# Alert when there is anomaly in machine learning?

**URL:** <https://discuss.elastic.co/t/alert-when-there-is-anomaly-in-machine-learning/92751>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [July 12, 2017, 4:21am UTC](https://discuss.elastic.co/t/alert-when-there-is-anomaly-in-machine-learning/92751 "2017-07-12T04:21:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![michaelcheung](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michaelcheung/32/53285_2.png) [@michaelcheung](https://discuss.elastic.co/u/michaelcheung)\
**Post date:** [July 12, 2017, 4:21am UTC](https://discuss.elastic.co/t/alert-when-there-is-anomaly-in-machine-learning/92751/1 "2017-07-12T04:21:38Z")

</div>

Using machine learning, I feed my system's cpu load data to a job continuously. I would like to know if there is combination usage with x-pack's watcher, alerting me when there is anomaly analyzed in machine learning.

I know I can use watcher setting threshold and check high cpu load. But I would consider having the critical anomaly detected in machine learning as the alerting trigger. Is there a way to do so?

Thanks,  
Michael

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [July 12, 2017, 5:37pm UTC](https://discuss.elastic.co/t/alert-when-there-is-anomaly-in-machine-learning/92751/2 "2017-07-12T17:37:56Z")

</div>

Hi Michael,

Check out the example ML-based Watches I created here:

[https://github.com/elastic/examples/tree/master/Alerting/ml\_examples](https://github.com/elastic/examples/tree/master/Alerting/ml_examples)

---

<div class="post-metadata">

**Author:** ![bohyun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bohyun/32/10087_2.png) [@bohyun](https://discuss.elastic.co/u/bohyun)\
**Post date:** [July 12, 2017, 7:25pm UTC](https://discuss.elastic.co/t/alert-when-there-is-anomaly-in-machine-learning/92751/3 "2017-07-12T19:25:27Z")

</div>

Hi @michaelcheung

In 5.5, we released the watch creation UI in the Machine Learning job workflow as shown below so that it's easier for you to get alerted when critical anomalies were detected. Once you choose the time interval to check against the data and severity threshold, and click apply, it will create a watch for you. You can go to the Watcher UI under Management tab so you can edit the watch further to configure watch actions. By default, there's a logging action.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f46d81afd9356e5eeb2ccbc6fabae9367154ad04.png)

Thanks,  
Bohyun

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [July 14, 2017, 4:32pm UTC](https://discuss.elastic.co/t/alert-when-there-is-anomaly-in-machine-learning/92751/4 "2017-07-14T16:32:47Z")

</div>

And, in v5.5, if your X-Pack Alerting setup has [email enabled](https://www.elastic.co/guide/en/x-pack/current/actions-email.html#configuring-email), then there will also be a Send email option:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fe8e8dd6f5670b5a354b36a590a0a241c68b7746.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2017, 4:33pm UTC](https://discuss.elastic.co/t/alert-when-there-is-anomaly-in-machine-learning/92751/5 "2017-08-11T16:33:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.