# Machine Learning for Visualizations

**URL:** <https://discuss.elastic.co/t/machine-learning-for-visualizations/289393>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [November 17, 2021, 5:35am UTC](https://discuss.elastic.co/t/machine-learning-for-visualizations/289393 "2021-11-17T05:35:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pianist\_iris](https://avatars.discourse-cdn.com/v4/letter/p/ac8455/32.png) [@pianist\_iris](https://discuss.elastic.co/u/pianist_iris)\
**Post date:** [November 17, 2021, 5:35am UTC](https://discuss.elastic.co/t/machine-learning-for-visualizations/289393/1 "2021-11-17T05:35:23Z")

</div>

We have multiple Kibana visualizations which are traffic volume graph or login count graph.  
Now we would like to utilize machine learning module to detect anomaly in those graphs.  
What would be the most efficient way to achieve this?

I probably could create multiple jobs manually, applying the same logic in each visualize into each job. Just wondering if there's any smarter way - both for the creation now, and for future maintenance across visualizations and machine learning jobs.

It would be so cool if there's a setting button next to each visualization, where we could just enable Machine Learning for that visualization! 😃

Thanks!

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [November 17, 2021, 8:31pm UTC](https://discuss.elastic.co/t/machine-learning-for-visualizations/289393/2 "2021-11-17T20:31:24Z")

</div>

Hi - yes it would be really cool to ML-ify a data visualization (certainly if that visualization made sense and could be translated to an anomaly detection job config). 😃

In the meantime, you'll have to "translate" the config of the visualization to the ML job config. For example, if the visualization shows the count of something over time (i.e. a login count graph) then you will use the `count` function of ML. If you have a metric-based graph (i.e. sum of network bytes) then you'd use `sum(bytes)`.

If you have a "split" in your visualization ("Break down by") then this field could be a `partition_field` for the ML job.

So, as an example, here's a Lens visualization of some web logs looking at the `sum(bytes)` for each `agent.keyword`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a3d951979cd2a96db3861908b65b45128d2a441.jpeg)

The equivalent ML job for this (using the multi-metric wizard) would look like:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fbb8bd54c3e543927650e74dd3437530e2e28387.jpeg)

Essentially, exactly the same logic!

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [November 17, 2021, 8:33pm UTC](https://discuss.elastic.co/t/machine-learning-for-visualizations/289393/3 "2021-11-17T20:33:51Z")

</div>

Results!

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/3/33b7b13b63015de910fb63f5703b8d2a5b30994c.jpeg)

---

<div class="post-metadata">

**Author:** ![ghudgins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghudgins/32/138532_2.png) [@ghudgins](https://discuss.elastic.co/u/ghudgins)\
**Post date:** [November 17, 2021, 8:43pm UTC](https://discuss.elastic.co/t/machine-learning-for-visualizations/289393/4 "2021-11-17T20:43:01Z")

</div>

Very interesting idea. Would be good to articulate it as a "Feature Request" in Kibana if you're up for it. [Issues · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/).

As a complete aside we're also thinking about surfacing visualizations of anomalies and ML annotations in more places in Kibana...but that's the reverse of what you're suggesting. With Lens' multiple layers we do want to make it really easy to add ML Anomalies & Annotations as an overlay to your visualization.

Anyway - would love to see an issue for this to continue the discussion!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2021, 8:43pm UTC](https://discuss.elastic.co/t/machine-learning-for-visualizations/289393/5 "2021-12-15T20:43:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.