Hello
I found these 2 index patterns: ".ml-anomalies", ".ml-anomalies-shared" in Kibana when ticking "Include system indices".
What are those for?
What is the difference?
We have numerous concrete indices for storing Machine Learning results.
.ml-anomalies-shared is the default location for ALL machine learning jobs
For larger machine learning jobs, we give the option of allowing you to set the job to use its own index (see results_index_name in ML PUT Job API).
Those should be displayed as
.ml-anomalies-custom-<results_index_name>. The Kibana job creation wizards give you a checkbox to select if the results should be in their own index. Kibana sets results_index_name to the configured job id.
As for .ml-anomalies I am not sure why you are seeing that index as an option. I do not think the machine learning plugin uses an index by that name. What version of the stack are you seeing this concrete index in?
He probably means the .ml-anomalies-* index pattern which is designed to match everything
I am using the Kibana 6.8.2
I watched this tutorial on how to add a ML result to the dashboard.
I followed the example and used that file (.ml-anomalies-*) for a MULTIMETRIC job.
Then later I used the same file for a POPULATION job. Is that alright? Or should I have used the ".ml-anomalies-shared"?
Where is that option that will allow me to set the job to use its own index? Is it the "Use dedicated index"?
Yes, it is the use dedicated index checkbox.
As for whether to use .ml-anomalies-* vs .ml-anomalies-shared, that is entirely up to you. But using .ml-anomalies-* will cover the cases when a job has a dedicated results index.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.