# Explain diff\_from\_typical meaning in custom rules

**URL:** <https://discuss.elastic.co/t/explain-diff-from-typical-meaning-in-custom-rules/304419>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 11, 2022, 6:49am UTC](https://discuss.elastic.co/t/explain-diff-from-typical-meaning-in-custom-rules/304419 "2022-05-11T06:49:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ixperdomo](https://avatars.discourse-cdn.com/v4/letter/i/e56c9b/32.png) [@ixperdomo](https://discuss.elastic.co/u/ixperdomo)\
**Post date:** [May 11, 2022, 6:49am UTC](https://discuss.elastic.co/t/explain-diff-from-typical-meaning-in-custom-rules/304419/1 "2022-05-11T06:49:27Z")

</div>

Hi,

When configuring Machine Learning jobs in ES, you can customise your detectors by using [custom\_rules](https://www.elastic.co/guide/en/elasticsearch/reference/master/ml-put-job.html#put-customrules).

I'm wondering about the actual meaning of the `applies_to` value `diff_from_typical`. My main question is if `diff_from_typical` considers difference in an absolute way or not. I know then you can use `lt` or `gt` operators (among others) but let's image the following situation:

I have a custom rule for two jobs. The rule is the same but the cases scenarios are different. Let's say that the custom rule is:

```auto
"custom_rules": [{
        "actions": ["skip_model_update"],
        "conditions": [
          {
            "applies_to": "diff_from_typical",
            "operator": "gt",
            "value": 2000
          }
        ]
      }]

```

Case scenario A:

- Typical value: 5000
- Actual value: 2000
- diff\_from\_typical: 5000 - 2000 = 3000

Case scenario B:

- Typical value: 5000
- Actual value: 8000
- diff\_from\_typical: 5000 - 8000 = -3000

Will the aforementioned custom rule apply in both cases? I mean, using the absolute difference from typical? Or will it only work in the first case (case A)?

I assume that if it only works for the first case, I should write the "inverse" custom rule to manage both cases.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 11, 2022, 11:19am UTC](https://discuss.elastic.co/t/explain-diff-from-typical-meaning-in-custom-rules/304419/2 "2022-05-11T11:19:40Z")

</div>

Yes `diff_from_typical` means absolute difference, so it covers the difference on either side.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2022, 11:20am UTC](https://discuss.elastic.co/t/explain-diff-from-typical-meaning-in-custom-rules/304419/3 "2022-06-08T11:20:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.