# Anomaly on specific value (0) **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-machine-learning\ **Created:** [November 29, 2021, 8:14am UTC](https://discuss.elastic.co/t/anomaly-on-specific-value-0/290400 "2021-11-29T08:14:41Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![zangero98](https://avatars.discourse-cdn.com/v4/letter/z/a587f6/32.png) [@zangero98](https://discuss.elastic.co/u/zangero98)\ **Post date:** [November 29, 2021, 8:14am UTC](https://discuss.elastic.co/t/anomaly-on-specific-value-0/290400/1 "2021-11-29T08:14:41Z")
hello guys, (1) I want to make alerts with machine learning when a specific log source don't send any logs for 10 minutes (availability job). I tried it with low count and custom rules but there always showed up anomalies with actual=0 that aren't really zero values. Is it possible to specify the machine learning job to only look on unexpected zero values? Or is there a much easier way for this common use case? (2) Some Logsources send very inconsistent so I don't won't to train the data but still want the zero values in my anomalies. Have you some ideas to realize this? ---
**Author:** ![sophie\_chang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sophie_chang/32/18008_2.png) [@sophie\_chang](https://discuss.elastic.co/u/sophie_chang)\ **Post date:** [November 29, 2021, 9:41am UTC](https://discuss.elastic.co/t/anomaly-on-specific-value-0/290400/2 "2021-11-29T09:41:12Z")
Hi @zangero98 if your detection is really just "count=0 for \> 10 mins" then this sounds more like a rule that could be implemented using Kibana Alerting. If you want to model data and learn from past behaviours, then ML anomaly detection (or a combination of alerting and ML) could be used. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 27, 2021, 9:41am UTC](https://discuss.elastic.co/t/anomaly-on-specific-value-0/290400/3 "2021-12-27T09:41:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.