Setup Anomaly-Detection using Logstail Insights Plugin

1. Navigate to Insights Plugin from the top menu. 
2. Click on Create detector. 

Create Detector

1. Name your detector. 
2. Optionally add a description to the detector. 

Name the detector

1. Select the desired index you want to run the detector on. (We recommend to use the wildcard “*” to include the logs for all the dates.) 
2. Optionally you add a Data filter. 
3. Select @timestamp for the Timestamp field. 
4. Click next on the bottom-right of the page. 

Data Source

Timestamp

Next =>

1. Enter a name for your feature. 
2. Check the Enable feature option. 
3. For our example we use the Field value option. 
4. For our example we use max as an Aggregation method. 
5. For field select “cpuusage” to find anomalies based on high CPU usage. 
6. You can add more features to match your needs and your use case. 
7. Click next on the bottom-right of the page. 

Feature name

Setup feature

Next =>

1. Check the Start real-time detector automatically checkbox. 
2. Check the Run historical analysis detection checkbox if you want to run historical analysis to your MikroTik logs. Also select the desired time range for the analysis. 
3. Click next on the bottom-right of the page. 
4. Click Create detector on the bottom-right of the page. 

Detector Settings

Create the Detector

The Detector setup has finished. You can navigate in the Real-time results tab to view the anomalies detected in real time, in the Historical analysis tab to view the analysis of your data and in the Detector configuration tab to view or edit the Detector configuration.