Hello, I recently been building Anomaly Detection jobs and alerts. I was wondering if there's a way to specify a threshold. Here's my current issue: Anomaly Detection works by using the historical data as a baseline. If there's a spike/anomaly in the data, the spike would be granted a score of de…

[image] erikg: In some cases, I would only be concerned if the actual value was exceeding 4,000, is this possible to do with the alerts? Then you can create a simple Threshold Alerts / ES| QL alert based on that threshold. If you want to combine these to data Ml Score + Threshold... not that…

@stephenb @richcollier thanks for the insight! I ended up using ES|QL and the logic here is that I am grabbing the last hour and the previous hour, then doing math to determine if there was an increase by percentage, in this case, I only care about if its 80% above the baseline FROM logs-* | EVAL …

ML Anomaly Detection - Alert Thresholds

Elastic Stack Kibana

richcollier (rich collier) May 19, 2025, 2:28pm 3

Also look at Custom Rules in the ML job to ignore anomalies that you know are not meaningful.

Topic		Replies	Views
[Jobs] Add threshold information to calculate anomlay score Elasticsearch elastic-stack-machine-learning	3	577	October 30, 2018
Elastic Search Anomaly Detection - Influencing Anomaly Scoring Elasticsearch elastic-stack-machine-learning	2	375	November 17, 2022
Log Rate Spikes alert Elastic Observability	5	128	April 25, 2025
Trigering Alerts for Machine learning Jobs SIEM	3	175	August 1, 2024
ML Anomaly Detection jobs gives very low score for absense of events Elasticsearch elastic-stack-machine-learning	5	123	October 18, 2024

ML Anomaly Detection - Alert Thresholds

Related topics