# ML - Anomaly fresh data (high score)

**URL:** <https://discuss.elastic.co/t/ml-anomaly-fresh-data-high-score/233297>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 19, 2020, 10:39am UTC](https://discuss.elastic.co/t/ml-anomaly-fresh-data-high-score/233297 "2020-05-19T10:39:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [May 19, 2020, 10:39am UTC](https://discuss.elastic.co/t/ml-anomaly-fresh-data-high-score/233297/1 "2020-05-19T10:39:43Z")

</div>

Hi,

I am starting to play with ML, i have created a job to look for rare user name to soure country. Many people login from the UK, the issue is ingesting a new company leads to high scores for the new user names, organizations.name is populated for all data

Job is Rare user.name, partition source.geo.country\_name and user.name + source.geo.county\_name as the influencers

Is there anything within the job i can set to deal with this?

Thanks  
Phil

---

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [May 19, 2020, 12:41pm UTC](https://discuss.elastic.co/t/ml-anomaly-fresh-data-high-score/233297/2 "2020-05-19T12:41:40Z")

</div>

Beleive i have resolved my issue with the filters. Although when cloning the job it fails on the validation, just says bad. Ive had to create the ML job with a small amount of data, open, add the filter then expand its dataset.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2020, 12:41pm UTC](https://discuss.elastic.co/t/ml-anomaly-fresh-data-high-score/233297/3 "2020-06-16T12:41:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
