ML count aggregation, fields are not visible to create ml job

Hi all,

I am trying to create a simple ML job to forecast.

No fields are visible in count aggregation. I can able to do using other aggregation like mean and sum.
But i want to use count as my aggregation. Could you anybody help me.

I have two number fields in my index 1. responsecode 2. response

Thanks in advance.

It is because count counts documents, not fields.

Thanks @richcollier. How to count the numbers in ml job.
I got 404 response code 100 times in past two days. How do i forecast in next 5 days how many times the 404 response code will occur.

Without using the count, how do I achieve the same?

could you please help me

  1. Create a search that returns 404 response codes: (i.e. - status:404)

  1. save this search

  1. Create job from saved search

  1. Select count aggregation and appropriate bucket_span

  1. Run job as much historical data as possible, get results

  1. Click forecast button and run your forecast
1 Like

Thank you very much @richcollier


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.