# Abnormal Datafeeding detected in Anomaly Detection Jobs

**URL:** <https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [December 7, 2022, 10:32am UTC](https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672 "2022-12-07T10:32:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\
**Post date:** [December 7, 2022, 10:32am UTC](https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672/1 "2022-12-07T10:32:29Z")

</div>

Hi Team,

There are a couple of machine learning jobs currently running in our ELK environment. With this, we have configured watcher alerts also, based on the record-level anomaly score. Since a few days back, we've been receiving false positive alerts.  
After investigation, we found that, though there are data in the index checked from discover (540 hits) for that timeframe, the anomaly detection result window is showing actual 0. Please see below for reference --

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/8/18b8b927abcfb30da7f910064cc1fa5fdda93340.png)

Now, by further deep-diving, we found that datafeed is not able to pull data properly, see the screenshot below for reference --

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/b/bbde60689a88ed18fe879a8999052b6bb5b5eae6.png)

**Why datafeed is not able to pull these many documents?**

FYI, current settings are as below --

> query\_delay - 240s  
> scroll\_size - 1000

Also, let me know if you need any other information.

Regards,  
Souvik

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 14, 2022, 5:47pm UTC](https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672/2 "2022-12-14T17:47:58Z")

</div>

if this is an ongoing issue you have to either increase your `query_delay` so that you are not missing data or figure out why it takes so long (apparently longer than 2 minutes) for your data to be ingested and searchable (by the ML job)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2023, 5:48pm UTC](https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672/3 "2023-01-11T17:48:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.