# Detecting anomalies on drop of throughput

**URL:** <https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [February 4, 2022, 2:04pm UTC](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307 "2022-02-04T14:04:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [February 4, 2022, 2:04pm UTC](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307/1 "2022-02-04T14:04:22Z")

</div>

Hi have data of throughput for multiple interfaces in a job, and I want to detect when the throughput drops abruptly, Im using the low\_mean function in the detector to do this, but sometimes there is an abrupt drop of throughtput and the anomaly is identify as minor.

What function in the detector would you recommend to get a higher severity when this drops happens?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [February 4, 2022, 7:39pm UTC](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307/2 "2022-02-04T19:39:11Z")

</div>

Ensure that you are using `partition_field` instead of `by_field` for the splitting of analysis, as `partition_field` allows for more [independent scoring per partition](https://www.elastic.co/blog/changes-to-elastic-machine-learning-anomaly-scoring-in-6-5).

There are many posts on this board relating to (I'll paraphrase a bit) "why isn't the anomaly scored like I want it to?" 😃 I think it is helpful to keep in mind that the scoring is always relative to the probability of the different behaviors of the data. So, it is possible that you have to tune your focus (or alerts) to lower-level scores for this data set just because that's the way this particular data set behaves.

Now with that said -You can also see if you get better fidelity using a different detector function like `low_sum()`, `low_median` or maybe even `min()` ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2022, 7:39pm UTC](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307/3 "2022-03-04T19:39:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.