rforest

Uses a random forest model (an ensemble method that randomly trains multiple decision trees) to predict classification values for input data.

Command properties

Syntax

To predict using a pre-trained model:

To train on data from a subquery and then predict:

In the syntax above, scorer is available starting with 4.0.2609.0.

Options

model=STR

Name of the random forest model. Machine learning models can be created and trained through the Logpresso Sonar web console or shell.

target=STR

Target field name. Specifies the field to use as the prediction target in random forest classification.

timeout=INT{s|m|h|d}

Subquery execution time limit. If the subquery does not complete within the specified time, it is cancelled.

scorer=INT

Assigns the top N fields that most influenced the prediction to the _scorer output field. If omitted, the _scorer field is not output. Applies to both predictions that use the model option and subquery-based training predictions. Available starting with 4.0.2609.0.

Target

FIELD, ...

List of feature fields to use for random forest analysis, separated by commas (,). Field values can be numbers, dates, IP addresses, or strings. String values are internally encoded for processing.

[ SUBQUERY ]

Subquery that retrieves training data. The random forest model is built using the subquery results, then predictions are made for input records.

Output fields

Error codes

Parse errors

Runtime errors

N/A

Description

The rforest command uses the random forest algorithm to predict the target field value for input records. Random forest is an ensemble learning method that randomly constructs multiple decision trees and combines each tree's prediction to produce the final classification.

Two modes are available:

• Pre-trained model: Specify a pre-trained model with the model option. Input records are passed directly to the model and prediction results are assigned to the _guess field.
• Subquery training: Specify the target option and a subquery. The random forest model is first trained on the subquery results, then predictions are made for input records.

The number of decision trees in the forest is fixed at 100 and cannot be changed from a query.

Feature field values of null are treated as missing values. String values are internally encoded as integers for training and prediction.

When you specify the scorer option, the command also outputs the top N fields among those used for prediction that most influenced the result, as an array in the _scorer field using [[field, count], ...] format. The count is the number of times the field was used in a decision tree split; only fields with a count greater than 0 are included, so the array can be shorter than N.

In a distributed environment, model training and prediction are performed on the Control Node.

Examples

1. Predicting with a pre-trained model

   table duration=1d test_data
   | rforest model=rforest_titanic
   

   Uses the pre-trained rforest_titanic model to predict classification values for input data.

2. Training with a subquery and analyzing top contributing fields (4.0 series, 4.0.2609.0 and later)

   csvfile /opt/logpresso/titanic_test.csv
   | rforest scorer=2 target=Survived Pclass, Sex, Age, Fare, Embarked [
       csvfile /opt/logpresso/titanic_train.csv
       | eval Age = double(Age), Fare = double(Fare)
     ]
   

   Trains the model on data from titanic_train.csv and predicts the Survived field value for data in titanic_test.csv, while using scorer=2 to assign the top 2 fields that most influenced each prediction to the _scorer field.

3. Training and predicting with a subquery

   csvfile /opt/logpresso/titanic_test.csv
   | rforest target=Survived Pclass, Sex, Age, Fare, Embarked [
       csvfile /opt/logpresso/titanic_train.csv
       | eval Age = double(Age), Fare = double(Fare)
     ]
   

   Trains the model on data from titanic_train.csv and predicts the Survived field value for data in titanic_test.csv.

4. Training with a subquery using a timeout

   table duration=1d test_data
   | rforest timeout=30s target=category feature1, feature2, feature3 [
       table duration=30d training_data
     ]
   

   Limits the subquery execution time to 30 seconds to retrieve training data and predicts the category field value.

5. Analyzing top contributing fields with a pre-trained model (4.0 series, 4.0.2609.0 and later)

   table duration=1d test_data
   | rforest scorer=2 model=rforest_titanic
   

   Uses the pre-trained rforest_titanic model to predict, and uses scorer=2 to assign the top 2 fields that most influenced each prediction to the _scorer field.

Change history