# Anomaly Detection Rule Won't Send Email

**URL:** <https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244>\
**Category:** Elasticsearch\
**Created:** [July 12, 2023, 3:58pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244 "2023-07-12T15:58:49Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://discuss.elastic.co/u/McJava1967)\
**Post date:** [July 12, 2023, 3:58pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244/1 "2023-07-12T15:58:49Z")

</div>

Hi all. I'm evaluating Anomaly alerting using a locally hosted Platinum trial. In short, the anomaly detection Job itself is working. I can see anomalies in the results. And I have set up a Rule with a Connector. I can press the "Try" button on that Connector and send myself an email.

But when I feed data into the associated Job, then run the Rule, I never get an email. I have tried adjusting the Rule so it should email me for a simple Warning, or even on any activity at all. Still no luck. The logs indicate the Job ran.

Could anybody help? Below are associated screen shots.

Job Result:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bdbfb59a95710bf57e59f0e41470576c49f63a6f.png)

---

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://discuss.elastic.co/u/McJava1967)\
**Post date:** [July 12, 2023, 4:02pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244/2 "2023-07-12T16:02:55Z")

</div>

Rule (part 1)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6a10896b616afc7165666ef6755c17a9f0c6f7c9.png)

---

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://discuss.elastic.co/u/McJava1967)\
**Post date:** [July 12, 2023, 4:06pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244/3 "2023-07-12T16:06:05Z")

</div>

Rule (Connector part)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8ceb4a29424729fb6d4458f9d0ae57f908f41147.png)

---

<div class="post-metadata">

**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\
**Post date:** [July 12, 2023, 11:15pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244/4 "2023-07-12T23:15:20Z")

</div>

There are 2 warnings on the job that both sound relevant: mostly starting the datafeed but also adjusting the lookback and notification windows (if you check every 1h but only look back 32min, you will miss the first 28min of the hour in your alerts.

---

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://discuss.elastic.co/u/McJava1967)\
**Post date:** [July 13, 2023, 1:58pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244/5 "2023-07-13T13:58:25Z")

</div>

Thank you, xeraa! I fixed those warnings, but I'm afraid the Rule still never generates an Alert, or sends me an email. (BTW, like you've probably guessed, I'm a newbie at Machine Learning.)

The Edit Rule now shows no more warning, with severity set to 0.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c8c9126a9b82cbf944f5a7c92adc812453a50d5b.png)

---

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://discuss.elastic.co/u/McJava1967)\
**Post date:** [July 13, 2023, 1:59pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244/6 "2023-07-13T13:59:44Z")

</div>

And when I set interval to one day, and hit Test, it finds two anamolies:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b1b148598a5363c074e06b78b85daa0f6c90e5cb.png)

---

<div class="post-metadata">

**Author:** ![McJava1967](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@McJava1967](https://discuss.elastic.co/u/McJava1967)\
**Post date:** [July 13, 2023, 2:02pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244/7 "2023-07-13T14:02:45Z")

</div>

But when the associated Rule runs, it always reports zero alerts:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/7/87bf6724dabc49543fcebc9d1b8c43e5ae7781c0.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2023, 2:03pm UTC](https://discuss.elastic.co/t/anomaly-detection-rule-wont-send-email/338244/8 "2023-08-10T14:03:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
