# How configure anomaly detector to detect specific day of week anomalies?

**URL:** <https://forum.opensearch.org/t/how-configure-anomaly-detector-to-detect-specific-day-of-week-anomalies/17344>\
**Category:** Machine Learning\
**Tags:** configure\
**Created:** [January 5, 2024, 12:05pm UTC](https://forum.opensearch.org/t/how-configure-anomaly-detector-to-detect-specific-day-of-week-anomalies/17344 "2024-01-05T12:05:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [January 5, 2024, 12:05pm UTC](https://forum.opensearch.org/t/how-configure-anomaly-detector-to-detect-specific-day-of-week-anomalies/17344/1 "2024-01-05T12:05:45Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.7.0

Hi,

I have created an anomaly detector which looks at Mondays but it doesn’t create any anomalies although there are huge differences between Mondays in my indices. I have 60 days of indices that are being analyzed.  
Any ideas why, what do I have to add in my detector config. in order to get this working?

The purpose is to see/find Monday anomalies when there are too few requests coming in.

The detector is based on my custom field: “testing.host.keyword” and a 60m detection interval.

Detector config:  
POST \_plugins/\_anomaly\_detection/detectors  
{  
“name”: “Monday\_request\_count\_anomaly\_detector”,  
“description”: “Detect anomalies in Monday request counts”,  
“time\_field”: “@timestamp”,  
“indices”: [“test\*”],  
“feature\_attributes”: [  
{  
“feature\_name”: “request\_count\_Monday”,  
“feature\_enabled”: true,  
“aggregation\_query”: {  
“testing\_host\_keyword\_count”: {  
“value\_count”: {  
“field”: “testing.host.keyword”  
}  
}  
}  
}  
],  
“filter\_query”: {  
“bool”: {  
“filter”: [  
{  
“range”: {  
“@timestamp”: {  
“gte”: “now-30d/d”,  
“lte”: “now/d”  
}  
}  
},  
{  
“script”: {  
“script”: {  
“source”: “”"  
def dayOfWeek = doc[‘@timestamp’].value.dayOfWeek;  
return dayOfWeek == 1;  
“”"  
}  
}  
}  
]  
}  
},  
“analysis\_config”: {  
“bucket\_span”: “1d”,  
“detectors”: [  
{  
“function”: “model\_plot”,  
“partition\_field\_name”: “testing.host.keyword”,  
“detector\_description”: “Detect lower-than-normal request counts on Mondays”  
}  
]  
},  
“detection\_interval”: {  
“period”: {  
“interval”: 60,  
“unit”: “Minutes”  
}  
},  
“window\_delay”: {  
“period”: {  
“interval”: 1,  
“unit”: “Minutes”  
}  
},  
“result\_index”: “opensearch-ad-plugin-result-monday-requests”  
}

I tried experimenting with the detection interval, but when i set it to 1440 minutes (24 Hours) i get this warning in opensearch log: “model is empty or too large: [0] bytes”

The host has 32 GB Ram and the JVM is set to 16 GB Ram

And if i change the interval to 10 minutes it shows anomalies but not the correct way.  
Screenshot with 10 min intervals and for 30 days is below

 ![Opensearch_270_ML_Anomaly_detector_mondays_10m_interval](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/1/1ca7064b69581245416378ea1a6a148e29a7b42d.jpeg)

Would really appreciate som help in solving what the config. should look like

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [March 5, 2024, 12:06pm UTC](https://forum.opensearch.org/t/how-configure-anomaly-detector-to-detect-specific-day-of-week-anomalies/17344/2 "2024-03-05T12:06:15Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.