# \[Jobs\] Add threshold information to calculate anomlay score

**URL:** <https://discuss.elastic.co/t/jobs-add-threshold-information-to-calculate-anomlay-score/130288>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 2, 2018, 3:33pm UTC](https://discuss.elastic.co/t/jobs-add-threshold-information-to-calculate-anomlay-score/130288 "2018-05-02T15:33:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yazid](https://avatars.discourse-cdn.com/v4/letter/y/bb73d2/32.png) [@yazid](https://discuss.elastic.co/u/yazid)\
**Post date:** [May 2, 2018, 3:33pm UTC](https://discuss.elastic.co/t/jobs-add-threshold-information-to-calculate-anomlay-score/130288/1 "2018-05-02T15:33:20Z")

</div>

Hello

Do you know if I can add a threshold information to calculate anomaly score?  
Example:  
I'm analysing a metric with values between 1 to 450. Generaly values are between 435-450. But actually all values higher than 400 must be considered "normal". So I need to add this information to the job .  
How can I do this please?

Thanks for your help.

Yazid

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 3, 2018, 8:12pm UTC](https://discuss.elastic.co/t/jobs-add-threshold-information-to-calculate-anomlay-score/130288/2 "2018-05-03T20:12:15Z")

</div>

Hello Yazid,

The ML jobs currently don't allow threshold logic on top of the existing anomaly detection. If you need this now you have a few choices:

1. Filter the input data by customizing the query that the ML datafeed uses. In other words, exclude data between 400-450.
2. Post-process the anomalies (i.e. with Watcher/Alerting) and exclude any anomalies that have an actual value between 400-450.

Or, do you need to use ML at all for this use case? Just use a static threshold for anything below 400?

---

<div class="post-metadata">

**Author:** ![yazid](https://avatars.discourse-cdn.com/v4/letter/y/bb73d2/32.png) [@yazid](https://discuss.elastic.co/u/yazid)\
**Post date:** [May 4, 2018, 9:30am UTC](https://discuss.elastic.co/t/jobs-add-threshold-information-to-calculate-anomlay-score/130288/3 "2018-05-04T09:30:43Z")

</div>

Hello Rich

Thanks for your clear answer.

Maybe 2nd option will be OK for me.

And yes I need ML for this use case, because my question was simple (intentionally) but in practice it is a bit more complicated 🙂 . I just needed to understand how it works.

Thanks again.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 30, 2018, 10:21pm UTC](https://discuss.elastic.co/t/jobs-add-threshold-information-to-calculate-anomlay-score/130288/4 "2018-10-30T22:21:33Z")

</div>