# ML: count vs low/high-count detector functions

**URL:** <https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [January 3, 2022, 9:11am UTC](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329 "2022-01-03T09:11:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shabnam](https://avatars.discourse-cdn.com/v4/letter/s/ecae2f/32.png) [@shabnam](https://discuss.elastic.co/u/shabnam)\
**Post date:** [January 3, 2022, 9:11am UTC](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329/1 "2022-01-03T09:11:53Z")

</div>

Hello  
I would like to know what is the difference between “count”, “low count”, and “high count”.  
I assume that “count” function includes the results from “low count”, "high count" and more ever. Please correct me if I’m wrong.  
If it's true, can you please make an example or express some of results from "count" that are not from "low count" nor "high count"?

Thanks

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [January 3, 2022, 12:34pm UTC](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329/2 "2022-01-03T12:34:32Z")

</div>

Simply, the `count` detector function finds anomalous deviations in the rate of documents/events on both the "high side" and the "low side" (i.e. spikes and dips) - whereas the one-sided functions of `low_count` and `high_count` only find anomalies on the low side and the high side, respectively.

As an example, you might pick `low_count` as an appropriate detector to track online orders per unit time because you only might want to know if your orders are less than expected (as having orders be higher than expected is likely a "good" thing). Alternatively, if you're looking for DDOS activity, then only looking for anomalies on the high side makes sense, thus an appropriate use of `high_count`.

---

<div class="post-metadata">

**Author:** ![shabnam](https://avatars.discourse-cdn.com/v4/letter/s/ecae2f/32.png) [@shabnam](https://discuss.elastic.co/u/shabnam)\
**Post date:** [January 26, 2022, 6:03am UTC](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329/3 "2022-01-26T06:03:26Z")

</div>

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2022, 6:03am UTC](https://discuss.elastic.co/t/ml-count-vs-low-high-count-detector-functions/293329/4 "2022-02-23T06:03:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.