# Not able to create a machine learning job

**URL:** <https://discuss.elastic.co/t/not-able-to-create-a-machine-learning-job/164600>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [January 17, 2019, 9:44am UTC](https://discuss.elastic.co/t/not-able-to-create-a-machine-learning-job/164600 "2019-01-17T09:44:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![maarab](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@maarab](https://discuss.elastic.co/u/maarab)\
**Post date:** [January 17, 2019, 9:44am UTC](https://discuss.elastic.co/t/not-able-to-create-a-machine-learning-job/164600/1 "2019-01-17T09:44:59Z")

</div>

Hi,

I activated a platinum trial license to do a hands-on machine learning. I have an index and have created an index pattern with the same index name without specifying a time field and no wild card. While creating the job I am able to select the index but it gives the following messages : "Index pattern X is not time based. Anomaly detection can only be run over indices which are time based." I don't see why a time based field is required as the anomalies can be detected while documents are getting indexed. Am I missing something here with respect to understanding? Please excuse my ignorance. I just want the job for e.g. to raise anomaly if it sees for a third value while all the documents would ideally be having 2 values.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [January 17, 2019, 4:24pm UTC](https://discuss.elastic.co/t/not-able-to-create-a-machine-learning-job/164600/2 "2019-01-17T16:24:47Z")

</div>

You are indeed missing something! 🙂 What you're describing is exactly a time-based situation - documents getting indexed over time. So, how would one know if what you see right now is "expected" or "unexpected" if you haven't paid attention to the behavior over time in the past?

But, keep in mind that ML doesn't solve every problem. If you have a simple use case (as in "this document should never have a 3rd value" - as you've described) - then you don't need ML. You can accomplish this with a simple rule/threshold in Alerting/Watcher.

---

<div class="post-metadata">

**Author:** ![maarab](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@maarab](https://discuss.elastic.co/u/maarab)\
**Post date:** [January 20, 2019, 6:59am UTC](https://discuss.elastic.co/t/not-able-to-create-a-machine-learning-job/164600/3 "2019-01-20T06:59:03Z")

</div>

Thank you for your reply. I understand that the behaviour is over time, but is there really a time field required as a field in the index? Can that time not be the time when documents are added to the index i.e. the created date? For e.g. if I have an index with fields (id, transNo, transType, isActive, countryId), do I need to have a createdDate field in the index as well?  
Also, thank you for the tip.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [January 21, 2019, 2:38am UTC](https://discuss.elastic.co/t/not-able-to-create-a-machine-learning-job/164600/4 "2019-01-21T02:38:04Z")

</div>

You only need a timestamp field in your index if you plan on using ML. And yes, it can be the date in which the document was indexed - but I assume that somehow relates to when the transaction was created in the first place?

---

<div class="post-metadata">

**Author:** ![maarab](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@maarab](https://discuss.elastic.co/u/maarab)\
**Post date:** [January 21, 2019, 6:46am UTC](https://discuss.elastic.co/t/not-able-to-create-a-machine-learning-job/164600/5 "2019-01-21T06:46:50Z")

</div>

That about sums it up. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 18, 2019, 6:46am UTC](https://discuss.elastic.co/t/not-able-to-create-a-machine-learning-job/164600/6 "2019-02-18T06:46:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.