# Anomaly score is changed after few days **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-machine-learning\ **Created:** [October 6, 2022, 8:12am UTC](https://discuss.elastic.co/t/anomaly-score-is-changed-after-few-days/315937 "2022-10-06T08:12:04Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![minkiyo](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Post date:** [October 6, 2022, 8:12am UTC](https://discuss.elastic.co/t/anomaly-score-is-changed-after-few-days/315937/1 "2022-10-06T08:12:04Z")
I am confusing that anomaly score is changed after few days in anomaly explore. First of all, it seems that the anomaly itself is not a cross sign, so it is not a phenomenon for multi-bucket anomaly score. If the anomaly score changes a few days after the detection point, there seems to be a big confusion during debugging. I wonder if it is a simple bug or normal behavior due to the Elastic ml policy. Our elastic stack version is 7.16.1. Please explain why it has changed. The applied ML job is as follows, and the same phenomenon occurs in all 2 ml jobs. - advanced multi metric ml job - 2 detector (request, response time) - single metric ml job (error) \ advanced multi metric ml job - anomaly explore ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c89313e3a8201960c20b662c86ef5968028abe7e.png) advanced multi metric ml job - single metric view ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04db4903af42dcabd52aff960c90940cea6c6125.png) advanced multi metric ml job - single metric view ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e2eb532b89585b28dc3af3156fa26292743295d5.png) single metric ml job - single metric view ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f610db3d83e89cf10691a39d6744b3c505104db2.png) \ advanced multi metric ml job - anomaly explore ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a0c5c714d4588301b2ce178aaed2da9c4b4707d.png) advanced multi metric ml job - single metric view ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/6/5682c99703ef738b99ae14d139388dfd82ca2c9b.png) advanced multi metric ml job - single metric view ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee67b253bc8a7b6eb150a7742ed1e0563503c22e.png) single metric ml job - single metric view ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/0/705cb406da8e3d35f0a90db5df3561222741ca32.png) ---
**Author:** ![droberts195](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/droberts195/32/17692_2.png) [@droberts195](https://discuss.elastic.co/u/droberts195)\ **Post date:** [October 6, 2022, 8:28am UTC](https://discuss.elastic.co/t/anomaly-score-is-changed-after-few-days/315937/2 "2022-10-06T08:28:58Z")
When a new anomaly has a much higher score than any anomaly in the past, the anomaly scores are adjusted on a range from 0 to 100 based on the new data. This is called renormalization. Renormalization happens for results from the last 30 days or 100 bucket spans (depending on which is the longer) by default. So probably what has happened is that a new anomaly has been detected more recently than the period in the screenshots that is much bigger than any anomaly seen before. Changing scores is a result of them being in the fixed range 0 to 100. The probabilities should never change. The idea is that a score in the range 0 to 100 is more user-friendly than a probability, but if you want to see a number that doesn't change for a particular anomaly then look at the probability. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 3, 2022, 8:29am UTC](https://discuss.elastic.co/t/anomaly-score-is-changed-after-few-days/315937/3 "2022-11-03T08:29:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.