[ML] Update http access modules for ECS (#29383)

* [ML] Initial commit for apache ecs module * [ML] Update apache2 module for ECS Rename following fields event.module:apache event.dataset:access source.address url.original http.response.status_code source.geo.location Rationalise to only use one set of kibana saved objects for all http web access logs Rename files from apache Combined URL explorer into Count explorer dashboard as there was a lot of duplication Add filter to custom url Rename custom urls to Investigate Source IP and Status Code Add chart to show overall event rate split by event.module - can tell if multiple datasets are included Increase limit for top source ips from 5 to 50 Add created_by to custom setting for telemetry Rename jobs and saved objects to include ecs tag Tested side by side against v6 jobs * [ML] Rename apache files from hyphen to underscores * [ML] Further apache renames Also change custom URLs to lower case to match "View series" Change created_by to ml-module-apache-access * [ML] Initial commit of nginx ml module * [ML] Rename dashboard to generic explorer * [ML] Further refinement for apache Rename http_status_code to status_code_rate Update custom url to use filters instead of lucene query bar * [ML] Convert apache module to nginx Copy files, keeping nginx logo Multiple renames to nginx * [ML] Make chart legend visible by default
elastic · Jan 31, 2019 · 413d37d · 413d37d
1 parent 0467735
commit 413d37d
Show file tree

Hide file tree

Showing 42 changed files with 1,025 additions and 0 deletions.
diff --git a/...dels/data_recognizer/modules/apache_ecs/kibana/dashboard/ml_http_access_explorer_ecs.json b/...dels/data_recognizer/modules/apache_ecs/kibana/dashboard/ml_http_access_explorer_ecs.json
@@ -0,0 +1,13 @@
+{
+  "hits": 0, 
+  "timeRestore": false, 
+  "description": "", 
+  "title": "ML HTTP Access Explorer (ECS)", 
+  "uiStateJSON": "{\"P-3\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-5\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}}", 
+  "panelsJSON": "[{\"size_x\":6,\"size_y\":3,\"panelIndex\":1,\"type\":\"visualization\",\"id\":\"ml_http_access_events_timechart_ecs\",\"col\":1,\"row\":1},{\"size_x\":6,\"size_y\":3,\"panelIndex\":2,\"type\":\"visualization\",\"id\":\"ml_http_access_unique_count_url_timechart_ecs\",\"col\":7,\"row\":1},{\"size_x\":6,\"size_y\":3,\"panelIndex\":3,\"type\":\"visualization\",\"id\":\"ml_http_access_status_code_timechart_ecs\",\"col\":1,\"row\":4},{\"size_x\":6,\"size_y\":3,\"panelIndex\":4,\"type\":\"visualization\",\"id\":\"ml_http_access_source_ip_timechart_ecs\",\"col\":7,\"row\":4},{\"size_x\":6,\"size_y\":3,\"panelIndex\":5,\"type\":\"visualization\",\"id\":\"ml_http_access_top_source_ips_table_ecs\",\"col\":1,\"row\":8},{\"size_x\":6,\"size_y\":3,\"panelIndex\":6,\"type\":\"visualization\",\"id\":\"ml_http_access_map_ecs\",\"col\":7,\"row\":8},{\"size_x\":12,\"size_y\":9,\"panelIndex\":7,\"type\":\"visualization\",\"id\":\"ml_http_access_top_urls_table_ecs\",\"col\":1,\"row\":11}]", 
+  "optionsJSON": "{\"darkTheme\":false}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\n  \"filter\": [],\n  \"highlightAll\": true,\n  \"version\": true,\n  \"query\": {\n    \"query\": \"\",\n    \"language\": \"lucene\"\n  }\n}"
+  }
+}
