(1) I want to make alerts with machine learning when a specific log source don't send any logs for 10 minutes (availability job). I tried it with low count and custom rules but there always showed up anomalies with actual=0 that aren't really zero values.
Is it possible to specify the machine learning job to only look on unexpected zero values? Or is there a much easier way for this common use case?
(2) Some Logsources send very inconsistent so I don't won't to train the data but still want the zero values in my anomalies. Have you some ideas to realize this?