# Elasticsearch watcher to send Prediction data
**URL:** https://discuss.elastic.co/t/elasticsearch-watcher-to-send-prediction-data/154004
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [October 25, 2018, 12:55pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-to-send-prediction-data/154004 "2018-10-25T12:55:43Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Kathir\_J](https://discuss.elastic.co/u/Kathir_J)
#### Post date: [October 25, 2018, 12:55pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-to-send-prediction-data/154004/1 "2018-10-25T12:55:44Z")
Elasticsearch watcher to send prediction data.
In this above screenshot, I have the prediction value as 32192.
So, is it possible to alert the user (by using watcher) with the prediction value?
My watcher configuration is,
```
{
"range": {
"anomaly_score": {
"gte": "30"
}
}
}
```
1. Is it possible to include prediction value inside range?
2. Is it possible to include prediction value in slack text?
"text": "Machine Learning Results - Object cache size is going to exceed threshold limit.\n Anomalies:\n{{#ctx.payload.hits.hits}}score={{\_source.anomaly\_score}} at time={{\_source.timestamp}}\n{{/ctx.payload.hits.hits}}"
If so, could you please let me know the syntax?
Thanks in advance.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 25, 2018, 1:04pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-to-send-prediction-data/154004/2 "2018-10-25T13:04:52Z")
Hey,
I am not sure what you are referring to with the first question. Something you could do is to put the anomaly score in the watch metadata like
```auto
"metadata" : { "score" : "30" }
```
and then do this in your query
```auto
"range": { "anomaly_score": { "gte": "{{ctx.metadata.score}}" } }
```
and also refer to this in the slack message via `{{ctx.metadata.score}}`.
Your second assumption is correct, that this will return all the anomaly scors of the hits being returned.
Hope this helps!
--Alex
---
### Author:  [@Kathir\_J](https://discuss.elastic.co/u/Kathir_J)
#### Post date: [October 25, 2018, 1:26pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-to-send-prediction-data/154004/3 "2018-10-25T13:26:51Z")
Alright. Thanks for that. It clarifies my few other questions. 🙂
My use case,
In the screenshot I provided, When prediction value goes beyond 32000, I want to alert users along with the prediction value and prediction date in the alert text.
In watcher, I configured the alert text as
"text": "Machine Learning Results - Object cache size is going to exceed threshold limit.\n Anomalies:\n{{#ctx.payload.hits.hits}}score={{\_source.anomaly\_score}} at time={{\_source.timestamp}}\n{{/ctx.payload.hits.hits}}"
Alert should look something like,
As per prediction, Object cache size is going to be at \ on \.
How do I include both \ and \data in alert text.
Is there anything like {{ctx.payload.hits.hits.0.prediction}}?
---
### Author:  [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [October 26, 2018, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-to-send-prediction-data/154004/4 "2018-10-26T16:08:24Z")
For forecasts, you do NOT want to use `anomaly_score` as the thing you're reporting on. Instead, use `forecast_prediction `. Please reference this other thread:
> [@Export forecast data](https://discuss.elastic.co/t/export-forecast-data/124875/2):
>
> Hi Oscar, all forecast results are written back to the result index of the job, that is default the shared index: .ml-anomalies-shared but you can also use a dedicated index. Therefore you can access all results via search, e.g. GET .ml-anomalies-shared/\_search { "query": { "bool": { "filter": [ { "query\_string": { "query": "result\_type:model\_forecast" } }, { "query\_string": { "query": "job\_id:n1" …
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 23, 2018, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-watcher-to-send-prediction-data/154004/5 "2018-11-23T16:08:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.