diff --git a/.../models/data_recognizer/modules/apache_ecs/kibana/search/ml_http_access_filebeat_ecs.json b/.../models/data_recognizer/modules/apache_ecs/kibana/search/ml_http_access_filebeat_ecs.json
@@ -0,0 +1,16 @@
+{
+  "sort": [
+    "@timestamp",
+    "desc"
+  ],
+  "hits": 0,
+  "description": "Filebeat HTTP Access Data (ECS)",
+  "title": "ML HTTP Access Data (ECS)",
+  "version": 1,
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"index\":\"INDEX_PATTERN_ID\",\"query\":{\"query_string\":{\"query\":\"fileset.name:access\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}"
+  },
+  "columns": [
+    "_source"
+  ]
+}
diff --git a/...cognizer/modules/apache_ecs/kibana/visualization/ml_http_access_events_timechart_ecs.json b/...cognizer/modules/apache_ecs/kibana/visualization/ml_http_access_events_timechart_ecs.json
@@ -0,0 +1,11 @@
+{
+    "visState": "{\"title\":\"ML HTTP Access Event Timechart (ECS)\",\"type\":\"histogram\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.module\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\"}},{\"id\":\"4\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"event.dataset\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+    "description": "", 
+    "title": "ML HTTP Access Event Timechart (ECS)", 
+    "uiStateJSON": "{\"vis\":{\"colors\":{\"apache - access\":\"#629E51\",\"nginx - access\":\"#1F78C1\"}}}", 
+    "version": 1, 
+    "savedSearchId": "ml_http_access_filebeat_ecs", 
+    "kibanaSavedObjectMeta": {
+      "searchSourceJSON": "{}"
+    }
+  }
diff --git a/...odels/data_recognizer/modules/apache_ecs/kibana/visualization/ml_http_access_map_ecs.json b/...odels/data_recognizer/modules/apache_ecs/kibana/visualization/ml_http_access_map_ecs.json
@@ -0,0 +1,11 @@
+{
+  "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"autoPrecision\":true,\"field\":\"source.geo.location\"},\"schema\":\"segment\",\"type\":\"geohash_grid\"}],\"listeners\":{},\"params\":{\"addTooltip\":true,\"heatBlur\":15,\"heatMaxZoom\":16,\"heatMinOpacity\":0.1,\"heatNormalizeData\":true,\"heatRadius\":25,\"isDesaturated\":true,\"legendPosition\":\"bottomright\",\"mapCenter\":[15,5],\"mapType\":\"Scaled Circle Markers\",\"mapZoom\":2,\"wms\":{\"enabled\":false,\"options\":{\"attribution\":\"Maps provided by USGS\",\"format\":\"image/png\",\"layers\":\"0\",\"styles\":\"\",\"transparent\":true,\"version\":\"1.3.0\"},\"url\":\"https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer\"}},\"title\":\"ML HTTP Access Map (ECS)\",\"type\":\"tile_map\"}", 
+  "description": "", 
+  "title": "ML HTTP Access Map (ECS)", 
+  "uiStateJSON": "{\n  \"mapCenter\": [\n    12.039320557540572,\n    -0.17578125\n  ]\n}", 
+  "version": 1, 
+  "savedSearchId": "ml_http_access_filebeat_ecs", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{}"
+  }
+}
diff --git a/...nizer/modules/apache_ecs/kibana/visualization/ml_http_access_source_ip_timechart_ecs.json b/...nizer/modules/apache_ecs/kibana/visualization/ml_http_access_source_ip_timechart_ecs.json
