Hi, may I know if there's any tool in Kibana that can help me to find out which variable can distinguish abnormal traffic?

The example below shows the daily traffic is around 10k, but it rose to 40k since May 28th. After trying and erroring many fields, I finally found that by split the series with field A, the tiffany-blue and red-orange bar are the source of abnormal traffic.

I would like to know if there's an easier way to find the field A automatically. That would be great if there's a guideline to build the search. Thanks.

Absolutely - this is exactly what the Machine Learning part of the stack was made for: Machine Learning for Elasticsearch | Elastic

It allows you to do anomaly detection which looks like the thing you need here.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.