I am following the use case for Machine Learning for Elastic Stack found at the link below:
Suspicious Login Activity
My setup:
Ubuntu 16.04, Elastic Stack 5.6.8 (Elasticsearch, Logstash, Kibana, Filebeats X-Pack)
I loaded the job by running the ./reset_job.sh suspicious_login_activity
script. The links to the repository are below.
reset_job.sh
job.json and data_feed.json
When I go to start the job, it gives me an error:
Datafeed lookback retrieved no data
I have even created this job from scratch.
This is my data showing in the Discover
tab.
Below is a copy of the job.json
{
"job_id": "suspicious_login_activity",
"description": "suspicious login activity",
"job_type": "anomaly_detector",
"analysis_config": {
"bucket_span": "5m",
"detectors": [
{
"detector_description": "high_count",
"function": "high_count",
"partition_field_name": "system.auth.hostname",
"detector_rules": []
}
],
"influencers": [
"system.auth.hostname",
"system.auth.user",
"system.auth.ssh.ip"
]
},
"data_description": {
"time_field": "@timestamp",
"time_format": "epoch_ms"
},
"model_plot_config": {
"enabled" : true
}
}
and the data_feed.json
{
"datafeed_id": "datafeed-suspicious_login_activity",
"job_id": "suspicious_login_activity",
"indexes": [
"filebeat-*"
],
"types": [
"doc"
],
"query": {
"query_string": {
"query": "system.auth.ssh.event:Failed OR system.auth.ssh.event:Invalid",
"fields": [],
"use_dis_max": true,
"auto_generate_phrase_queries": false,
"max_determinized_states": 10000,
"enable_position_increments": true,
"fuzziness": "AUTO",
"fuzzy_prefix_length": 0,
"fuzzy_max_expansions": 50,
"phrase_slop": 0,
"analyze_wildcard": true,
"escape": false,
"split_on_whitespace": true,
"boost": 1
}
},
"scroll_size": 1000,
"query_delay": "60s",
"frequency": "150s"
}
Also when previewing the datafeed, it is returning
GET _xpack/ml/datafeeds/datafeed-suspicious_login_activity/_preview
I am not understanding how to fix this.