If you have log entries that are message-based, but are machine-generated, then before they can be useful for anomaly detection, they first need to be organized into similar message types. This process is called categorization and Elastic ML can help with that process.
Counting message-based logs via categorization
Types of messages that can be categorized by ML
We need to be a little rigorous in our definition of the kinds of message-based log lines that are being considered here. What we are not considering are log lines/events/documents that are completely free-form and likely the result of human creation (emails, tweets, comments, and so on). These kinds of messages are too arbitrary and variable in their construction...
