# Are there pre-made Anomaly Detection detectors?

**URL:** <https://forum.opensearch.org/t/are-there-pre-made-anomaly-detection-detectors/6244>\
**Category:** Machine Learning\
**Created:** [June 16, 2021, 4:10pm UTC](https://forum.opensearch.org/t/are-there-pre-made-anomaly-detection-detectors/6244 "2021-06-16T16:10:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kanrab](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@kanrab](https://forum.opensearch.org/u/kanrab)\
**Post date:** [June 16, 2021, 4:10pm UTC](https://forum.opensearch.org/t/are-there-pre-made-anomaly-detection-detectors/6244/1 "2021-06-16T16:10:39Z")

</div>

I want to implement anomaly detection, but I want to know if there are any default detectors or pre-made detectors?

---

<div class="post-metadata">

**Author:** ![robcowart](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/robcowart/32/1012_2.png) [@robcowart](https://forum.opensearch.org/u/robcowart)\
**Post date:** [June 19, 2021, 7:36am UTC](https://forum.opensearch.org/t/are-there-pre-made-anomaly-detection-detectors/6244/2 "2021-06-19T07:36:46Z")

</div>

The challenge with pre-built detectors is that they will be specific to the data, or more specifically to the schema, that is being analyzed. For common and consistent datasources this can make sense. For example… prebuilt detectors for Metricbeat’s System module.

We are working on some pre-built anomaly detections for ElastiFlow, similar to [what we provide for Elastic’s ML features](https://github.com/elastiflow/elastiflow_for_elasticsearch/tree/master/ml). However these will be specific to the 'CODEX" schema we use in ElastiFlow when sending data to OpenSearch. These should be available by the end of July.

---

<div class="post-metadata">

**Author:** ![kanrab](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@kanrab](https://forum.opensearch.org/u/kanrab)\
**Post date:** [June 29, 2021, 2:27pm UTC](https://forum.opensearch.org/t/are-there-pre-made-anomaly-detection-detectors/6244/3 "2021-06-29T14:27:32Z")

</div>

Thank you!

My issue is building effective anomaly detectors. Besides [Anomaly Detection - Open Distro Documentation](https://opendistro.github.io/for-elasticsearch-docs/docs/ad/) , is there a resource in building effective anomaly detectors. I do not know if having multiple features I include are good or not.

---

<div class="post-metadata">

**Author:** ![wnbts](https://avatars.discourse-cdn.com/v4/letter/w/c89c15/32.png) [@wnbts](https://forum.opensearch.org/u/wnbts)\
**Post date:** [August 25, 2021, 9:03pm UTC](https://forum.opensearch.org/t/are-there-pre-made-anomaly-detection-detectors/6244/4 "2021-08-25T21:03:42Z")

</div>

Hi kanrab,  
I am one of the contributors to the anomaly detection plugin. Here’s some information that might be useful.

Since the data for anomaly detection is different, and even on the same data, the intents/definitions of anomalies can be different, there is no general way to make one detector that works on all data. The users must define what a detector does for their specific problems.

The very beginning is to define what is being monitored, error counts? p99 latency? a combination? For an example, there is a blog [Preprocess logs for anomaly detection in Amazon OpenSearch | AWS Big Data Blog](https://aws.amazon.com/blogs/big-data/preprocess-logs-for-anomaly-detection-in-amazon-es/) . As for which ones are good, the suggestion is just to create different detectors with different sets of features, let them run on the data, and see which detectors better solve the problems.