# Machine Learning

**URL:** <https://discuss.elastic.co/t/machine-learning/285987>\
**Category:** SIEM\
**Tags:** elastic-stack-machine-learning\
**Created:** [October 6, 2021, 7:33am UTC](https://discuss.elastic.co/t/machine-learning/285987 "2021-10-06T07:33:56Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [October 7, 2021, 1:13pm UTC](https://discuss.elastic.co/t/machine-learning/285987/3 "2021-10-07T13:13:21Z")

</div>

sure an ML job that queries the metricbeat index and does a `low_count` partitioned (split) on hostname should do the trick. If the volume of documents ingested by any beat suddenly drops, it will be flagged as anomalous and you can optionally alert upon that.

But, I will say that you probably can build a Watch (similar to what's [discussed here](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970)) to accomplish it without the need for ML.

---

_[View the full topic](https://discuss.elastic.co/t/machine-learning/285987)._