# Elasticsearch Anomaly Detection Explainer

Explain Elasticsearch ML anomaly detection scores, model behavior, and result...

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: Data and ML
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill elasticsearch-anomaly-detection-explainer -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill elasticsearch-anomaly-detection-explainer -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill elasticsearch-anomaly-detection-explainer -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill elasticsearch-anomaly-detection-explainer -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Explain Elasticsearch ML anomaly detection scores, model behavior, and result interpretation. Use when the user asks why a score is high or low, how the model learns, what the numbers mean, or how to troubleshoot unexpected anomaly scores.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Anomaly Detection Score Explainer

Explain anomaly scores, model behavior, and why results look the way they do. Use the **ML REST API** for job config and
the **standard `_search` API** against `.ml-anomalies-*` for results, no ES|QL, fully compatible with Elastic
Serverless. For job lifecycle (create, start, stop), use the `elasticsearch-anomaly-detection` skill.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

> **Prerequisite:** ML anomaly detection requires a Platinum-equivalent license on self-managed clusters. Serverless
> projects include ML. The caller needs `monitor_ml` to read job config and anomaly results.
>
> **Serverless note:** The `_ml/.../results/*` REST endpoints return HTTP 410 in Elastic Serverless. Always use
> `POST /.ml-anomalies-*/_search` for result queries instead, fully supported everywhere this skill runs.

## Process

1. **Decide whether to fetch data or interpret what the user supplied.** If the user embeds an anomaly record (or job
   config) in the prompt, interpret it directly using the domain knowledge below, do not call APIs to re-fetch fields
   already present. If the job ID, time range, or record is missing, retrieve it from the cluster.

The rest: https://github.com/elastic/agent-skills/blob/HEAD/plugins/elasticsearch/skills/elasticsearch-anomaly-detection-explainer/SKILL.md