Problem with X-Pack Machine Learning

[Arun_Raj]

Hi All

I am new to X-Pack and I tried to create a Single metric viewer for that I selected the aggregation as count then I tried to select the options from 'field' dropbox but there is no functions or values present in the drop down Can anyone help on this ?

I m using trial version of X-Pack 5.6.1

thanks
Arun

[Arun_Raj]

[Rohithnama]

The Count function doesn't take any fields. It just works based on the count of the indexed_data. If you want to use with data_feilds, you have to other functions such as sum, mean or any others.

[Arun_Raj]

Thanks Rohith i m facing same problem with sum and others

[Rohithnama]

Ok, I think you aren't creating the index pattern. But I assume you indexed the data into elasticsearch.

Once data is indexed, you must follow these steps.

-> Go to the management tab (the last tab at the end of left side menu) and choose Index pattern in the kibana tab.

-> In the index pattern, click on the create index pattern tab and add the name of the index you used while indexing the data into elasticsearch.
-> It should automatically detect the time/date pattern and provide you the mapping info as well.

-> Now, go to creating the single metric job and you should be able the see the name of the data index, you should select one.

-> Now, you should see the fields for functions other than Count.

Let me know if it didn't work.

[Arun_Raj]

I ve indexed the data into ES as logstash-* and I feed d same into kibana as well

I ll follow the steps that you ve mentioned n let you know

Thanks much

[Arun_Raj]

Rohit

still the issue persist, you can find the index name (logstash-*) I ve created

pfb;

[droberts195 (David Roberts)]

The Sum function needs to be applied to a numeric field, so the Field dropdown will only show numeric fields. Is it possible that all your fields are text or keyword? If so, you will have to choose an aggregation that doesn't require a numeric field, such as Count.

[Arun_Raj]

ok understood thanks David!

[Rohithnama]

Yeah, that's the other issue.

You can either search the mapping type in the index patterns tab or you can make a call to mapping api using the index.

If you have numeric fields indexed as a keyword/text, the mapping has to be changed. In future, you might have to set a dual-mapping to use the fields in different ways to create the advanced jobs. Referring to the concept of Mapping and fields would help you a lot.