Extending logic
The basic Watcher can be extended and improved following the same logic used with the stock _Watcher, for example by using transform to insert detections back in ES. An interesting set of examples is available from https://www.elastic.co/blog/implementing-a-statistical-anomaly-detector-part-3.