|
@@ -2,7 +2,7 @@ tag::aggregations[]
|
|
|
If set, the {dfeed} performs aggregation searches. Support for aggregations is
|
|
|
limited and should only be used with low cardinality data. For more information,
|
|
|
see
|
|
|
-{stack-ov}/ml-configuring-aggregation.html[Aggregating data for faster performance].
|
|
|
+{ml-docs}/ml-configuring-aggregation.html[Aggregating data for faster performance].
|
|
|
end::aggregations[]
|
|
|
|
|
|
tag::allow-lazy-open[]
|
|
@@ -203,7 +203,7 @@ at the same time as `categorization_filters`. The categorization analyzer
|
|
|
specifies how the `categorization_field` is interpreted by the categorization
|
|
|
process. The syntax is very similar to that used to define the `analyzer` in the
|
|
|
<<indices-analyze,Analyze endpoint>>. For more information, see
|
|
|
-{stack-ov}/ml-configuring-categories.html[Categorizing log messages].
|
|
|
+{ml-docs}/ml-configuring-categories.html[Categorizing log messages].
|
|
|
+
|
|
|
--
|
|
|
The `categorization_analyzer` field can be specified either as a string or as an
|
|
@@ -234,7 +234,7 @@ set this value to `0`, no examples are stored.
|
|
|
--
|
|
|
NOTE: The `categorization_examples_limit` only applies to analysis that uses
|
|
|
categorization. For more information, see
|
|
|
-{stack-ov}/ml-configuring-categories.html[Categorizing log messages].
|
|
|
+{ml-docs}/ml-configuring-categories.html[Categorizing log messages].
|
|
|
|
|
|
--
|
|
|
end::categorization-examples-limit[]
|
|
@@ -244,7 +244,7 @@ If this property is specified, the values of the specified field will be
|
|
|
categorized. The resulting categories must be used in a detector by setting
|
|
|
`by_field_name`, `over_field_name`, or `partition_field_name` to the keyword
|
|
|
`mlcategory`. For more information, see
|
|
|
-{stack-ov}/ml-configuring-categories.html[Categorizing log messages].
|
|
|
+{ml-docs}/ml-configuring-categories.html[Categorizing log messages].
|
|
|
end::categorization-field-name[]
|
|
|
|
|
|
tag::categorization-filters[]
|
|
@@ -254,7 +254,7 @@ are used to filter out matching sequences from the categorization field values.
|
|
|
You can use this functionality to fine tune the categorization by excluding
|
|
|
sequences from consideration when categories are defined. For example, you can
|
|
|
exclude SQL statements that appear in your log files. For more information, see
|
|
|
-{stack-ov}/ml-configuring-categories.html[Categorizing log messages]. This
|
|
|
+{ml-docs}/ml-configuring-categories.html[Categorizing log messages]. This
|
|
|
property cannot be used at the same time as `categorization_analyzer`. If you
|
|
|
only want to define simple regular expression filters that are applied prior to
|
|
|
tokenization, setting this property is the easiest method. If you also want to
|
|
@@ -299,7 +299,7 @@ tag::custom-rules[]
|
|
|
An array of custom rule objects, which enable you to customize the way detectors
|
|
|
operate. For example, a rule may dictate to the detector conditions under which
|
|
|
results should be skipped. For more examples, see
|
|
|
-{stack-ov}/ml-configuring-detector-custom-rules.html[Configuring detector custom rules].
|
|
|
+{ml-docs}/ml-configuring-detector-custom-rules.html[Customizing detectors with custom rules].
|
|
|
A custom rule has the following properties:
|
|
|
+
|
|
|
--
|
|
@@ -363,7 +363,7 @@ end::custom-rules[]
|
|
|
tag::custom-settings[]
|
|
|
Advanced configuration option. Contains custom meta data about the job. For
|
|
|
example, it can contain custom URL information as shown in
|
|
|
-{stack-ov}/ml-configuring-url.html[Adding custom URLs to {ml} results].
|
|
|
+{ml-docs}/ml-configuring-url.html[Adding custom URLs to {ml} results].
|
|
|
end::custom-settings[]
|
|
|
|
|
|
tag::data-description[]
|
|
@@ -503,7 +503,7 @@ an effort to determine whether any data has subsequently been added to the index
|
|
|
If missing data is found, it is a good indication that the `query_delay` option
|
|
|
is set too low and the data is being indexed after the {dfeed} has passed that
|
|
|
moment in time. See
|
|
|
-{stack-ov}/ml-delayed-data-detection.html[Working with delayed data].
|
|
|
+{ml-docs}/ml-delayed-data-detection.html[Working with delayed data].
|
|
|
|
|
|
This check runs only on real-time {dfeeds}.
|
|
|
|
|
@@ -692,7 +692,7 @@ end::from[]
|
|
|
tag::function[]
|
|
|
The analysis function that is used. For example, `count`, `rare`, `mean`, `min`,
|
|
|
`max`, and `sum`. For more information, see
|
|
|
-{stack-ov}/ml-functions.html[Function reference].
|
|
|
+{ml-docs}/ml-functions.html[Function reference].
|
|
|
end::function[]
|
|
|
|
|
|
tag::gamma[]
|
|
@@ -979,7 +979,7 @@ tag::over-field-name[]
|
|
|
The field used to split the data. In particular, this property is used for
|
|
|
analyzing the splits with respect to the history of all splits. It is used for
|
|
|
finding unusual values in the population of all splits. For more information,
|
|
|
-see {stack-ov}/ml-configuring-pop.html[Performing population analysis].
|
|
|
+see {ml-docs}/ml-configuring-pop.html[Performing population analysis].
|
|
|
end::over-field-name[]
|
|
|
|
|
|
tag::outlier-fraction[]
|
|
@@ -1049,7 +1049,7 @@ tag::script-fields[]
|
|
|
Specifies scripts that evaluate custom expressions and returns script fields to
|
|
|
the {dfeed}. The detector configuration objects in a job can contain functions
|
|
|
that use these script fields. For more information, see
|
|
|
-{stack-ov}/ml-configuring-transform.html[Transforming data with script fields]
|
|
|
+{ml-docs}/ml-configuring-transform.html[Transforming data with script fields]
|
|
|
and <<request-body-search-script-fields,Script fields>>.
|
|
|
end::script-fields[]
|
|
|
|