# How to create anomaly alert of Machine Learning in Kibana?

**URL:** <https://discuss.elastic.co/t/how-to-create-anomaly-alert-of-machine-learning-in-kibana/160078>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [December 10, 2018, 2:08am UTC](https://discuss.elastic.co/t/how-to-create-anomaly-alert-of-machine-learning-in-kibana/160078 "2018-12-10T02:08:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fr0der1c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fr0der1c/32/34125_2.png) [@fr0der1c](https://discuss.elastic.co/u/fr0der1c)\
**Post date:** [December 10, 2018, 2:08am UTC](https://discuss.elastic.co/t/how-to-create-anomaly-alert-of-machine-learning-in-kibana/160078/1 "2018-12-10T02:08:25Z")

</div>

I want to get a Slack notification when there is an anomaly in our APM data. I found this: [Alert when there is anomaly in machine learning?](https://discuss.elastic.co/t/alert-when-there-is-anomaly-in-machine-learning/92751/3?u=fr0der1c) but this is Kibana 5.5. I'm using ELK stack 6.5.0, and I didn't see this option.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 10, 2018, 1:44pm UTC](https://discuss.elastic.co/t/how-to-create-anomaly-alert-of-machine-learning-in-kibana/160078/2 "2018-12-10T13:44:01Z")

</div>

There is currently no way to specify that an alert/watch action is to invoke a Slack notification if you build the alert in using the ML UI. However, if you create such an alert, and then modify the alert in the Watcher UI, you can modify the Watcher JSON (specifically, the `action` section) to use a Slack notification instead.

See the Alerting/Watcher docs for more information:

[https://www.elastic.co/guide/en/elastic-stack-overview/current/actions-slack.html](https://www.elastic.co/guide/en/elastic-stack-overview/current/actions-slack.html)

---

<div class="post-metadata">

**Author:** ![fr0der1c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fr0der1c/32/34125_2.png) [@fr0der1c](https://discuss.elastic.co/u/fr0der1c)\
**Post date:** [December 11, 2018, 7:41am UTC](https://discuss.elastic.co/t/how-to-create-anomaly-alert-of-machine-learning-in-kibana/160078/3 "2018-12-11T07:41:33Z")

</div>

Thanks for the response.

> [@richcollier](#):
>
> if you create such an alert, and then modify the alert

How can I create alerts for ML in Watcher UI? Do I have to create from scratch? Does "create watch for real-time job" still available in 6.5.0?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 11, 2018, 2:59pm UTC](https://discuss.elastic.co/t/how-to-create-anomaly-alert-of-machine-learning-in-kibana/160078/4 "2018-12-11T14:59:33Z")

</div>

Good info here: [https://www.elastic.co/blog/alerting-on-machine-learning-jobs-in-elasticsearch-v55](https://www.elastic.co/blog/alerting-on-machine-learning-jobs-in-elasticsearch-v55)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2019, 2:59pm UTC](https://discuss.elastic.co/t/how-to-create-anomaly-alert-of-machine-learning-in-kibana/160078/5 "2019-01-08T14:59:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.