@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"ML HTTP Access Source IP Timechart (ECS)\",\"type\":\"area\",\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"@timestamp per 5 minutes\"},\"type\":\"category\"}],\"defaultYExtents\":false,\"drawLinesBetweenPoints\":true,\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"interpolate\":\"linear\",\"legendPosition\":\"right\",\"radiusRatio\":9,\"scale\":\"linear\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"area\",\"valueAxis\":\"ValueAxis-1\"}],\"setYExtents\":false,\"showCircles\":true,\"times\":[],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"value\"}]},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"source.address\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "ML HTTP Access Source IP Timechart (ECS)", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "ml_http_access_filebeat_ecs", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{}"
+  }
+}
diff --git a/...zer/modules/apache_ecs/kibana/visualization/ml_http_access_status_code_timechart_ecs.json b/...zer/modules/apache_ecs/kibana/visualization/ml_http_access_status_code_timechart_ecs.json
@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"ML HTTP Access Status Code Timechart (ECS)\",\"type\":\"histogram\",\"params\":{\"shareYAxis\":true,\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"yAxis\":{}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"http.response.status_code\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "ML HTTP Access Status Code Timechart (ECS)", 
+  "uiStateJSON": "{\n  \"vis\": {\n    \"colors\": {\n      \"200\": \"#7EB26D\",\n      \"404\": \"#614D93\"\n    }\n  }\n}", 
+  "version": 1, 
+  "savedSearchId": "ml_http_access_filebeat_ecs", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{}"
+  }
+}
diff --git a/...izer/modules/apache_ecs/kibana/visualization/ml_http_access_top_source_ips_table_ecs.json b/...izer/modules/apache_ecs/kibana/visualization/ml_http_access_top_source_ips_table_ecs.json
@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"ML HTTP Access Top Source IPs Table (ECS)\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"source.address\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "ML HTTP Access Top Source IPs Table (ECS)", 
+  "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", 
+  "version": 1, 
+  "savedSearchId": "ml_http_access_filebeat_ecs", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{}"
+  }
+}
diff --git a/...recognizer/modules/apache_ecs/kibana/visualization/ml_http_access_top_urls_table_ecs.json b/...recognizer/modules/apache_ecs/kibana/visualization/ml_http_access_top_urls_table_ecs.json
@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"ML HTTP Access Top URLs Table (ECS)\",\"type\":\"table\",\"params\":{\"perPage\":100,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"url.original\",\"size\":1000,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "ML HTTP Access Top URLs Table (ECS)", 
+  "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", 
+  "version": 1, 
+  "savedSearchId": "ml_http_access_filebeat_ecs", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{}"
+  }
+}
diff --git a/...odules/apache_ecs/kibana/visualization/ml_http_access_unique_count_url_timechart_ecs.json b/...odules/apache_ecs/kibana/visualization/ml_http_access_unique_count_url_timechart_ecs.json
