We created an anomaly detector using OpenSearch with a 10-minute window interval, focusing on three features: total_count, logstats, and flowstats, using sum aggregation and a shingle size of 8.

To test the detector, we inserted an anomaly with values of 6 million, while the usual values are around 6700. However, the detector failed to detect this anomaly in real-time data, even though it successfully identifies anomalies in historical data.

Our dataset contains hundreds of features, but the detector only considers these three. Why is the detector missing real-time anomalies, and how can we fix this?

We tried inserting the data multiple times and reviewing the logs but nothing seemed out of the ordinary.