diff --git a/docs/reference/ml/aggregations.asciidoc b/docs/reference/ml/aggregations.asciidoc index 4b873ea790b1e..43a789d1337c6 100644 --- a/docs/reference/ml/aggregations.asciidoc +++ b/docs/reference/ml/aggregations.asciidoc @@ -8,7 +8,7 @@ and to configure your jobs to analyze aggregated data. One of the benefits of aggregating data this way is that {es} automatically distributes these calculations across your cluster. You can then feed this -aggregated data into {xpackml} instead of raw results, which +aggregated data into the {ml-features} instead of raw results, which reduces the volume of data that must be considered while detecting anomalies. There are some limitations to using aggregations in {dfeeds}, however. diff --git a/docs/reference/ml/apis/resultsresource.asciidoc b/docs/reference/ml/apis/resultsresource.asciidoc index 8962129c73966..f2533bbd07345 100644 --- a/docs/reference/ml/apis/resultsresource.asciidoc +++ b/docs/reference/ml/apis/resultsresource.asciidoc @@ -269,7 +269,7 @@ probability of this occurrence. There can be many anomaly records depending on the characteristics and size of the input data. In practice, there are often too many to be able to manually -process them. The {xpackml} features therefore perform a sophisticated +process them. The {ml-features} therefore perform a sophisticated aggregation of the anomaly records into buckets. The number of record results depends on the number of anomalies found in each diff --git a/docs/reference/ml/configuring.asciidoc b/docs/reference/ml/configuring.asciidoc index a7773b5681f89..9304a93d360c7 100644 --- a/docs/reference/ml/configuring.asciidoc +++ b/docs/reference/ml/configuring.asciidoc @@ -2,12 +2,12 @@ [[ml-configuring]] == Configuring machine learning -If you want to use {xpackml} features, there must be at least one {ml} node in +If you want to use {ml-features}, there must be at least one {ml} node in your cluster and all master-eligible nodes must have {ml} enabled. By default, all nodes are {ml} nodes. For more information about these settings, see {ref}/modules-node.html#modules-node-xpack[{ml} nodes]. -To use the {xpackml} features to analyze your data, you must create a job and +To use the {ml-features} to analyze your data, you must create a job and send your data to that job. * If your data is stored in {es}: diff --git a/docs/reference/ml/functions.asciidoc b/docs/reference/ml/functions.asciidoc index e32470c6827b6..48e56bb4627ee 100644 --- a/docs/reference/ml/functions.asciidoc +++ b/docs/reference/ml/functions.asciidoc @@ -2,7 +2,7 @@ [[ml-functions]] == Function reference -The {xpackml} features include analysis functions that provide a wide variety of +The {ml-features} include analysis functions that provide a wide variety of flexible ways to analyze data for anomalies. When you create jobs, you specify one or more detectors, which define the type of diff --git a/docs/reference/ml/functions/count.asciidoc b/docs/reference/ml/functions/count.asciidoc index abbbd118ffebf..868afddbdc136 100644 --- a/docs/reference/ml/functions/count.asciidoc +++ b/docs/reference/ml/functions/count.asciidoc @@ -14,7 +14,7 @@ in one field is unusual, as opposed to the total count. Use high-sided functions if you want to monitor unusually high event rates. Use low-sided functions if you want to look at drops in event rate. -The {xpackml} features include the following count functions: +The {ml-features} include the following count functions: * xref:ml-count[`count`, `high_count`, `low_count`] * xref:ml-nonzero-count[`non_zero_count`, `high_non_zero_count`, `low_non_zero_count`] diff --git a/docs/reference/ml/functions/geo.asciidoc b/docs/reference/ml/functions/geo.asciidoc index 461ab825ff5b2..43cfc1a96754c 100644 --- a/docs/reference/ml/functions/geo.asciidoc +++ b/docs/reference/ml/functions/geo.asciidoc @@ -5,7 +5,7 @@ The geographic functions detect anomalies in the geographic location of the input data. -The {xpackml} features include the following geographic function: `lat_long`. +The {ml-features} include the following geographic function: `lat_long`. NOTE: You cannot create forecasts for jobs that contain geographic functions. You also cannot add rules with conditions to detectors that use geographic @@ -72,7 +72,7 @@ For example, JSON data might contain the following transaction coordinates: In {es}, location data is likely to be stored in `geo_point` fields. For more information, see {ref}/geo-point.html[Geo-point datatype]. This data type is not -supported natively in {xpackml} features. You can, however, use Painless scripts +supported natively in {ml-features}. You can, however, use Painless scripts in `script_fields` in your {dfeed} to transform the data into an appropriate format. For example, the following Painless script transforms `"coords": {"lat" : 41.44, "lon":90.5}` into `"lat-lon": "41.44,90.5"`: diff --git a/docs/reference/ml/functions/info.asciidoc b/docs/reference/ml/functions/info.asciidoc index 2c3117e0e5644..c75440f238ff5 100644 --- a/docs/reference/ml/functions/info.asciidoc +++ b/docs/reference/ml/functions/info.asciidoc @@ -6,7 +6,7 @@ that is contained in strings within a bucket. These functions can be used as a more sophisticated method to identify incidences of data exfiltration or C2C activity, when analyzing the size in bytes of the data might not be sufficient. -The {xpackml} features