Elastic Machine Learning
Elastic Machine Learning (Elastic ML) provides a powerful suite of tools to automatically model the behaviour of your data in real time. Elastic ML is not a single feature but a collection of unsupervised and supervised learning methods that work directly on your data in Elasticsearch. It supports a powerful set of job types designed to analyze your data for observability or security purposes:
- Anomaly detection jobs
- Data frame analytics jobs
Learn more in ML jobs.
Benefits of using Elastic ML
Integrating Elastic ML into your observability, security, or business analytics workflows provides significant advantages:
- Unsupervised detection—ML models detect unknown or emerging threats without predefined rules, complementing rule-based detection for broader coverage.
- Reduced alert fatigue—ML models learn the normal ebb and flow of your metrics, alerting only on statistically significant deviations rather than fixed conditions, thus reducing the amount of irrelevant alerts.
- Time and resource efficiency—Teams spend less time investigating noise, false positives, or repetitive alerts, improving operational efficiency.
- Actionable insights—ML insights are immediately actionable, allowing teams to use them in alerts, dashboards, and automated workflows.
- Enhanced security posture—ML models can detect unusual user behaviour, DNS tunneling, malware communication, and other threats that signature-based methods miss.
- Predictive forecasting—ML models can analyse historical data to predict future values (like resource utilisation or traffic volume), enabling proactive resource allocation.
Here is a comparison of traditional alerts and ML-enhanced alerts:
| Characteristic | Traditional alerts | ML-enhanced alerts |
|---|---|---|
| Detection method | Static thresholds | Dynamic baselines |
| Accuracy | High false positives | Contextual scoring |
| Maintenance | Manual tuning required | Self-adapting detection |
| Complexity | Limited pattern recognition | Advanced statistical modeling |
Elastic ML is best utilized in scenarios characterized by two key data challenges: high volume and high velocity. It is specifically designed to handle massive-scale datasets and to remain effective in dynamic environments where the data is updated or changes rapidly.
Getting started with Elastic ML in StackOps Elastic
Pre-requisites:
- An existing StackOps Elastic deployment
In StackOps Elastic, ML capabilities are disabled by default. You must raise a service request to get dedicated ML nodes provisioned for your deployment.
Next steps
Once the ML capabilities are enabled, you can explore the following guide:
