Anomaly Detection Rule Won't Send Email

Elastic Stack Elasticsearch
1

Hi all. I'm evaluating Anomaly alerting using a locally hosted Platinum trial. In short, the anomaly detection Job itself is working. I can see anomalies in the results. And I have set up a Rule with a Connector. I can press the "Try" button on that Connector and send myself an email.

But when I feed data into the associated Job, then run the Rule, I never get an email. I have tried adjusting the Rule so it should email me for a simple Warning, or even on any activity at all. Still no luck. The logs indicate the Job ran.

Could anybody help? Below are associated screen shots.

Job Result:

image
image950×639 46.3 KB

2

Rule (part 1)

image
image613×765 45.8 KB

3

Rule (Connector part)

image
image584×764 33.6 KB

4

There are 2 warnings on the job that both sound relevant: mostly starting the datafeed but also adjusting the lookback and notification windows (if you check every 1h but only look back 32min, you will miss the first 28min of the hour in your alerts.

5

Thank you, xeraa! I fixed those warnings, but I'm afraid the Rule still never generates an Alert, or sends me an email. (BTW, like you've probably guessed, I'm a newbie at Machine Learning.)

The Edit Rule now shows no more warning, with severity set to 0.

image
image600×765 35 KB

6

And when I set interval to one day, and hit Test, it finds two anamolies:

image
image596×751 38.7 KB

7

But when the associated Rule runs, it always reports zero alerts:

image
image1646×824 81.5 KB

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.