Anomaly detection using filter in custom expression

Hey guys!

My team and I want to set an anomaly detection based on the response status code. Specifically, we want to collect the counts of 200 and the counts of other status codes in an interval as features in the model configuration.

The status code we have is in one field. I’ve tried using filter and scripted_metric in custom expression to collect the counts, but it seems that the custom expression does not allow me to do this. If it actually could work, please let me know.

As far as I know, the value here should be a single value. Do you have any good ways to achieve that? Thanks!

Can you share index schema and your custom expression?