Visualization of low log precentage

Hello,

I have 2 devices that sending exactly 30K of log every day to my ELK system.
I would like to make a visualization when one of the is sending 10% less logs, lets say 24K or less.
Can i make something like that, without showing the normal case (of 30K logs), i mean only the delta of logs?
thanks.

I'm not really sure what you are asking. Perhaps attach a mockup / drawing of what you have in mind?