Adding custom rules for anomaly detection in X-pack

Elastic Stack Elasticsearch
1

Hey, I'm using X-pack for Anomaly Detection.Is there any way to alter the conditions/rules in my ML job for which the anomaly is detected in my data? For example, i want anomalies to be detected only for zero/null values in my data. i also want anomalies to be detected if no value is input to my ML job

2
3

So, can we modify the rules to detect anomalies if there is no input data to the ML job for a given amount of time?

4

You don't need a custom rule for that. A simple detection configuration of low_count will suffice. If the index you're interested in keeping track of suddenly gets lower input volume than it should, then you'll get an anomaly:

image

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.