Machine Learning Multiple Split Data Fields

Elastic Stack Elasticsearch
1

Hi I'm working on creating Machine Learning jobs and was wondering if there is any way to use multiple fields in the "Split Data" field? I ask this because I would like one series to represent an individual node, but multiple sites have the same node name so the data should be split by site and then by node name.

If this is not possible would a solution be to create a scripted field that contains "site.node_name" and then split on that?

2

When using an Advanced Job (or using the API), you can specify both a partition_field_name and a by_field_name in the same detector and that effectively does a "double split".

Another option is indeed to create a scripted field that is the concatenation of two other fields, then split on that.

1 Like