# ML Anomaly Detection - Alert Thresholds

**URL:** <https://discuss.elastic.co/t/ml-anomaly-detection-alert-thresholds/378094>\
**Category:** Kibana\
**Created:** [May 13, 2025, 4:48pm UTC](https://discuss.elastic.co/t/ml-anomaly-detection-alert-thresholds/378094 "2025-05-13T16:48:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [May 13, 2025, 4:48pm UTC](https://discuss.elastic.co/t/ml-anomaly-detection-alert-thresholds/378094/1 "2025-05-13T16:48:10Z")

</div>

Hello,

I recently been building Anomaly Detection jobs and alerts. I was wondering if there's a way to specify a threshold.

Here's my current issue:  
Anomaly Detection works by using the historical data as a baseline. If there's a spike/anomaly in the data, the spike would be granted a score of deviation, an anomaly score.

For example:  
`Lets say, I get an anomaly score of 90, the actual value was 1445 above the baseline of 30`

This is a fair score due to it being an anomaly but when it comes to alerting, do I want to know if an anomaly (a deviation from the baseline) occurs all the time? Not really

In some cases, I would only be concerned if the actual value was exceeding 4,000, is this possible to do with the alerts?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 19, 2025, 2:12pm UTC](https://discuss.elastic.co/t/ml-anomaly-detection-alert-thresholds/378094/2 "2025-05-19T14:12:20Z")

</div>

> [@erikg](#):
>
> In some cases, I would only be concerned if the actual value was exceeding 4,000, is this possible to do with the alerts?

Then you can create a simple Threshold Alerts / ES| QL alert based on that threshold.

If you want to combine these to data Ml Score + Threshold... not that simple

You could write all the ML Alerts to an index then write a custom rule on top of that data.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 19, 2025, 2:28pm UTC](https://discuss.elastic.co/t/ml-anomaly-detection-alert-thresholds/378094/3 "2025-05-19T14:28:25Z")

</div>

Also look at [Custom Rules](https://discuss.elastic.co/t/how-to-generate-rules-for-anomaly-detection-ml/285707) in the ML job to ignore anomalies that you know are not meaningful.

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [May 23, 2025, 11:38pm UTC](https://discuss.elastic.co/t/ml-anomaly-detection-alert-thresholds/378094/4 "2025-05-23T23:38:37Z")

</div>

@stephenb @richcollier thanks for the insight!  
I ended up using ES|QL and the logic here is that I am grabbing the last hour and the previous hour, then doing math to determine if there was an increase by percentage, in this case, I only care about if its 80% above the baseline

```auto
FROM logs-*
| EVAL now = NOW()
| SORT @timestamp
| EVAL key = CASE(@timestamp < (now - 1 hour) AND @timestamp > (now - 2 hour), "Last hour", @timestamp < (now - 2 hour) AND @timestamp > (now - 3 hour), "Previous hour","Other")
| STATS count = COUNT(*) BY key
| EVAL count_last_hour = CASE(key == "Last hour", count), previous_hour = CASE(key == "Previous hour", count)
| STATS last_window_count = SUM(count_last_hour), previous_window_count = SUM(previous_hour)
| EVAL total_percentage = ROUND(ABS((last_window_count::DOUBLE - previous_window_count::DOUBLE) / previous_window_count::DOUBLE), 2) * 100
// Evaluation Threshold
| WHERE previous_window_count > 0 AND total_percentage >= 80

```

I am still rusty with ES|QL so this query can be optimized but the goal was identify peaks at a percentage , which currently not possible with ML.