# low\_Sum and low\_count

**URL:** <https://discuss.elastic.co/t/low-sum-and-low-count/187016>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [June 23, 2019, 5:54pm UTC](https://discuss.elastic.co/t/low-sum-and-low-count/187016 "2019-06-23T17:54:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bharath\_Kumar\_R](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bharath_kumar_r/32/45474_2.png) [@Bharath\_Kumar\_R](https://discuss.elastic.co/u/Bharath_Kumar_R)\
**Post date:** [June 23, 2019, 5:54pm UTC](https://discuss.elastic.co/t/low-sum-and-low-count/187016/1 "2019-06-23T17:54:06Z")

</div>

Hey, Im trying to create a job where anomalies are to be detected if the amount of data in an index falls to very low values. If low\_count function is used, I can detect anomalies if the count of documents falls to very low values. Is low\_sum similar to the low\_count function? Can low\_sum also be used for situations similar to this, since I'm getting different plots for same data? i.e, can low\_Sum be used to find anomalies if input falls to low values?  
For low\_sum, I used a field EVENTHOUR, which denotes the hour at which we received the data. So, will the anomaly detection be similar for both low\_sum and low\_count?

 ![15%20PM](https://us1.discourse-cdn.com/elastic/original/3X/2/4/245f56e18a657b58821b1bab9d8e3f951e2d21ce.png)

 ![48%20PM](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f3b25019adde327e9a43b0519ea96f4014f3d6ce.png)

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [June 24, 2019, 12:19pm UTC](https://discuss.elastic.co/t/low-sum-and-low-count/187016/2 "2019-06-24T12:19:01Z")

</div>

There often can be several different ways to detect the evidence of the same situation. This is one of those cases.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2019, 12:19pm UTC](https://discuss.elastic.co/t/low-sum-and-low-count/187016/3 "2019-07-22T12:19:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.