# Why can't I use user.name as field in machine learning job, but the standard jobs can?

**URL:** <https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 9, 2022, 11:27am UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245 "2022-05-09T11:27:57Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![anddam](https://avatars.discourse-cdn.com/v4/letter/a/90db22/32.png) [@anddam](https://discuss.elastic.co/u/anddam)\
**Post date:** [May 16, 2022, 2:22pm UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245/21 "2022-05-16T14:22:08Z")

</div>

Here it is:

> **[GET winlogbeat-\_field\_capsfields=user output.txt](https://drive.google.com/file/d/1gUj7wFRpiaDN7d0a1rwq-gSfNf1ghMyI/view?usp=sharing)**
>
> Google Drive file.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 16, 2022, 5:27pm UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245/22 "2022-05-16T17:27:49Z")

</div>

It really isn't obvious what's the issue here. Worst case scenario is that you always edit the JSON for the job on the last step of the wizard to change the field in the detector to be `user.name`. This will get around the UI restriction.

---

<div class="post-metadata">

**Author:** ![anddam](https://avatars.discourse-cdn.com/v4/letter/a/90db22/32.png) [@anddam](https://discuss.elastic.co/u/anddam)\
**Post date:** [May 17, 2022, 6:34am UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245/24 "2022-05-17T06:34:45Z")

</div>

Somehow this does not work for me. I just tried editing (removing .keyword) this in the last step (summary page):

```auto
{
  "job_id": "testpws",
  "description": "",
  "groups": [],
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {
        "function": "rare",
        "by_field_name": "user.name.keyword"
      }
    ],
    "influencers": [
      "user.name.keyword"
    ]
  },
  "data_description": {
    "time_field": "@timestamp"
  },
  "analysis_limits": {
    "model_memory_limit": "10MB"
  },
  "model_plot_config": {
    "enabled": false,
    "annotations_enabled": false
  }
}

```

It automatically removes the "by\_field\_name" field, like this:

```auto
{
  "job_id": "testpws",
  "description": "",
  "groups": [],
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {
        "function": "rare"
      }
    ],
    "influencers": [
      "user.name"
    ]
  },
  "data_description": {
    "time_field": "@timestamp"
  },
  "analysis_limits": {
    "model_memory_limit": "10MB"
  },
  "model_plot_config": {
    "enabled": false,
    "annotations_enabled": false
  }
}

```

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 17, 2022, 11:13am UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245/25 "2022-05-17T11:13:28Z")

</div>

Well, not sure what's up with your setup and honestly, we're probably at the limit of what we can do here on a forum. A proper support ticket would normally be the next step but you're doing this as a project and not as a paid customer. In the meantime, your best bet is likely to bypass the UI altogether and just create your jobs with the API. So for example:

```auto
PUT _ml/anomaly_detectors/aaa
{
    "job_id": "aaa",
    "custom_settings": {},
    "description": "",
    "analysis_config": {
      "bucket_span": "15m",
      "detectors": [
        {
          "detector_description": "rare users",
          "function": "rare",
          "by_field_name": "user.name",
          "detector_index": 0
        }
      ],
      "influencers": [
        "user.name"
      ],
      "model_prune_window": "30d"
    },
    "analysis_limits": {
      "model_memory_limit": "11mb",
      "categorization_examples_limit": 4
    },
    "data_description": {
      "time_field": "timestamp",
      "time_format": "epoch_ms"
    },
    "model_plot_config": {
      "enabled": false,
      "annotations_enabled": false
    },
    "model_snapshot_retention_days": 10,
    "daily_model_snapshot_retention_after_days": 1,
    "results_index_name": "aaa",
    "allow_lazy_open": false
}

```

and

```auto
PUT _ml/datafeeds/datafeed-aaa
{
     "datafeed_id": "datafeed-aaa",
    "job_id": "aaa",
    "query": {
      "bool": {
        "must": [
          {
            "match_all": {}
          }
        ]
      }
    },
    "indices": [
      "winlogbeat-*"
    ],
    "scroll_size": 1000,
    "delayed_data_check_config": {
      "enabled": true
    }
}

```

Replacing all occurrences of `aaa` above with your desired job name.

Good luck!

---

<div class="post-metadata">

**Author:** ![anddam](https://avatars.discourse-cdn.com/v4/letter/a/90db22/32.png) [@anddam](https://discuss.elastic.co/u/anddam)\
**Post date:** [May 17, 2022, 11:58am UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245/27 "2022-05-17T11:58:17Z")

</div>

This works for now. Thank you for the support.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 14, 2022, 11:58am UTC](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245/28 "2022-06-14T11:58:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/why-cant-i-use-user-name-as-field-in-machine-learning-job-but-the-standard-jobs-can/304245.md?page=1)