diff --git a/.gitignore b/.gitignore
index 5242de0..dcb6477 100755
--- a/.gitignore
+++ b/.gitignore
@@ -25,4 +25,5 @@ tmp/
 go-watch-logs
 *.sqlite
 *.sqlite3
-logs/
\ No newline at end of file
+logs/
+testdata/
\ No newline at end of file
diff --git a/pkg/database.go b/pkg/database.go
index 07e136a..f7ff961 100644
--- a/pkg/database.go
+++ b/pkg/database.go
@@ -15,7 +15,6 @@ var (
 
 func InitDB(dbName string) (*sql.DB, error) {
 	if db != nil {
-		// do a db ping to check if the connection is still alive
 		if err := db.Ping(); err == nil {
 			slog.Info("Reusing database connection", "dbName", dbName)
 			return db, nil
@@ -33,38 +32,49 @@ func InitDB(dbName string) (*sql.DB, error) {
 		return nil, err
 	}
 
-	_, err = db.Exec(`
+	db.SetMaxOpenConns(5)
+	db.SetMaxIdleConns(5)
+	db.SetConnMaxLifetime(time.Hour)
+
+	if err := createTables(db); err != nil {
+		return nil, err
+	}
+
+	return db, nil
+}
+func Vacuum(dbName string) error {
+	if _, err := os.Stat(dbName); err == nil {
+		if err := os.Remove(dbName); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func createTables(db *sql.DB) error {
+	slog.Info("Creating tables if not exist")
+	_, err := db.Exec(`
 		CREATE TABLE IF NOT EXISTS state (
 			key TEXT PRIMARY KEY,
-			value INTEGER
+			value INTEGER,
+			updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 		)
 	`)
 	if err != nil {
 		slog.Error("Error creating state table", "error", err.Error())
-		return nil, err
+		return err
 	}
 	_, err = db.Exec(`
-		CREATE TABLE IF NOT EXISTS plot (
+		CREATE TABLE IF NOT EXISTS anomaly (
 			key TEXT PRIMARY KEY,
-			value INTEGER
+			value INTEGER,
 			created_at DATETIME DEFAULT CURRENT_TIMESTAMP
 		)
 	`)
 	if err != nil {
 		slog.Error("Error creating plot table", "error", err.Error())
-		return nil, err
+		return err
 	}
-	db.SetMaxOpenConns(5)
-	db.SetMaxIdleConns(5)
-	db.SetConnMaxLifetime(time.Hour)
 
-	return db, nil
-}
-func Vacuum(dbName string) error {
-	if _, err := os.Stat(dbName); err == nil {
-		if err := os.Remove(dbName); err != nil {
-			return err
-		}
-	}
 	return nil
 }
diff --git a/pkg/watcher.go b/pkg/watcher.go
index a305350..4d10368 100644
--- a/pkg/watcher.go
+++ b/pkg/watcher.go
@@ -14,6 +14,7 @@ type Watcher struct {
 	db              *sql.DB
 	dbName          string // full path
 	filePath        string
+	anomalyKey      string
 	lastLineKey     string
 	lastFileSizeKey string
 	matchPattern    string
@@ -43,6 +44,7 @@ func NewWatcher(
 		anomaly:         anomaly,
 		matchPattern:    matchPattern,
 		ignorePattern:   ignorePattern,
+		anomalyKey:      "anm-" + filePath,
 		lastLineKey:     "llk-" + filePath,
 		lastFileSizeKey: "llks-" + filePath,
 	}
@@ -65,6 +67,8 @@ type ScanResult struct {
 	LastDate     string
 }
 
+var lines = []string{}
+
 func (w *Watcher) Scan() (*ScanResult, error) {
 	errorCounts := 0
 	firstLine := ""
@@ -108,6 +112,7 @@ func (w *Watcher) Scan() (*ScanResult, error) {
 	bytesRead := w.lastFileSize
 
 	for scanner.Scan() {
+		lines = append(lines, scanner.Text())
 		line := scanner.Bytes()
 		bytesRead += int64(len(line)) + 1 // Adding 1 for the newline character
 		currentLineNum++
@@ -116,10 +121,24 @@ func (w *Watcher) Scan() (*ScanResult, error) {
 		if linesRead < 0 {
 			linesRead = -linesRead
 		}
-		slog.Debug("Scanning line", "line", string(line), "lineNum", currentLineNum, "linesRead", linesRead)
+		// slog.Debug("Scanning line", "line", string(line), "lineNum", currentLineNum, "linesRead", linesRead)
 		if w.ignorePattern != "" && ri.Match(line) {
 			continue
 		}
+
+		// anomaly insertion
+		if w.anomaly {
+			match := re.FindAllString(string(line), -1)
+			var exactMatch string
+			if len(match) >= 1 {
+				exactMatch = match[0]
+			}
+			if exactMatch != "" {
+				slog.Info("Match found", "line", string(line), "match", exactMatch)
+			}
+
+		}
+
 		if re.Match(line) {
 			lineStr := string(line)
 			if firstLine == "" {