# Kibana graph for anamoly detection

**URL:** <https://discuss.elastic.co/t/kibana-graph-for-anamoly-detection/76281>\
**Category:** Kibana\
**Created:** [February 23, 2017, 6:10pm UTC](https://discuss.elastic.co/t/kibana-graph-for-anamoly-detection/76281 "2017-02-23T18:10:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![RSundareswaran](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@RSundareswaran](https://discuss.elastic.co/u/RSundareswaran)\
**Post date:** [February 23, 2017, 6:10pm UTC](https://discuss.elastic.co/t/kibana-graph-for-anamoly-detection/76281/1 "2017-02-23T18:10:15Z")

</div>

With some data loaded into ES using LS, is there a way to mention in Kibana a threshold and display an indicator it breaches the threshold. For example number of transaction in an hour across the system lets set to 200. When gets refreshed the dashboard, it should indicate in red or something when it goes beyond 200 in a time line graph or some visualization. So If we see for whole day some hours will be red or spikes and most will be green or lower lines. This will be useful for us to display capability of anamoly detection. We are still working to understand Prelert but this kind of detection in Kibana will help us to see in graphs.

Regards, Raj

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [February 23, 2017, 9:54pm UTC](https://discuss.elastic.co/t/kibana-graph-for-anamoly-detection/76281/2 "2017-02-23T21:54:38Z")

</div>

It's not a feature at the moment, we have an open enhancement request you can track (and add your input on) here: [https://github.com/elastic/kibana/issues/4482](https://github.com/elastic/kibana/issues/4482)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 24, 2017, 1:32am UTC](https://discuss.elastic.co/t/kibana-graph-for-anamoly-detection/76281/3 "2017-02-24T01:32:29Z")

</div>

You can do something like that in Timelion.

With moving average agg;

```auto
$thres=NUMBER,$act=.es(index=INDEX,metric=sum:value), $movavg=.es(index=INDEX,metric=sum:FIELD).mvavg(window=5), ($movavg).lines(10).color(lightgray).label("Moving Average"), ($act).color(#07a5de).label("Actual"), ($movavg).subtract($act).abs().if(lt,$thres,null,$act).points(5,3,0).color(#e9478b).label("Anomaly")

```

With holt winters;

```auto
$thres=NUMBER, $act=.es(index=INDEX,metric=sum:FIELD), $holt=.es(index=INDEX,metric=sum:FIELD).holt(0.9,0.1,0.9,24h ),($holt).lines(10).color(lightgray).label("HoltWinters"),($act).color(#07a5de).label("Actual"), ($holt).subtract($act).abs().if(lt,$thres,null,$act).points(5,3,0).color(#e9478b).label("Anomaly")

```

(You'll need to change `THRESHOLD`, `INDEX` and `FIELD` to suit your data)

These can be misleading though. We've found that both of the above generate multiple false positives compared to ML, see the image below:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a117b5260bdb474e37e512ff513b3aeec7d51dee.png)

---

<div class="post-metadata">

**Author:** ![RSundareswaran](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@RSundareswaran](https://discuss.elastic.co/u/RSundareswaran)\
**Post date:** [February 24, 2017, 1:41pm UTC](https://discuss.elastic.co/t/kibana-graph-for-anamoly-detection/76281/4 "2017-02-24T13:41:55Z")

</div>

Thanks will try this

---

<div class="post-metadata">

**Author:** ![RSundareswaran](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@RSundareswaran](https://discuss.elastic.co/u/RSundareswaran)\
**Post date:** [February 24, 2017, 1:42pm UTC](https://discuss.elastic.co/t/kibana-graph-for-anamoly-detection/76281/5 "2017-02-24T13:42:35Z")

</div>

Thanks for the reply will do a +1 on the enhancement

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2017, 1:43pm UTC](https://discuss.elastic.co/t/kibana-graph-for-anamoly-detection/76281/6 "2017-03-24T13:43:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.