# Need to setup mail alert on Mertricbeat data using ML (Prediction Alert)

**URL:** <https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning, elastic-stack-alerting\
**Created:** [August 25, 2021, 5:57am UTC](https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442 "2021-08-25T05:57:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![aniket.sonavane](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aniket.sonavane](https://discuss.elastic.co/u/aniket.sonavane)\
**Post date:** [August 25, 2021, 5:57am UTC](https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442/1 "2021-08-25T05:57:17Z")

</div>

**Objective:- Need prediction alert from kibana on metricbeat data?**

Hi,  
I've setup metricbeat 100+ servers and data is reporting, also I've created some anomaly jobs to identify anomalies and alert critical anomalies. now want to schedule the forecast and based on forecast data need threshold-based alerting.

Please suggest the steps and methodologies to achieve the given objective.

---

<div class="post-metadata">

**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\
**Post date:** [August 25, 2021, 1:32pm UTC](https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442/2 "2021-08-25T13:32:34Z")

</div>

Hi @aniket.sonavane ,

See this doc: [Generating alerts for anomaly detection jobs | Machine Learning in the Elastic Stack [master] | Elastic](https://www.elastic.co/guide/en/machine-learning/master/ml-configuring-alerts.html)

Does that help?

---

<div class="post-metadata">

**Author:** ![aniket.sonavane](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aniket.sonavane](https://discuss.elastic.co/u/aniket.sonavane)\
**Post date:** [August 25, 2021, 1:57pm UTC](https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442/3 "2021-08-25T13:57:29Z")

</div>

hi @chrisronline

thanks for replying  
I already have set up these anomaly alerts based on running data. but the objective is to create a predictive alert like "In next 2 days/hours hostname=xyz disk/CPU/memory utilization will be 80% " so the user can take action before the anomaly occurred.

---

<div class="post-metadata">

**Author:** ![darnautov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darnautov/32/70608_2.png) [@darnautov](https://discuss.elastic.co/u/darnautov)\
**Post date:** [August 25, 2021, 3:12pm UTC](https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442/4 "2021-08-25T15:12:28Z")

</div>

Hi @aniket.sonavane,

At the moment there is no easy way to set up the forecasting alerts you're referring to. As a workaround I can suggest the following:

1. Create forecast jobs using the Machine Learning plugin in Kibana or with [API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-forecast.html)
2. Set up the [index threshold alerting rule type](https://www.elastic.co/guide/en/kibana/current/rule-type-index-threshold.html). You need to query the `.ml-anomalies-*` index for `result_type:model_forecast ` with desired job IDs (potentially filter for partition, over or by fields), time range and checking a threshold value against `forecast_prediction`.
3. You will also need something for scheduling forecast yourself, wich is the most difficult part here. Utilizing the [Kibana task manager](https://www.elastic.co/guide/en/kibana/current/task-manager-production-considerations.html) might help.

You may consider [creating a feature request](https://github.com/elastic/kibana/issues/new?assignees=&labels=:ml&template=Feature_request.md) with more details about your particular use-case.

Hope it helps.

Regards,  
Dima

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 22, 2021, 3:12pm UTC](https://discuss.elastic.co/t/need-to-setup-mail-alert-on-mertricbeat-data-using-ml-prediction-alert/282442/5 "2021-09-22T15:12:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.