# Kibana 6 ML **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-machine-learning\ **Created:** [December 19, 2017, 3:09pm UTC](https://discuss.elastic.co/t/kibana-6-ml/112458 "2017-12-19T15:09:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Kornelia\_Watson](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@Kornelia\_Watson](https://discuss.elastic.co/u/Kornelia_Watson)\ **Post date:** [December 19, 2017, 3:09pm UTC](https://discuss.elastic.co/t/kibana-6-ml/112458/1 "2017-12-19T15:09:31Z")
Hi, We have just upgraded to Kibana 6 and I wanted to try out ML plugin. It would be ideal for me if I could export anomalies found to a csv file. Is this possible? Also, is it possible to trigger ML job and return its results via script? My use case: We use a ruby script to transform and index information about orders. We wanted to use ML plugin to detect anomaly orders and to marked them as such. ---
**Author:** ![dmitri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmitri/32/17997_2.png) [@dmitri](https://discuss.elastic.co/u/dmitri)\ **Post date:** [December 19, 2017, 3:50pm UTC](https://discuss.elastic.co/t/kibana-6-ml/112458/2 "2017-12-19T15:50:15Z")
Hi, 1. ML writes anomalies in elasticsearch as JSON. There is no built-in functionality to convert them to CSV but you could probably write or use something that converts JSON to CSV. The APIs for retrieving the anomaly results are documented [here](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/ml-apis.html#ml-api-result-endpoint). 2. Yes, everything ML does can be also used programmatically via its REST API. You can find details in the [docs](https://www.elastic.co/guide/en/x-pack/6.0/xpack-ml.html) and the [API reference](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/ml-apis.html). I hope this helps. Happy anomaly hunting! ---
**Author:** ![Kornelia\_Watson](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@Kornelia\_Watson](https://discuss.elastic.co/u/Kornelia_Watson)\ **Post date:** [December 19, 2017, 11:04pm UTC](https://discuss.elastic.co/t/kibana-6-ml/112458/3 "2017-12-19T23:04:15Z")
Hi, Thanks for the reply. I have a follow up question... When I do GET on Records resource I can't see an ID of a document that was classified as anomaly. Is retrieval of that information possible? ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [December 20, 2017, 7:28pm UTC](https://discuss.elastic.co/t/kibana-6-ml/112458/4 "2017-12-20T19:28:20Z")
Hello Kornelia, In our ML, data is analyzed in time buckets (of width equal to `bucket_span`). When looking at the results, they are also presented in the context of a time bucket. Depending on the specific configuration of the job that you've created, the anomaly records that you'll see will have information about what was unusual (and by how much). It won't show you the particular elasticsearch document that was the culprit, because it may not be just one - it could be many documents within that `bucket_span`. If you desire to view the raw data that is relevant during that window of time, you can use the ["custom URL" functionality](https://www.elastic.co/guide/en/x-pack/6.1/ml-configuring-url.html) to specify a destination (such as the discover tab of Kibana) where you can view the raw data during the time of the anomaly (and optionally filtered by the specific "influencer" that ML may have identified). For additional information, the following blog may be of interest: > **[Machine Learning Anomaly Scoring and Elasticsearch - How it Works | Elastic](https://www.elastic.co/blog/machine-learning-anomaly-scoring-elasticsearch-how-it-works)** > > We often get questions about Elastic’s Machine Learning “anomaly score” and how the various scores presented in the dashboards relate to the “unusualness” of individual occurrences within the da... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 17, 2018, 7:28pm UTC](https://discuss.elastic.co/t/kibana-6-ml/112458/5 "2018-01-17T19:28:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.