Hi @thos1996, welcome!
With just 5 fields plus timestamp either way could work.
The multi-field model has the advantage of potentially finding relationships between the fields, and the single-field model has the advantage of showing different activity for each field.
I generally like the approach of multi single-field models, where an anomaly is raised when a certain % of the fields are being anomalous at the same time. I’d say it’s worth trying both tho.
I’d create a data structure that stores the anomaly scores/likelihoods of each field for all time steps thus far (or the last n time steps). Then craft a sliding window logic which uses that info in some way. A simple baseline could just be: ‘any model is anomalous at all times where its last n anomaly likelihood vales average over 0.9’.
Here are a couple threads about handling multiple input fields:
Best of luck!