# Anomaly Detection: Stop alerting on one of the Partitioned value

**URL:** <https://discuss.elastic.co/t/anomaly-detection-stop-alerting-on-one-of-the-partitioned-value/241036>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning, elastic-stack-alerting\
**Created:** [July 13, 2020, 10:43pm UTC](https://discuss.elastic.co/t/anomaly-detection-stop-alerting-on-one-of-the-partitioned-value/241036 "2020-07-13T22:43:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexisdrnt](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@alexisdrnt](https://discuss.elastic.co/u/alexisdrnt)\
**Post date:** [July 13, 2020, 10:43pm UTC](https://discuss.elastic.co/t/anomaly-detection-stop-alerting-on-one-of-the-partitioned-value/241036/1 "2020-07-13T22:43:06Z")

</div>

Hey,

I'm running a machine learning job using a partition key.  
I want to stop alerting on one of the partition key, or even better if I could remove all the data for this particular partition value and not alert anymore.  
The only way I found is to add a filter. Is there a cleaner way to do that?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [July 14, 2020, 12:38pm UTC](https://discuss.elastic.co/t/anomaly-detection-stop-alerting-on-one-of-the-partitioned-value/241036/2 "2020-07-14T12:38:39Z")

</div>

There is the possibility of a filter on the data feed query - if that's what you mean.

But, also, if you want to stop the creation of anomalies for a particular entity, you can use Custom Rules (specifically, [Filters](https://www.elastic.co/guide/en/machine-learning/current/ml-configuring-detector-custom-rules.html)) to have ML ignore those entities.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c9a2e233a68c9d739178b11fd2d5362eed1b2200.png)

If you want to continue to flag anomalies, but not alert, then obviously that is a different task that would be relegated to building that logic into the Watch. Essentially you would have to maintain a separate "lookup table" index of entity names that you want to exclude from alerting and Watcher would have to compare entities with anomalies against this "allowed to alert" lookup table.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [July 14, 2020, 12:41pm UTC](https://discuss.elastic.co/t/anomaly-detection-stop-alerting-on-one-of-the-partitioned-value/241036/3 "2020-07-14T12:41:46Z")

</div>

Also, as [Kibana Alerting](https://www.elastic.co/guide/en/kibana/current/alerting-getting-started.html) matures and ML eventually moves from using Watcher to Kibana Alerting, there will also be the ability to mute the alerting for a specific entity within a set.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2020, 12:41pm UTC](https://discuss.elastic.co/t/anomaly-detection-stop-alerting-on-one-of-the-partitioned-value/241036/4 "2020-08-11T12:41:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.