# \[ML\] Custom function in anomaly detection job

**URL:** <https://discuss.elastic.co/t/ml-custom-function-in-anomaly-detection-job/326332>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [February 23, 2023, 2:31pm UTC](https://discuss.elastic.co/t/ml-custom-function-in-anomaly-detection-job/326332 "2023-02-23T14:31:50Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [February 23, 2023, 3:46pm UTC](https://discuss.elastic.co/t/ml-custom-function-in-anomaly-detection-job/326332/2 "2023-02-23T15:46:01Z")

</div>

You should do this with a set of query aggregations in the datafeed of the ML job so that the sums and the ratio are calculated first, then fed to ML.

An older, but relevant example is here: [Analyzing a ratio of documents over time with Anomaly Detection](https://discuss.elastic.co/t/analyzing-a-ratio-of-documents-over-time-with-anomaly-detection/225255)

In your case, you'd do two different `sum` aggregations, then do the ratio with a `bucket_script` aggregation

---

_[View the full topic](https://discuss.elastic.co/t/ml-custom-function-in-anomaly-detection-job/326332)._