Anomaly score is changed after few days

[minkiyo]

I am confusing that anomaly score is changed after few days in anomaly explore.
First of all, it seems that the anomaly itself is not a cross sign, so it is not a phenomenon for multi-bucket anomaly score.
If the anomaly score changes a few days after the detection point, there seems to be a big confusion during debugging.
I wonder if it is a simple bug or normal behavior due to the Elastic ml policy.
Our elastic stack version is 7.16.1.
Please explain why it has changed.

The applied ML job is as follows, and the same phenomenon occurs in all 2 ml jobs.

• advanced multi metric ml job - 2 detector (request, response time)
• single metric ml job (error)

<When checking on September 29 - the day of detection of anomalies>
advanced multi metric ml job - anomaly explore

advanced multi metric ml job - single metric view

advanced multi metric ml job - single metric view

single metric ml job - single metric view

<When checking on October 5>
advanced multi metric ml job - anomaly explore

advanced multi metric ml job - single metric view

advanced multi metric ml job - single metric view

single metric ml job - single metric view

[droberts195 (David Roberts)]

When a new anomaly has a much higher score than any anomaly in the past, the anomaly scores are adjusted on a range from 0 to 100 based on the new data. This is called renormalization. Renormalization happens for results from the last 30 days or 100 bucket spans (depending on which is the longer) by default.

So probably what has happened is that a new anomaly has been detected more recently than the period in the screenshots that is much bigger than any anomaly seen before.

Changing scores is a result of them being in the fixed range 0 to 100. The probabilities should never change. The idea is that a score in the range 0 to 100 is more user-friendly than a probability, but if you want to see a number that doesn't change for a particular anomaly then look at the probability.