094 "2022-05-06T06:26:56Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 6, 2022, 10:48am UTC](https://discuss.elastic.co/t/how-to-start-a-machine-learning-job-to-check-if-a-user-starts-an-application-they-normally-do-not-use-with-kibana/304094/7 "2022-05-06T10:48:00Z")

</div>

I think the misunderstanding here is that you do not search for `rare by related.user` in the actual Elasticsearch query language, you accomplish that bit using an ML job (see [rarity analysis article](https://discuss.elastic.co/t/dec-4th-2018-en-ml-rarity-analysis-with-machine-learning/158979))

So, you need to:

1. Create a filtered search to come up with a version of the data set that you want - it seems that you've done this part. Save this search as a "Saved Search"
2. Use that "Saved Search" as the [basis of your ML job](https://discuss.elastic.co/t/creating-ml-using-saved-search/149570)
3. Configure your ML job to do rarity analysis using the appropriate fields in the data.

I hope this helps

---

_[View the full topic](https://discuss.elastic.co/t/how-to-start-a-machine-learning-job-to-check-if-a-user-starts-an-application-they-normally-do-not-use-with-kibana/304094)._