# Machine Learning **URL:** \ **Category:** Elastic Training\ **Created:** [November 15, 2017, 4:11am UTC](https://discuss.elastic.co/t/machine-learning/107654 "2017-11-15T04:11:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 15, 2017, 4:11am UTC](https://discuss.elastic.co/t/machine-learning/107654/1 "2017-11-15T04:11:15Z")
In the 'Analyzing Script Attacks' lesson the the teacher adds keyword to by\_field\_name and over\_field\_name, where can I read more about this? Also, keep getting this error Save failed: [status\_exception] This job would cause a mapping clash with existing field [event\_data.NewProcessName] - avoid the clash by assigning a dedicated results index x but I checked the dedicated index box on the first page under job details. ---
**Author:** ![nzamecnik](https://avatars.discourse-cdn.com/v4/letter/n/76d3ee/32.png) [@nzamecnik](https://discuss.elastic.co/u/nzamecnik)\ **Post date:** [November 15, 2017, 4:38am UTC](https://discuss.elastic.co/t/machine-learning/107654/2 "2017-11-15T04:38:27Z")
Hello, You can reference the ML documentation to get more info on those types of fields. In terms of the index clash - what is happening is the ML process is trying to update the index mapping in a way that causes a conflict. Your best bet is to create ML jobs that have dedicate indexes to avoid this. ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 15, 2017, 3:14pm UTC](https://discuss.elastic.co/t/machine-learning/107654/3 "2017-11-15T15:14:26Z")
OK so regarding 'keywords' and adding them as 'influencers' etc. from here - [https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html) They are typically used for filtering (Find me all blog posts where status is published), for sorting, and for aggregations. Keyword fields are only searchable by their exact value. If you need to index full text content such as email bodies or product descriptions, it is likely that you should rather use a text field. The above doesn't explain it... at least not to me. Why does he use keyword? uri\_requests.keyword, clientip.keyword response.keyword? What's the benefit of this on these fields? I did find this in a blog which helps a little... > **[Elasticsearch replaces string type with two new types text and keyword.](https://www.elastic.co/blog/strings-are-dead-long-live-strings)** > > On using text types for full text search and keyword type for keyword search in Elasticsearch 5.0. To make things better, Elasticsearch decided to borrow an idea that initially stemmed from Logstash: strings will now be mapped both as text and keyword by default. For instance, if you index the following simple document: { "foo": "bar" } Then the following dynamic mappings will be created: { "foo": { "type" "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 } } } } As a consequence, it will both be possible to perform full-text search on foo, and keyword search and aggregations using the foo.keyword field. The only explanation the course gives is - ".keyword" fields need to be used otherwise the analysis will fail due to the way the data is indexed. We recommend taking our "Developer" or "Operations" courses if this isn't clear. ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 15, 2017, 7:04pm UTC](https://discuss.elastic.co/t/machine-learning/107654/4 "2017-11-15T19:04:10Z")
fields It is often useful to index the same field in different ways for different purposes. This is the purpose of multi-fields. For instance, a string field could be mapped as a text field for full-text search, and as a keyword field for sorting or aggregations: ---
**Author:** ![nzamecnik](https://avatars.discourse-cdn.com/v4/letter/n/76d3ee/32.png) [@nzamecnik](https://discuss.elastic.co/u/nzamecnik)\ **Post date:** [November 15, 2017, 7:26pm UTC](https://discuss.elastic.co/t/machine-learning/107654/5 "2017-11-15T19:26:07Z")
Yes, they're another way to index your data for different purposes. We talk about these types of things a lot in our Elasticsearch Developer I course as well as our Elasticsearch Operations I course. I recommend you take one of those to get a firm understanding of not only that concept but many other important concepts as well. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 15, 2017, 7:26pm UTC](https://discuss.elastic.co/t/machine-learning/107654/6 "2017-12-15T19:26:42Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.