@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"ML HTTP Access Unique Count URL Timechart (ECS)\",\"type\":\"line\",\"params\":{\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{\"text\":\"@timestamp per day\"}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Unique count of url.original\"}}],\"seriesParams\":[{\"show\":true,\"mode\":\"normal\",\"type\":\"line\",\"drawLinesBetweenPoints\":true,\"showCircles\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"data\":{\"id\":\"1\",\"label\":\"Unique count of url.original\"},\"valueAxis\":\"ValueAxis-1\"}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"showCircles\":true,\"interpolate\":\"linear\",\"scale\":\"linear\",\"drawLinesBetweenPoints\":true,\"radiusRatio\":9,\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"url.original\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "ML HTTP Access Unique Count URL Timechart (ECS)", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "ml_http_access_filebeat_ecs", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{}"
+  }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apache_ecs/logo.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apache_ecs/logo.json
@@ -0,0 +1,6 @@
+{
+	"src": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAA5CAIAAADYwb7wAAAHTUlEQVR4AbXTa1iT5xkH8Lvt7BTFtXioxjcJggIiHkQFUQQFJgdEUGB27arOQxHdCgNdUStFC1OrbR3latU5kIAogoKUg1JQAjkgkIQEAjSExBBCSAIkkDM5sMf5rR/64ZU81/vhzvX+r/v33s/zBKZnYtlVPHOhl/EGwabo+dUrmInu3aYrYM4Dwzcw+QXYdaoZBTQi/eVX3c233zbdnKfNAkNxzMwBZo3+azD++1V3c76T6SYYrsPkFZg2js0EYLOidsbvwHQLpu76ThV5mhHwPWgvARrLbre/KTCRG69Jh6kCMJUGTlXuM99Cc4DpRzBfhWm9wmq1cbg8iUSCEzAz78oTYfQ0mAq9ppnpZoqTpQCm8sH4AxivoS1So8zYuFqhUOIBrAqxbB8oU2cp/gbG6kxjUfhENkzkOKuznEfTQH01eNpux38GdptVdgBkB0F+BLR3UvTlWYpjoEpbqEpzUZ1aOHIAjI15b3SL1DfTxBEwfGSJMiPQ0ERRnnZXpswfPb1g7HOX8Qxn5TGwjUnxA+Z+jsAfhg57SBJA/zRfczt16ACMpBAVqUtUp5YqjsJE7m78/2S71SIMf1e0e554z2zVt8n65/cG/wSypOXDyST5SeLIZ5gsAaxDvfgBVe65nrUg3u8zEOViaH6szP5Ikug0dHiF7Ijb8HG3wXgYzY5GMZyARSrikUG427tvy9vjd67qfi4VhsDgXzyln6yQHnIfOkQWh4FVJcUL2O09fht6NswV7FrVH71Gz2iQJkcKo4niRK+X+z0HD3j3B4D6zpcoiBPQPKigAfQGb+ryfEtdckvzuLhnHQzE+ojiVokTVgsCYfDgGvQROAGb0dgGi1ngwVu++pfIAH1ri2h/iGCHe3+UtzDGqz+CMJJ10KpWoSROYPh8Dh2At8L/BThr7t+frCnnEqBv59q+nT59OzwHj+8fu5E3WVdnt1rxABbVKANmsz9Yx17k07V2p57G7A0K5WLePLf13OUbuO6+Pf6hDICJigqcE7xMTmeCU6e7Xyu8P1Zwd/zeQwbM78Q2dy7x5RJ8uZgvC1w5Lp7TFgsewCIbocHvOYQN7KXrOkkbtejzQ2NZ8705mC8H29BJ8uWSN9IAtPWNKIwHEB/9jA7OHDd/JixQ3aZM1NYz0ee7bkQA8tC+obFkZy6gJB5galBGhfdYyzaxl25sn+OtY3YIEw93zPLoxF4BnCXr+JvCRH89ae4X4QQkGTlNQGgnb2UAceSbHyYbqQxw4ZD8ONgm9KB94/v9kesRYJHJ8QDWSe1zWE13CXhB2t4M7loqU5KW2QrubDQQesibO+Z602G2rqkFhfEA8vzyOnClk0OaYJ0wJUvLYLXAyjZSQAfmx1q2uWPxen5wrDLvNkriAew2W8vK6EbY0kIKeworNc+ZwzeLnsGKVuL2F9jWNmxLG2Ezb3OE+PgpdDvxANouQRX4NGHhjfOCWFGfalndNCyk5YMgOhbEwIJalwW2uQY+gzljxWU4JxBcuFEB6xtdo6tgjbKyQVXVWANezeSwFmIIDdtJx4LR2VDB26bV4QFsFkuda1z1nNCnhOgnfwjTvOCx4v7e4BTchO2iYmHNy0L/v29uA2k5KIwHmOgSlsG2WmLcI9gmvEZR0zmV4NtAjmokRjzDwhHTRAitgZVmqRwnMHCjsgS2V5MTSmHrOJMnvFZYCdvqSTH1pKifiZHP3HdXgkdv2mWUxAlQYzNKIfKhczQj4aya3ff4vegawp46YuwTLKaevKfmnR2VsNZmMOEErFpD+eL4soXxFNg+/BNdXk27CwHVpPhq0t5aclwtIaYIlqtpHJTECYzypXcg7uHSxPtOcWMdvfQ/Z5XNiakkJlSREquW7i0Ar4HcEhTDD3Q/Yn0HH5dAJPcrymh7HwV2PSJ9WOH64YM5MRTwF+WVogwewGa1qfrkqGAXtFx8N+lHiBxl8oUFTwog/P77CRQIfbRgr/YXyeskzgmEDfzWvAZm7tMv3kku3Hp+omvgJ5+jFa6f0D/+Sl7bajNbNNJxLoWOH0DrvxHfZs46cQ4+5dxrk9F6L8G+yvhr/GKatE30+GTxxd8lTemMKIYfUPWNpMOxc28lyzsHGy7VZcz9x79WZmYtSj8Fh66vOmPU6FEGJ2C32V//uLLqy+8DLsu40gvY5zluZ3NIGdfXZ1G/rhvqEKO3+IEpk0XS/lLGHcrEzrRTmP1UQSqcyPY4f5GYcXZu6vWN2Qq+7I0AtPi13Ulw4iScUAmU+R/lJ8HxM4v+eX5ZRunRwmHOIArgB9DFkHXLO8rYvfW9jHwm+yGnNKUM1cImgVYx+es4PkA3bnh9EkK6SDeuk7ClOJv99i0SNA/waviosE5ZTTrTzAPNBW1olN9O4wdGpZqmgnZUOArg1gu6GoQOBJpLuNpxg6OAyTED9QEPFY4CWM2CDqrAgUD5vRaVcsJRgFZrKC5qnHbYAiazt6623YHAf27ViUQjDgTo9J5pR67/AfRrVpVr6wheAAAAAElFTkSuQmCC",
