elasticsearch/docs/reference/ml/functions/geo.asciidoc

[role="xpack"]
[[ml-geo-functions]]
=== Geographic functions

The geographic functions detect anomalies in the geographic location of the
input data.

The {ml-features} include the following geographic function: `lat_long`.

NOTE: You cannot create forecasts for jobs that contain geographic functions. 
You also cannot add rules with conditions to detectors that use geographic 
functions. 

[float]
[[ml-lat-long]]
==== Lat_long

The `lat_long` function detects anomalies in the geographic location of the
input data.

This function supports the following properties:

* `field_name` (required)
* `by_field_name` (optional)
* `over_field_name` (optional)
* `partition_field_name` (optional)

For more information about those properties,
see {ref}/ml-job-resource.html#ml-detectorconfig[Detector Configuration Objects].

.Example 1: Analyzing transactions with the lat_long function
[source,js]
--------------------------------------------------
PUT _ml/anomaly_detectors/example1
{
  "analysis_config": {
    "detectors": [{
      "function" : "lat_long",
      "field_name" : "transactionCoordinates",
      "by_field_name" : "creditCardNumber"
    }]
  },
  "data_description": {
    "time_field":"timestamp",
    "time_format": "epoch_ms"
  }
}
--------------------------------------------------
// CONSOLE
// TEST[skip:needs-licence]

If you use this `lat_long` function in a detector in your job, it
detects anomalies where the geographic location of a credit card transaction is
unusual for a particular customer’s credit card. An anomaly might indicate fraud.

IMPORTANT: The `field_name` that you supply must be a single string that contains
two comma-separated numbers of the form `latitude,longitude`. The `latitude` and
`longitude` must be in the range -180 to 180 and represent a point on the
surface of the Earth.

For example, JSON data might contain the following transaction coordinates:

[source,js]
--------------------------------------------------
{
  "time": 1460464275,
  "transactionCoordinates": "40.7,-74.0",
  "creditCardNumber": "1234123412341234"
}
--------------------------------------------------
// NOTCONSOLE

In {es}, location data is likely to be stored in `geo_point` fields. For more
information, see {ref}/geo-point.html[Geo-point datatype]. This data type is not
supported natively in {ml-features}. You can, however, use Painless scripts
in `script_fields` in your {dfeed} to transform the data into an appropriate
format. For example, the following Painless script transforms
`"coords": {"lat" : 41.44, "lon":90.5}` into `"lat-lon": "41.44,90.5"`:

[source,js]
--------------------------------------------------
PUT _ml/datafeeds/datafeed-test2
{
  "job_id": "farequote",
  "indices": ["farequote"],
  "query": {
    "match_all": {
          "boost": 1
    }
  },
  "script_fields": {
    "lat-lon": {
      "script": {
        "source": "doc['coords'].lat + ',' + doc['coords'].lon",
        "lang": "painless"
      }
    }
  }
}
--------------------------------------------------
// CONSOLE
// TEST[skip:setup:farequote_job]

For more information, see <<ml-configuring-transform>>.