# Email alerts from machine learning, bucket and record anomalies

**URL:** <https://discuss.elastic.co/t/email-alerts-from-machine-learning-bucket-and-record-anomalies/231588>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning, elastic-stack-alerting\
**Created:** [May 7, 2020, 4:46pm UTC](https://discuss.elastic.co/t/email-alerts-from-machine-learning-bucket-and-record-anomalies/231588 "2020-05-07T16:46:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [May 7, 2020, 4:46pm UTC](https://discuss.elastic.co/t/email-alerts-from-machine-learning-bucket-and-record-anomalies/231588/1 "2020-05-07T16:46:25Z")

</div>

Hi, I have created a mail watch alert for machine learning and choose the lower Severity threshold for it  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b8f224464edc9489cb7e48c43a3cc6459d0f193b.png)

In the execution history of the watch I have several entries, but I dont get email alerts

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/4/84b1840cc25b1b8b997c14310da14a1a10b7e4c3.png)

I enter in the edit section of the watch an in the bucker\_results the value of anomaly\_score was 75, even when I choose the lower severity threshold as stated earlier, I have change the value to 3 and now I get alert mail

```auto
          "aggs": {
            "bucket_results": {
              "filter": {
                "range": {
                  "anomaly_score": {
                    "gte": 3
                  }
                }
              },

```

Questions:

¿the severity threshold chosed on the UI when creating the watch, doesn modify the anomaly score of bucket result, it will always will be greater than 75?

¿ only the bucket anomalies will trigger email alert, not the record anomalies?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 8, 2020, 11:40am UTC](https://discuss.elastic.co/t/email-alerts-from-machine-learning-bucket-and-record-anomalies/231588/2 "2020-05-08T11:40:50Z")

</div>

The UI which helps you create the Watch should obviously set the range correctly. If it doesn't, perhaps there is a bug in the version you are using (what version are you using?)

And yes, the default Watch that is created is only using bucket-level scoring (so the highest level of aggregated scores for the job). If you want record-level scoring, you have to create your own watch.

First consult: [https://www.elastic.co/blog/machine-learning-anomaly-scoring-elasticsearch-how-it-works](https://www.elastic.co/blog/machine-learning-anomaly-scoring-elasticsearch-how-it-works) to understand the scoring completely and you can also reference a record-level watch example here: [https://gist.github.com/richcollier/1c2b8161286bdca6c553859f28d3d66d](https://gist.github.com/richcollier/1c2b8161286bdca6c553859f28d3d66d)

---

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [May 8, 2020, 8:15pm UTC](https://discuss.elastic.co/t/email-alerts-from-machine-learning-bucket-and-record-anomalies/231588/3 "2020-05-08T20:15:45Z")

</div>

Thanks Richcollier, the version is 7.5.1 on docker, in the severity threshold I choose warning and critical an both give this values, so maybe its a bug.....or maybe im looking in the wrong part of the json, this values are in the input

```auto
       "aggs": {
            "bucket_results": {
              "filter": {
                "range": {
                  "anomaly_score": {
                    "gte": 75
                  }
-------------
            "influencer_results": {
              "filter": {
                "range": {
                  "influencer_score": {
                    "gte": 3
                  }
-------------
            "record_results": {
              "filter": {
                "range": {
                  "record_score": {
                    "gte": 3
                  }
                }

```

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 10, 2020, 5:35pm UTC](https://discuss.elastic.co/t/email-alerts-from-machine-learning-bucket-and-record-anomalies/231588/4 "2020-05-10T17:35:20Z")

</div>

Hey - Looks like there indeed was a bug there that's solved in v7.7 with the following PR: [https://github.com/elastic/kibana/pull/58597](https://github.com/elastic/kibana/pull/58597)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2020, 5:35pm UTC](https://discuss.elastic.co/t/email-alerts-from-machine-learning-bucket-and-record-anomalies/231588/5 "2020-06-07T17:35:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.