Some field is not showing in ML

[tatdat (Dat Pham Tat)]

Im testing in Kibana + ES 6.1

Im following guide in this blog https://www.elastic.co/blog/machine-learning-for-nginx-logs - Use Case 2: Changes in Website Behaviour

But i cant see field "nginx.access.response" .. and this field existed data

[tatdat (Dat Pham Tat)]

Can someone have suggestion?

[Nathan_Reese]

What does the Index Pattern look like for nginx data? Go to Management -> Index Pattern and select the nginx Index Pattern. Does the field response_code exist. If not, try hitting the "Refresh field list" button in the top left.

[tatdat (Dat Pham Tat)]

Hi @Nathan_Reese , of course, response_code existed

[dkyle (David Kyle)]

Hi,

You can't split a job by a numerical field due to the high cardinality of the field i.e. you could have billions of fields. Only text fields can be used to split data.

Is nginx.access.response also indexed as a keyword field? If so that should appear in the split data drop down list otherwise you will have to re-index the nginx data I'm afraid

[richcollier]

The single and multi-metric job configuration UIs do indeed prevent users from selecting fields that are of type number as fields to "split by".

However, you can get around this by using the Advanced Job configuration - it has no such limitation:

[tatdat (Dat Pham Tat)]

Many thank @dkyle and @richcollier. I got it.