# Anomaly filter

**URL:** <https://discuss.elastic.co/t/anomaly-filter/142206>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [July 30, 2018, 3:16pm UTC](https://discuss.elastic.co/t/anomaly-filter/142206 "2018-07-30T15:16:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [July 30, 2018, 3:16pm UTC](https://discuss.elastic.co/t/anomaly-filter/142206/1 "2018-07-30T15:16:45Z")

</div>

Hello.  
I wont to detect this anomaly (high traffic):

 ![anom](https://us1.discourse-cdn.com/elastic/original/3X/8/2/82470f147ff59fcab9154483d99bc689b1a78635.JPG)

But I dont want detect anomaly with traffic for less then 1 Mbytes. How can I exclude the detection of anomalies with a small amount of traffic? I want detect anomaly only high traffic. My jobs based upon the observed past behavior.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [July 30, 2018, 8:19pm UTC](https://discuss.elastic.co/t/anomaly-filter/142206/2 "2018-07-30T20:19:06Z")

</div>

Doing an analysis using something like `high_mean(yourfieldname)` will restrict the finding of the anomalies on the high-side (and not anomalies for unusually low values). This will properly find the anomaly shown above. Anomalies are [always scored relative to their level of unusualness](https://www.elastic.co/blog/machine-learning-anomaly-scoring-elasticsearch-how-it-works), so smaller spikes are scored lower than larger spikes. You would then potentially [alert](https://www.elastic.co/blog/alerting-on-machine-learning-jobs-in-elasticsearch-v55) only on the high scoring anomalies.

However, if you are asking for the functionality such as "find me anomalous spikes in the data, but NEVER in the case where the anomalous value is less than 1 Mbyte, then you'll need to wait for a few versions for a forthcoming feature that will allow specific rules to override/control what gets considered an anomaly.

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [August 1, 2018, 6:16am UTC](https://discuss.elastic.co/t/anomaly-filter/142206/3 "2018-08-01T06:16:39Z")

</div>

> [@richcollier](#):
>
> However, if you are asking for the functionality such as "find me anomalous spikes in the data, but NEVER in the case where the anomalous value is less than 1 Mbyte, then you'll need to wait for a few versions for a forthcoming feature that will allow specific rules to override/control what gets considered an anomaly.

Great news! Tell me when is it planned to release this feature? In which version of the elastic it appears?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [August 1, 2018, 11:57am UTC](https://discuss.elastic.co/t/anomaly-filter/142206/4 "2018-08-01T11:57:32Z")

</div>

This feature is planned for v6.4 coming within the next few months, but we cannot guarantee that.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 29, 2018, 10:04pm UTC](https://discuss.elastic.co/t/anomaly-filter/142206/5 "2018-10-29T22:04:20Z")

</div>