elasticsearch/docs/reference/ml/anomaly-detection/configuring.asciidoc

[role="xpack"]
[[ml-configuring]]
== Configuring machine learning

If you want to use {ml-features}, there must be at least one {ml} node in
your cluster and all master-eligible nodes must have {ml} enabled. By default,
all nodes are {ml} nodes. For more information about these settings, see 
{ref}/modules-node.html#ml-node[{ml} nodes].

To use the {ml-features} to analyze your data, you can create an {anomaly-job}
and send your data to that job.

* If your data is stored in {es}:

** You can create a {dfeed}, which retrieves data from {es} for analysis.
** You can use {kib} to expedite the creation of jobs and {dfeeds}.

* If your data is not stored in {es}, you can
{ref}/ml-post-data.html[POST data] from any source directly to an API.

The results of {ml} analysis are stored in {es} and you can use {kib} to help
you visualize and explore the results.

//For a tutorial that walks you through these configuration steps,
//see <<ml-getting-started>>.

Though it is quite simple to analyze your data and provide quick {ml} results,
gaining deep insights might require some additional planning and configuration.
The scenarios in this section describe some best practices for generating useful
{ml} results and insights from your data.

* <<ml-configuring-url>>
* <<ml-configuring-aggregation>>
* <<ml-configuring-categories>>
* <<ml-configuring-detector-custom-rules>>
* <<ml-configuring-pop>>
* <<ml-configuring-transform>>
* <<ml-delayed-data-detection>>

include::customurl.asciidoc[]

include::aggregations.asciidoc[]

include::detector-custom-rules.asciidoc[]

include::categories.asciidoc[]

include::populations.asciidoc[]

include::transforms.asciidoc[]

include::delayed-data-detection.asciidoc[]