ML jobs

Elastic Stack Elasticsearch
2

Since the datafeed preview looks okay, it seems like the problem is probably with the fact that your windows logs might be ingested more slowly than your linux logs, thus the real-time nature of the ML job is undermined.

You could test this theory by doing the following:

  1. Go to the ML Anomaly Detection Jobs page.
  2. Clone the windows_anomalous_process_creation job
  3. Have the job run on some past data.
  4. Continue to run the data in "real-time"
  5. If the number of processed records doesn't increase after entering real-time mode (and assuming you are still ingesting new Windows logs) - then you know your ingest delay is bigger than what the ML job is accounting for - so you will need to increase the query_delay parameter of the ML job (or figure out why the ingest delay is larger on Windows than Linux)