# ML - Datafeed is encountering errors extracting data: all shards failed

**URL:** <https://discuss.elastic.co/t/ml-datafeed-is-encountering-errors-extracting-data-all-shards-failed/264994>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [February 21, 2021, 4:59pm UTC](https://discuss.elastic.co/t/ml-datafeed-is-encountering-errors-extracting-data-all-shards-failed/264994 "2021-02-21T16:59:09Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [February 23, 2021, 9:52pm UTC](https://discuss.elastic.co/t/ml-datafeed-is-encountering-errors-extracting-data-all-shards-failed/264994/21 "2021-02-23T21:52:57Z")

</div>

It's quite possible that the query being run by Kibana (the one that "works") looks more like the following, behind the scenes:

```auto
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "event.action": "EXECVE"
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }

```

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [February 23, 2021, 9:55pm UTC](https://discuss.elastic.co/t/ml-datafeed-is-encountering-errors-extracting-data-all-shards-failed/264994/22 "2021-02-23T21:55:09Z")

</div>

The motivation for using v7.11 is that many of the ML jobs are now directly enabled via the Security (SIEM) app

> **[Anomaly Detection with Machine Learning | Elastic Security Solution \[7.11\] |...](https://www.elastic.co/guide/en/security/current/machine-learning.html)**

---

<div class="post-metadata">

**Author:** ![cezar996](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@cezar996](https://discuss.elastic.co/u/cezar996)\
**Post date:** [February 24, 2021, 12:57pm UTC](https://discuss.elastic.co/t/ml-datafeed-is-encountering-errors-extracting-data-all-shards-failed/264994/23 "2021-02-24T12:57:29Z")

</div>

It perfectly worked! 🙂 Congratulations, you are a genius!! However, I have a question: if I run packetbeat during the day and during the night not, then in the next day when I create a ML job which uses the packetbeat data, it will also take into consideration the pause period which was during the night, or it will automatically calculate and take the data just when was packetbeat running?

---

<div class="post-metadata">

**Author:** ![cezar996](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@cezar996](https://discuss.elastic.co/u/cezar996)\
**Post date:** [February 24, 2021, 12:59pm UTC](https://discuss.elastic.co/t/ml-datafeed-is-encountering-errors-extracting-data-all-shards-failed/264994/24 "2021-02-24T12:59:10Z")

</div>

I will consider upgrading to this version! Thanks for this information! 👍

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2021, 12:59pm UTC](https://discuss.elastic.co/t/ml-datafeed-is-encountering-errors-extracting-data-all-shards-failed/264994/25 "2021-03-24T12:59:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/ml-datafeed-is-encountering-errors-extracting-data-all-shards-failed/264994.md?page=1)