# Kibana Anomaly Alerts by PartitionField

**URL:** <https://discuss.elastic.co/t/kibana-anomaly-alerts-by-partitionfield/373133>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning, elastic-stack-alerting\
**Created:** [January 13, 2025, 2:54pm UTC](https://discuss.elastic.co/t/kibana-anomaly-alerts-by-partitionfield/373133 "2025-01-13T14:54:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jlrivera81](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jlrivera81/32/138213_2.png) [@jlrivera81](https://discuss.elastic.co/u/jlrivera81)\
**Post date:** [January 13, 2025, 2:54pm UTC](https://discuss.elastic.co/t/kibana-anomaly-alerts-by-partitionfield/373133/1 "2025-01-13T14:54:55Z")

</div>

I currently have a working anomaly detection job for which i have configured my detector as: high\_count over Supervisor.routine.name partitionfield=Supervisor.resource.type

For my alerts, I'd like to get an alert for the highest anomaly for each partitioned resource.type. However, i only get alerts on the anomaly with the highest score across all resource.types

For other non-anomaly-detection related alerts, I've used the group-by field to get a similar result. When setting up the partitionField for anomaly-alert, I assumed it would be same or similar.

Is there a way to get the highest anomaly detected per partitionField ?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [January 15, 2025, 3:33pm UTC](https://discuss.elastic.co/t/kibana-anomaly-alerts-by-partitionfield/373133/2 "2025-01-15T15:33:16Z")

</div>

Did you create an alert of type "Record", "Bucket", or "Influencer"?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b6458fd826d7d5ca5e690e5ebf1c7a47a3ced952.png)

---

<div class="post-metadata">

**Author:** ![jlrivera81](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jlrivera81/32/138213_2.png) [@jlrivera81](https://discuss.elastic.co/u/jlrivera81)\
**Post date:** [January 16, 2025, 11:01am UTC](https://discuss.elastic.co/t/kibana-anomaly-alerts-by-partitionfield/373133/3 "2025-01-16T11:01:42Z")

</div>

Yes. I've tried all of them. But my preference is to stick with type "Record"

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [January 16, 2025, 6:09pm UTC](https://discuss.elastic.co/t/kibana-anomaly-alerts-by-partitionfield/373133/4 "2025-01-16T18:09:21Z")

</div>

You could create an ES|QL based Rule/Alert where you can find the max record\_score per partition:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/7/67aacfc20134f4ebc7cd1820685c42feee5ae19b.png)