Getting Started

Ready to get some hands-on experience with the X-Pack machine learning features? This tutorial shows you how to:

  • Load a sample data set into Elasticsearch
  • Create a machine learning job
  • Use the results to identify possible anomalies in the data

At the end of this tutorial, you should have a good idea of what machine learning is and will hopefully be inspired to use it to detect anomalies in your own data.

You might also be interested in these video tutorials:

System Overview

To follow the steps in this tutorial, you will need the following components of the Elastic Stack:

  • Elasticsearch 5.4.0, which stores the data and the analysis results
  • X-Pack 5.4.0, which includes the beta machine learning features for both Elasticsearch and Kibana
  • Kibana 5.4.0, which provides a helpful user interface for creating and viewing jobs

The X-Pack machine learning features are in beta and subject to change. Beta features are not subject to the same support SLA as GA features, and deployment in production is at your own risk.

See the Elastic Support Matrix for information about supported operating systems.

See Installing the Elastic Stack for information about installing each of the components.


To get started, you can install Elasticsearch and Kibana on a single VM or even on your laptop (requires 64-bit OS). As you add more data and your traffic grows, you’ll want to replace the single Elasticsearch instance with a cluster.

When you install X-Pack into Elasticsearch and Kibana, the machine learning features are enabled by default. If you have multiple nodes in your cluster, you can optionally dedicate nodes to specific purposes. If you want to control which nodes are machine learning nodes or limit which nodes run resource-intensive activity related to jobs, see Machine Learning Settings.

Users, Roles, and Privileges

The X-Pack machine learning features implement cluster privileges and built-in roles to make it easier to control which users have authority to view and manage the jobs, datafeeds, and results.

By default, you can perform all of the steps in this tutorial by using the built-in elastic super user. The default password for the elastic user is changeme. For information about how to change that password, see Getting Started with Security.

If you are performing these steps in a production environment, take extra care because elastic has the superuser role and you could inadvertently make significant changes to the system. You can alternatively assign the machine_learning_admin and kibana_user roles to a user ID of your choice.

For more information, see Built-in Roles and Cluster Privileges.