ML concepts

Learn more about the concepts in Elastic ML.

ML jobs

Elastic ML jobs analyse historical and real-time data to model the baseline behaviours of systems, users, or network activity. These jobs identify statistically significant anomalies instead of relying solely on static, rule-based thresholds. This adaptive detection helps reduce false positives caused by normal but rare events that traditional rules may flag.

Job types

Elastic ML supports the following job types:

• Anomaly detection jobs
• Data frame analytics jobs

Anomaly detection jobs

Anomaly detection jobs are built to analyse continuous time-series data. They automatically model the normal behaviour of metrics to identify unusual patterns, spikes, or dips in real time.

These jobs can be configured in various ways, including:

• Single-metric jobs—Used to monitor just one metric (e.g., CPU usage, authentication failures).
• Multi-metric jobs—Used to monitor multiple metrics simultaneously.
• Population jobs—Used to compare the behaviour of one entity (e.g., a specific user) against the behaviour of the entire group (the population).

Learn more about anomaly detection in Elastic documentation.

Data frame analytics jobs

Data frame analytics jobs are batch-processing jobs that perform analysis on a static snapshot of your data. With these jobs, you can conduct the following types of analysis:

• Outlier detection—Identifies data points that are unusual compared to the rest of the data.
• Regression—Predicts continuous numerical values, such as the cost of a transaction.
• Classification—Predicts which category a data point belongs to (e.g., identifying log messages as “error”, “warning”, or “info”).

Learn more about data frame analytics in Elastic documentation.