# Standard deviation based window on time series data and send alerts on outliers

**URL:** <https://discuss.elastic.co/t/standard-deviation-based-window-on-time-series-data-and-send-alerts-on-outliers/133035>\
**Category:** Elasticsearch\
**Created:** [May 23, 2018, 5:53pm UTC](https://discuss.elastic.co/t/standard-deviation-based-window-on-time-series-data-and-send-alerts-on-outliers/133035 "2018-05-23T17:53:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![natdip](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@natdip](https://discuss.elastic.co/u/natdip)\
**Post date:** [May 23, 2018, 5:53pm UTC](https://discuss.elastic.co/t/standard-deviation-based-window-on-time-series-data-and-send-alerts-on-outliers/133035/1 "2018-05-23T17:53:21Z")

</div>

I have a time series data. I want to create a standard deviation window based threshold on the count of data points for a particular time. Based on this threshold violation, I want to check the outliers in the data. Based on outliers then I would like to send alerts.  
What is the best way to approach the problem.

A similar solution in SumoLogic looks like:- In the given link-

> **[outlier](https://help.sumologic.com/Search/Search-Query-Language/Search-Operators/outlier)**
>
> Tracks the moving average and standard deviation of the value, and detects or alerts when the difference between the value exceeds mean by a given multiple of standard deviation.

Example:-  
Apache logs - Server Errors Over Time  
Run the following query to find outlier values in Apache logs over the last 3 hours.

\_sourceCategory=Apache/Access  
| parse "HTTP/1.1" \* " as status\_code  
| where status\_code matches "5\*"  
| timeslice 5m  
| count(status\_code) as status\_code by \_timeslice  
| outlier status\_code window=5,threshold=3,consecutive=1,direction=+-

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2018, 5:53pm UTC](https://discuss.elastic.co/t/standard-deviation-based-window-on-time-series-data-and-send-alerts-on-outliers/133035/2 "2018-06-20T17:53:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.