Watcher Alerting on multi-bucket anomaly?

[Incauto]

Its posible to alert only on multi-bucket anomalies? can you direct me to some examples please?

thanks

[richcollier]

See example here:

ML watcher configs

Hi @richcollier, thank you for your reply. I have increased the interval and it looks working for missed results. however I found another inconsistency in the results which I'm not sure if related to interval or not - I had another watcher looking at a ML job results with a 10min bucket span and query_delay around 15min. Watcher has a timestamp filter with the following config to be sure all the results are written and final. I noticed that a execution of watcher has fired for a record with a r…

The field that defines if the anomaly is multi-bucket is: multi_bucket_impact. Anomalies with a multi_bucket_impact value of greater than or equal to 2 are considered multi-bucket impact anomalies and are marked with crosses in our UI. For more info see: Interpreting multi-bucket impact anomalies using Elastic machine learning features | Elastic Blog