# Sub partition in Machine Learning

**URL:** <https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [December 1, 2020, 2:57pm UTC](https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220 "2020-12-01T14:57:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![OmarDacca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omardacca/32/68171_2.png) [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\
**Post date:** [December 1, 2020, 2:57pm UTC](https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220/1 "2020-12-01T14:57:01Z")

</div>

Hi,

Is it possible to make sub partitions in Machine Learning ?  
domain and event are fields in every document.  
I created a categorization ml job, with partition\_field = domain, but this is not enough, I must split it by domain and event, and since its a categorization job, I already have by\_field\_name = mlcategory, so I guess the only way to achieve this is to concatenate domain and event and partition on it ?

this is the job config:

```
{
  "job_id": "test_ml",
  "description": "",
  "groups": [],
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {
        "function": "count",
        "by_field_name": "mlcategory",
        "partition_field_name": "domain"
      }
    ],
    "influencers": [
      "mlcategory"
    ],
    "categorization_field_name": "error"
  },
  "data_description": {
    "time_field": "date_time"
  },
  "analysis_limits": {
    "model_memory_limit": "139MB"
  },
  "results_index_name": "test_ml"
}

```

thanks,  
Omar

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 1, 2020, 11:50pm UTC](https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220/2 "2020-12-01T23:50:32Z")

</div>

Correct, since `mlcategory` is taking up the `by_field_name`, it is taking away your ability to double-split.

You'd need to create a `scripted_field` in your datafeed's query that was the concatenation of `domain` and `event` and then partition on this new `domain_event` field

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 29, 2020, 11:51pm UTC](https://discuss.elastic.co/t/sub-partition-in-machine-learning/257220/3 "2020-12-29T23:51:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.