# Using Anomaly Detection to detect sudden increases or decreases in the amount of logs received for an index

**URL:** <https://forum.opensearch.org/t/using-anomaly-detection-to-detect-sudden-increases-or-decreases-in-the-amount-of-logs-received-for-an-index/8628>\
**Category:** Machine Learning\
**Tags:** troubleshoot\
**Created:** [February 15, 2022, 8:36am UTC](https://forum.opensearch.org/t/using-anomaly-detection-to-detect-sudden-increases-or-decreases-in-the-amount-of-logs-received-for-an-index/8628 "2022-02-15T08:36:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor](https://avatars.discourse-cdn.com/v4/letter/v/3e96dc/32.png) [@victor](https://forum.opensearch.org/u/victor)\
**Post date:** [February 15, 2022, 8:36am UTC](https://forum.opensearch.org/t/using-anomaly-detection-to-detect-sudden-increases-or-decreases-in-the-amount-of-logs-received-for-an-index/8628/1 "2022-02-15T08:36:24Z")

</div>

Hi,

We have a need to detect sudden changes to the amount of logs received for certain indices. One idea we had was using the OpenSearch Anomaly Detection plugin to perhaps do a count() on the @timestamp field.

We tested this and got some results back from the historical analysis, but the detections were a little to picky for us. The anomalies were created when we got an increase around about 2-5%, instead we would like to get an alert when it differs around 10% or more.

Is this possible? Thanks

---

<div class="post-metadata">

**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\
**Post date:** [February 15, 2022, 2:42pm UTC](https://forum.opensearch.org/t/using-anomaly-detection-to-detect-sudden-increases-or-decreases-in-the-amount-of-logs-received-for-an-index/8628/2 "2022-02-15T14:42:08Z")

</div>

Humm. How much does your data typically vary on the `count()`?

Also, what is your interval - is that set too tight?

---

<div class="post-metadata">

**Author:** ![kaituo](https://avatars.discourse-cdn.com/v4/letter/k/e8c25b/32.png) [@kaituo](https://forum.opensearch.org/u/kaituo)\
**Post date:** [February 16, 2022, 7:13pm UTC](https://forum.opensearch.org/t/using-anomaly-detection-to-detect-sudden-increases-or-decreases-in-the-amount-of-logs-received-for-an-index/8628/3 "2022-02-16T19:13:33Z")

</div>

trying different intervals might help. Also, you can use alerting since you know the threshold to trigger.