# elasticsearch-anomaly-detection-explainer

> Claude/Codex skill by [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars · Updated 2026-10-23

Explain Elasticsearch ML anomaly detection scores, model behavior, and result interpretation. Use when the user asks why a score is high or low, how the model learns, what the numbers mean, or how to troubleshoot unexpected anomaly scores.

## Install

```sh
git clone https://github.com/elastic/claude-plugin /tmp/claude-plugin && ln -s /tmp/claude-plugin/skills/elasticsearch/elasticsearch-anomaly-detection-explainer ~/.claude/skills/elasticsearch-anomaly-detection-explainer
```

## From README

Anomaly Detection Score Explainer Explain anomaly scores, model behavior, and why results look the way they do. Use the ML REST API for job config and the standard search API against .ml-anomalies- for results — no ES|QL, fully compatible with Elastic Serverless. For job lifecycle (create, start, stop), use the elasticsearch-anomaly-detection skill. Environment Configuration This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds. This skill references operations in HTTP-shorthand form (e.g., GET /, GET /cat/indices, GET /{index}/mapping, GET /{index}/settings/index.mode, POST /query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.

## Links

- HTML page: https://omgskills.com/library/elastic/claude-plugin/skills/elasticsearch/elasticsearch-anomaly-detection-explainer/
- GitHub: https://github.com/elastic/claude-plugin
- Author: [@elastic](https://omgskills.com/library/elastic/index.md)

## More from this repo

- [cloud-onboarding](https://omgskills.com/library/elastic/claude-plugin/skills/cloud/onboarding/index.md) — Onboard an Elastic Cloud organization: configure the \`elastic\` CLI's Cloud context and API key, establish a default...
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars
- [cloud-provisioning](https://omgskills.com/library/elastic/claude-plugin/skills/cloud/provisioning/index.md) — Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects...
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars
- [elasticsearch-anomaly-detection](https://omgskills.com/library/elastic/claude-plugin/skills/elasticsearch/elasticsearch-anomaly-detection/index.md) — Used to create and manage Elastic ML anomaly detection jobs via the API.
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 4 stars