How create watcher for ML anomalies detected

[kurdit (Aleksandr)]

hi! where can I find documentation on creating and configuring watchdogs for machine learning jobs?

[richcollier]

You can start here: https://www.elastic.co/blog/alerting-on-machine-learning-jobs-in-elasticsearch-v55

It is a little dated, but still relevant. Post any follow-up questions you may have here.

[kurdit (Aleksandr)]

thank you for you reply

I have ELС 7.10 and for some reason I do not have a section "Create watch for real-time job" when creating machine learning jobs

[richcollier]

The job has to be running in "real-time" to enable the creation of a Watch. For example, here is v7.10 Single metric job wizard right after creating a job:

The Create Watch button is disabled because the job is not running in "real-time". If I click the button to start the job, the Create Watch button becomes enabled:

and then I can create the Watch. If you "miss the opportunity" to do this during the setup wizard - don't worry. From the job management screen, when you start any datafeeds for jobs that are currently not running, you can select the job to run in real-time and then there is a checkbox to create a watch from there as well.

And, as the blog mentions, you can also create a watch independently from the ML UI

[kurdit (Aleksandr)]

Thank you! I found this!

Now the question is: do watchers send notifications only by email? is it possible to set up a webhook there?

[richcollier]

You need to manually edit the Watcher JSON configuration. See:

Watcher webhook action | Elasticsearch Reference [7.10] | Elastic