+	"height": 25,
+	"width": 125
+}
+
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apache_ecs/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apache_ecs/manifest.json
@@ -0,0 +1,111 @@
+{
+  "id": "apache_ecs",
+  "title": "Apache access logs",
+  "description": "Find unusual activity in HTTP access logs from filebeat (ECS)",
+  "type": "Web Access Logs",
+  "logoFile": "logo.json",
+  "defaultIndexPattern": "filebeat-*",
+  "query": {
+    "bool": {
+      "filter": [
+        { "term":  { "event.dataset": "apache.access" } },
+        { "exists": { "field": "source.address" } },
+        { "exists": { "field": "url.original" } },
+        { "exists": { "field": "http.response.status_code" } }
+      ]
+    }
+  },
+  "jobs": [
+    {
+      "id": "visitor_rate_ecs",
+      "file": "visitor_rate_ecs.json"
+    },
+    {
+      "id": "status_code_rate_ecs",
+      "file": "status_code_rate_ecs.json"
+    },
+    {
+      "id": "source_ip_url_count_ecs",
+      "file": "source_ip_url_count_ecs.json"
+    },
+    {
+      "id": "source_ip_request_rate_ecs",
+      "file": "source_ip_request_rate_ecs.json"
+    },
+    {
+      "id": "low_request_rate_ecs",
+      "file": "low_request_rate_ecs.json"
+    }
+  ],
+  "datafeeds": [
+    {
+      "id": "datafeed-visitor_rate_ecs",
+      "file": "datafeed_visitor_rate_ecs.json",
+      "job_id": "visitor_rate_ecs"
+    },
+    {
+      "id": "datafeed-status_code_rate_ecs",
+      "file": "datafeed_status_code_rate_ecs.json",
+      "job_id": "status_code_rate_ecs"
+    },
+    {
+      "id": "datafeed-source_ip_url_count_ecs",
+      "file": "datafeed_source_ip_url_count_ecs.json",
+      "job_id": "source_ip_url_count_ecs"
+    },
+    {
+      "id": "datafeed-source_ip_request_rate_ecs",
+      "file": "datafeed_source_ip_request_rate_ecs.json",
+      "job_id": "source_ip_request_rate_ecs"
+    },
+    {
+      "id": "datafeed-low_request_rate_ecs",
+      "file": "datafeed_low_request_rate_ecs.json",
+      "job_id": "low_request_rate_ecs"
+    }
+  ],
+  "kibana": {
+    "dashboard": [
+      {
+        "id": "ml_http_access_explorer_ecs",
+        "file": "ml_http_access_explorer_ecs.json"
+      }
+    ],
+    "search": [
+      {
+        "id": "ml_http_access_filebeat_ecs",
+        "file": "ml_http_access_filebeat_ecs.json"
+      }
+    ],
+    "visualization": [
+      {
+        "id": "ml_http_access_map_ecs",
+        "file": "ml_http_access_map_ecs.json"
+      },
+      {
+        "id": "ml_http_access_source_ip_timechart_ecs",
+        "file": "ml_http_access_source_ip_timechart_ecs.json"
+      },
+      {
+        "id": "ml_http_access_status_code_timechart_ecs",
+        "file": "ml_http_access_status_code_timechart_ecs.json"
+      },
+      {
+        "id": "ml_http_access_top_source_ips_table_ecs",
+        "file": "ml_http_access_top_source_ips_table_ecs.json"
+      },
+      {
+        "id": "ml_http_access_top_urls_table_ecs",
+        "file": "ml_http_access_top_urls_table_ecs.json"
+      },
+      {
+        "id": "ml_http_access_unique_count_url_timechart_ecs",
+        "file": "ml_http_access_unique_count_url_timechart_ecs.json"
+      },
+      {
