diff --git a/solutions/images/observability-anomalies-chart.png b/solutions/images/observability-anomalies-chart.png index 003e06fc5e..41979c713e 100644 Binary files a/solutions/images/observability-anomalies-chart.png and b/solutions/images/observability-anomalies-chart.png differ diff --git a/solutions/images/observability-log-opened.png b/solutions/images/observability-log-opened.png index 33e07a84cb..1829a7e303 100644 Binary files a/solutions/images/observability-log-opened.png and b/solutions/images/observability-log-opened.png differ diff --git a/solutions/observability/logs/categorize-log-entries.md b/solutions/observability/logs/categorize-log-entries.md index 877225dbf8..719f38ad5b 100644 --- a/solutions/observability/logs/categorize-log-entries.md +++ b/solutions/observability/logs/categorize-log-entries.md @@ -2,7 +2,8 @@ mapped_pages: - https://www.elastic.co/guide/en/observability/current/categorize-logs.html applies_to: - stack: all + stack: ga + serverless: ga products: - id: observability --- @@ -17,8 +18,6 @@ The **Categories** page enables you to identify patterns in your log events quic This feature makes use of {{ml}} {{anomaly-jobs}}. To set up jobs, you must have `all` {{kib}} feature privileges for **{{ml-app}}**. Users that have full or read-only access to {{ml-features}} within a {{kib}} space can view the results of *all* {{anomaly-jobs}} that are visible in that space, even if they do not have access to the source indices of those jobs. You must carefully consider who is given access to {{ml-features}}; {{anomaly-job}} results may propagate field values that contain sensitive information from the source indices to the results. For more details, refer to [Set up {{ml-features}}](/explore-analyze/machine-learning/setting-up-machine-learning.md). :::: - - ## Create log categories [create-log-categories] Create a {{ml}} job to categorize log messages automatically. {{ml-cap}} observes the static parts of the message, clusters similar messages, classifies them into message categories, and detects unusually high message counts in the categories. @@ -26,7 +25,7 @@ Create a {{ml}} job to categorize log messages automatically. {{ml-cap}} observe 1. Open the **Categories** page by finding `Logs / Categories` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). You are prompted to use {{ml}} to create log rate categorizations. 2. Choose a time range for the {{ml}} analysis. By default, the {{ml}} job analyzes log messages no older than four weeks and continues indefinitely. 3. Add the indices that contain the logs you want to examine. By default, Machine Learning analyzes messages in all log indices that match the patterns set in the **logs sources** advanced setting. To open **Advanced settings**, find **Stack Management** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -4. Click **Create ML job**. The job is created, and it starts to run. It takes a few minutes for the {{ml}} robots to collect the necessary data. After the job processed the data, you can view the results. +4. Click **Create ML job**. The creates and runs the job. It takes a few minutes for the {{ml}} robots to collect the necessary data. After the job has processed the data, you can view its results. ## Analyze log categories [analyze-log-categories] @@ -46,7 +45,7 @@ The category row contains the following information: * datasets: the name of the datasets where the categories are present. * maximum anomaly score: the highest anomaly score in the category. -To view a log message under a particular category, click the arrow at the end of the row. To further examine a message, it can be viewed in the corresponding log event on the **Stream** page or displayed in its context. +To view a log message for a particular category, click the arrow at the end of the row. To further examine it, click **View in Discover** or **View in context** :::{image} /solutions/images/observability-log-opened.png :alt: Opened log category diff --git a/solutions/observability/logs/inspect-log-anomalies.md b/solutions/observability/logs/inspect-log-anomalies.md index f99c374a0f..c6ea29768e 100644 --- a/solutions/observability/logs/inspect-log-anomalies.md +++ b/solutions/observability/logs/inspect-log-anomalies.md @@ -2,7 +2,8 @@ mapped_pages: - https://www.elastic.co/guide/en/observability/current/inspect-log-anomalies.html applies_to: - stack: all + stack: ga + serverless: ga products: - id: observability --- @@ -22,18 +23,14 @@ You can also view log anomalies directly in the [{{ml-app}} app](/explore-analyz This feature makes use of {{ml}} {{anomaly-jobs}}. To set up jobs, you must have `all` {{kib}} feature privileges for **{{ml-app}}**. Users that have full or read-only access to {{ml-features}} within a {{kib}} space can view the results of *all* {{anomaly-jobs}} that are visible in that space, even if they do not have access to the source indices of those jobs. You must carefully consider who is given access to {{ml-features}}; {{anomaly-job}} results may propagate field values that contain sensitive information from the source indices to the results. For more details, refer to [Set up {{ml-features}}](/explore-analyze/machine-learning/setting-up-machine-learning.md). :::: - - ## Enable log rate analysis and {{anomaly-detect}} [enable-anomaly-detection] Create a {{ml}} job to detect anomalous log entry rates automatically. -1. Select **Anomalies**, and you’ll be prompted to create a {{ml}} job which will carry out the log rate analysis. +1. From the main menu, go to **Other tools** → **Logs Anomalies**, or find `Logs anomalies` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). From here, you’ll be prompted to create a {{ml}} job which will carry out the log rate analysis. 2. Choose a time range for the {{ml}} analysis. 3. Add the indices that contain the logs you want to examine. By default, Machine Learning analyzes messages in all log indices that match the patterns set in the **logs source** advanced setting. To open **Advanced settings**, find **Stack Management** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -4. Click **Create {{ml-init}} job**. -5. You’re now ready to explore your log partitions. - +4. Click **Create ML job**. This creates and runs the job. It takes a few minutes for the {{ml}} robots to collect the necessary data. After the job has processed the data, you can view its results. ## Anomalies chart [anomalies-chart]