The X-Pack machine learning features include the following count functions:
Count functions detect anomalies when the count of events in a bucket is anomalous.
non_zero_count functions if your data is sparse and you want to ignore
cases where the bucket count is zero.
distinct_count functions to determine when the number of distinct values
in one field is unusual, as opposed to the total count.
Use high-sided functions if you want to monitor unusually high event rates. Use low-sided functions if you want to look at drops in event rate.