+        "id": "ml_http_access_events_timechart_ecs",
+        "file": "ml_http_access_events_timechart_ecs.json"
+      }
+    ]
+  }
+}
diff --git a/...ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_low_request_rate_ecs.json b/...ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_low_request_rate_ecs.json
@@ -0,0 +1,34 @@
+{
+    "job_id": "JOB_ID",
+    "indexes": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "query": {
+      "bool": {
+        "filter": [
+          { "term":  { "event.dataset": "apache.access" } }
+        ]
+      }
+    },
+    "aggregations": {
+      "buckets": {
+        "date_histogram": {
+          "field": "@timestamp",
+          "interval": 900000,
+          "offset": 0,
+          "order": {
+            "_key": "asc"
+          },
+          "keyed": false,
+          "min_doc_count": 0
+        },
+        "aggregations": {
+          "@timestamp": {
+            "max": {
+              "field": "@timestamp"
+            }
+          }
+        }
+      }
+    }
+}
diff --git a/...ver/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_request_rate_ecs.json b/...ver/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_request_rate_ecs.json
@@ -0,0 +1,13 @@
+{
+    "job_id": "JOB_ID",
+    "indexes": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "query": {
+      "bool": {
+        "filter": [
+          { "term":  { "event.dataset": "apache.access" } }
+        ]
+      }
+    }
+}
diff --git a/...server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_url_count_ecs.json b/...server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_url_count_ecs.json
@@ -0,0 +1,13 @@
+{
+    "job_id": "JOB_ID",
+    "indexes": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "query": {
+      "bool": {
+        "filter": [
+          { "term":  { "event.dataset": "apache.access" } }
+        ]
+      }
+    }
+}
diff --git a/...ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_status_code_rate_ecs.json b/...ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_status_code_rate_ecs.json
@@ -0,0 +1,13 @@
+{
+    "job_id": "JOB_ID",
+    "indexes": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "query": {
+      "bool": {
+        "filter": [
+          { "term":  { "event.dataset": "apache.access" } }
+        ]
+      }
+    }
+}
diff --git a/...ins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_visitor_rate_ecs.json b/...ins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_visitor_rate_ecs.json
@@ -0,0 +1,39 @@
+{
+    "job_id": "JOB_ID",
+    "indexes": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "query": {
+      "bool": {
+        "filter": [
+          { "term":  { "event.dataset": "apache.access" } }
+        ]
+      }
+    },
+    "aggregations": {
+      "buckets": {
+        "date_histogram": {
+          "field": "@timestamp",
+          "interval": 900000,
+          "offset": 0,
+          "order": {
+            "_key": "asc"
+          },
+          "keyed": false,
+          "min_doc_count": 0
+        },
+        "aggregations": {
+          "@timestamp": {
+            "max": {
+              "field": "@timestamp"
+            }
+          },
+          "dc_source_address": {
+            "cardinality": {
+              "field": "source.address"
+            }
+          }
+        }
+      }
+    }
+}