include the following information content functions: +The {ml-features} include the following information content functions: * `info_content`, `high_info_content`, `low_info_content` diff --git a/docs/reference/ml/functions/metric.asciidoc b/docs/reference/ml/functions/metric.asciidoc index 9d6f3515a029c..7868d4b780a40 100644 --- a/docs/reference/ml/functions/metric.asciidoc +++ b/docs/reference/ml/functions/metric.asciidoc @@ -6,7 +6,7 @@ The metric functions include functions such as mean, min and max. These values are calculated for each bucket. Field values that cannot be converted to double precision floating point numbers are ignored. -The {xpackml} features include the following metric functions: +The {ml-features} include the following metric functions: * <> * <> diff --git a/docs/reference/ml/functions/rare.asciidoc b/docs/reference/ml/functions/rare.asciidoc index 1531285a7add2..87c212fbd1275 100644 --- a/docs/reference/ml/functions/rare.asciidoc +++ b/docs/reference/ml/functions/rare.asciidoc @@ -27,7 +27,7 @@ with shorter bucket spans typically being measured in minutes, not hours. for typical data. ==== -The {xpackml} features include the following rare functions: +The {ml-features} include the following rare functions: * <> * <> @@ -85,7 +85,7 @@ different rare status codes compared to the population is regarded as highly anomalous. This analysis is based on the number of different status code values, not the count of occurrences. -NOTE: To define a status code as rare the {xpackml} features look at the number +NOTE: To define a status code as rare the {ml-features} look at the number of distinct status codes that occur, not the number of times the status code occurs. If a single client IP experiences a single unique status code, this is rare, even if it occurs for that client IP in every bucket. diff --git a/docs/reference/ml/functions/sum.asciidoc b/docs/reference/ml/functions/sum.asciidoc index 7a95ad63fccee..9313a60a01a6c 100644 --- a/docs/reference/ml/functions/sum.asciidoc +++ b/docs/reference/ml/functions/sum.asciidoc @@ -11,7 +11,7 @@ If want to look at drops in totals, use low-sided functions. If your data is sparse, use `non_null_sum` functions. Buckets without values are ignored; buckets with a zero value are analyzed. -The {xpackml} features include the following sum functions: +The {ml-features} include the following sum functions: * xref:ml-sum[`sum`, `high_sum`, `low_sum`] * xref:ml-nonnull-sum[`non_null_sum`, `high_non_null_sum`, `low_non_null_sum`] diff --git a/docs/reference/ml/functions/time.asciidoc b/docs/reference/ml/functions/time.asciidoc index ac8199307f130..026d29d85d3d7 100644 --- a/docs/reference/ml/functions/time.asciidoc +++ b/docs/reference/ml/functions/time.asciidoc @@ -6,7 +6,7 @@ The time functions detect events that happen at unusual times, either of the day or of the week. These functions can be used to find unusual patterns of behavior, typically associated with suspicious user activity. -The {xpackml} features include the following time functions: +The {ml-features} include the following time functions: * <> * <> diff --git a/docs/reference/ml/transforms.asciidoc b/docs/reference/ml/transforms.asciidoc index 5273a26c204e3..65572aa88b9be 100644 --- a/docs/reference/ml/transforms.asciidoc +++ b/docs/reference/ml/transforms.asciidoc @@ -573,7 +573,7 @@ GET _xpack/ml/datafeeds/datafeed-test4/_preview // TEST[skip:needs-licence] In {es}, location data can be stored in `geo_point` fields but this data type is -not supported natively in {xpackml} analytics. This example of a script field +not supported natively in {ml} analytics. This example of a script field transforms the data into an appropriate format. For more information, see <>. diff --git a/docs/reference/modules/ml-node.asciidoc b/docs/reference/modules/ml-node.asciidoc index 9e4413e3a0c7e..5a907adfbbf3a 100644 --- a/docs/reference/modules/ml-node.asciidoc +++ b/docs/reference/modules/ml-node.asciidoc @@ -9,10 +9,9 @@ If {xpack} is installed, there is an additional node type: <>:: A node that has `xpack.ml.enabled` and `node.ml` set to `true`, which is the -default behavior when {xpack} is installed. If you want to use {xpackml} -features, there must be at least one {ml} node in your cluster. For more -information about {xpackml} features, -see {xpack-ref}/xpack-ml.html[Machine Learning in the Elastic Stack]. +default behavior when {xpack} is installed. If you want to use {ml-features}, there must be at least one {ml} node in your cluster. For more +information about {ml-features}, +see {stack-ov}/xpack-ml.html[Machine learning in the {stack}]. IMPORTANT: Do not set use the `node.ml` setting unless {xpack} is installed. Otherwise, the node fails to start. @@ -88,11 +87,11 @@ node.ml: false <5> [[ml-node]] === [xpack]#Machine learning node# -The {xpackml} features provide {ml} nodes, which run jobs and handle {ml} API +The {ml-features} provide {ml} nodes, which run jobs and handle {ml} API requests. If `xpack.ml.enabled` is set to true and `node.ml` is set to `false`, the node can service API requests but it cannot run jobs. -If you want to use {xpackml} features in your cluster, you must enable {ml} +If you want to use {ml-features} in your cluster, you must enable {ml} (set `xpack.ml.enabled` to `true`) on all master-eligible nodes. Do not use these settings if you do not have {xpack} installed.