# How to index anomalous documents in another index?

**URL:** <https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [January 26, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458 "2022-01-26T13:58:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ilia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ilia/32/60042_2.png) [@Ilia](https://discuss.elastic.co/u/Ilia)\
**Post date:** [January 26, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458/1 "2022-01-26T13:58:47Z")

</div>

It is my first time working with Elasticsearch anomaly detection. I've read the concepts and create a sample index to test it. I've also created these `job` and `datafeed` by using kibana for the sample index:

```auto
{
  "job_id": "account",
  "description": "",
  "groups": [],
  "analysis_config": {
    "bucket_span": "1m",
    "detectors": [
      {
        "function": "high_mean",
        "field_name": "credit"
      }
    ],
    "influencers": [],
    "summary_count_field_name": "doc_count"
  },
  "data_description": {
    "time_field": "@timestamp"
  },
  "custom_settings": {
    "created_by": "single-metric-wizard"
  },
  "analysis_limits": {
    "model_memory_limit": "11MB"
  },
  "model_plot_config": {
    "enabled": true,
    "annotations_enabled": true
  }
}

```

```auto
{
  "datafeed_id": "datafeed-account",
  "job_id": "account",
  "indices": [
    "account"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        }
      ]
    }
  },
  "runtime_mappings": {},
  "aggregations": {
    "buckets": {
      "date_histogram": {
        "field": "timeStamp",
        "interval": "6000ms"
      },
      "aggregations": {
        "credit": {
          "avg": {
            "field": "credit"
          }
        },
        "@timestamp": {
          "max": {
            "field": "timeStamp"
          }
        }
      }
    }
  }
}

```

I need to index the anomalous documents in another index, so it must be possible to define something like `action` concept (e.g. alert, index, ...) in the job but I don't know how to define it.  
How can I index the anomalous events in another index?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [January 26, 2022, 6:48pm UTC](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458/2 "2022-01-26T18:48:37Z")

</div>

Anomaly Detection jobs create results into a new index already (and are named `.ml-anomalies-*`). Using the Machine Learning UI in Kibana will read the results from these indices and show them to you but obviously, you're also able to manually query those indices for other purposes (alerting, etc.)

If you want to learn the basics of Elastic ML, download an e-copy of this book:  
[https://events.elastic.co/machinelearningwithelastic](https://events.elastic.co/machinelearningwithelastic)

and/or watch the webinar: [“Machine Learning with the Elastic Stack” book preview - Part 1: Anomaly Detection | Elastic Videos](https://www.elastic.co/virtual-events/machine-learning-book-preview-part-1-anomaly-detection)

---

<div class="post-metadata">

**Author:** ![Ilia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ilia/32/60042_2.png) [@Ilia](https://discuss.elastic.co/u/Ilia)\
**Post date:** [January 30, 2022, 10:11am UTC](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458/3 "2022-01-30T10:11:42Z")

</div>

Thank you Rich,  
It's also looks like possible to send results to [dedicated indices](https://www.elastic.co/guide/en/machine-learning/current/create-jobs.html#dedicated-indices).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458/4 "2022-02-27T10:12:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.