Kibana Anomaly Alerts by PartitionField

Elastic Stack Kibana
,
1

I currently have a working anomaly detection job for which i have configured my detector as: high_count over Supervisor.routine.name partitionfield=Supervisor.resource.type

For my alerts, I'd like to get an alert for the highest anomaly for each partitioned resource.type. However, i only get alerts on the anomaly with the highest score across all resource.types

For other non-anomaly-detection related alerts, I've used the group-by field to get a similar result. When setting up the partitionField for anomaly-alert, I assumed it would be same or similar.

Is there a way to get the highest anomaly detected per partitionField ?

2

Did you create an alert of type "Record", "Bucket", or "Influencer"?

image
image1280×1290 92.3 KB

3

Yes. I've tried all of them. But my preference is to stick with type "Record"

4

You could create an ES|QL based Rule/Alert where you can find the max record_score per partition:

image
image1352×2580 283 KB