# Custom rules parameter

**URL:** <https://discuss.elastic.co/t/custom-rules-parameter/383337>\
**Category:** Kibana\
**Created:** [November 10, 2025, 3:24pm UTC](https://discuss.elastic.co/t/custom-rules-parameter/383337 "2025-11-10T15:24:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Le\_Philosophe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/le_philosophe/32/144664_2.png) [@Le\_Philosophe](https://discuss.elastic.co/u/Le_Philosophe)\
**Post date:** [November 10, 2025, 3:24pm UTC](https://discuss.elastic.co/t/custom-rules-parameter/383337/1 "2025-11-10T15:24:42Z")

</div>

Hello,

I have some data i collected and visualizing in Kibana.Now I have defined a ML job to monitor high/low filerate but I want the ML analysis to stop outside the range the data is collected(eg: 7 to 9pm data are not collected everyday). What I want to know is can I use “time“ as value to the parameter applies\_to like

```auto
"custom_rules": [
      {
        "actions": ["skip_result", "skip_model_update"],
        "conditions": [
          {
            "applies_to": "time",
            "operator": "lt",
            "value": 7
          },
          {
            "applies_to": "time",
            "operator": "gte",
            "value": 12
          }
        ]
      }
    ]

```

I have a doubt and I would like to know if it’s correct or how I exclude this range for the model.

Thanks.

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [November 11, 2025, 7:54am UTC](https://discuss.elastic.co/t/custom-rules-parameter/383337/2 "2025-11-11T07:54:36Z")

</div>

Hello @Le_Philosophe

As per the documentation it should work :

> **[Update anomaly detection jobs API](https://www.elastic.org.cn/docs/8.1/www.elastic.co/guide/en/elasticsearch/reference/current/ml-update-job.html)**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00dd8726e3ae65cbeb00ce9fd83c6d64f70529d5.png)

Thanks!!

---

<div class="post-metadata">

**Author:** ![Le\_Philosophe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/le_philosophe/32/144664_2.png) [@Le\_Philosophe](https://discuss.elastic.co/u/Le_Philosophe)\
**Post date:** [November 11, 2025, 9:52am UTC](https://discuss.elastic.co/t/custom-rules-parameter/383337/3 "2025-11-11T09:52:33Z")

</div>

Okay,

Can I have multiple scope associated with their conditions and actions like i use a filter to target a feed type and for each feed if they are not in their range the result is not compute for those splits models (I use feed\_id as split field when creating my job)

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [November 11, 2025, 10:03pm UTC](https://discuss.elastic.co/t/custom-rules-parameter/383337/4 "2025-11-11T22:03:08Z")

</div>

I’d filter out the data using a filter in the datafeed itself (such that none of the data is even sent to the ML algorithms)

Other option is to use [Calendar Events](https://www.elastic.co/docs/explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs#ml-ad-calendars)

---

<div class="post-metadata">

**Author:** ![Le\_Philosophe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/le_philosophe/32/144664_2.png) [@Le\_Philosophe](https://discuss.elastic.co/u/Le_Philosophe)\
**Post date:** [November 22, 2025, 5:08pm UTC](https://discuss.elastic.co/t/custom-rules-parameter/383337/5 "2025-11-22T17:08:25Z")

</div>

Like having multiple jobs for each feed?

for the the “time“ value for “applies\_to” variable it’s the time the bucket start or else?