# Anomaly detection

**URL:** <https://discuss.elastic.co/t/anomaly-detection/382487>\
**Category:** Elasticsearch\
**Created:** [October 7, 2025, 6:19pm UTC](https://discuss.elastic.co/t/anomaly-detection/382487 "2025-10-07T18:19:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![searchwithme](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/searchwithme/32/137075_2.png) [@searchwithme](https://discuss.elastic.co/u/searchwithme)\
**Post date:** [October 7, 2025, 6:19pm UTC](https://discuss.elastic.co/t/anomaly-detection/382487/1 "2025-10-07T18:19:25Z")

</div>

I got metrics ingested into elastic for each process. Some metrics are \>95%. I have created a ML job on max(cpu). You can see in the image how the spikes are for cpu. but I see no anomalies are found. why so? Please help!

 ![Screenshot 2025-10-07 at 11.47.55 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/3/83cde5fcb643b7625be668b0132102b2b7e04f4a.png)

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [October 8, 2025, 11:15pm UTC](https://discuss.elastic.co/t/anomaly-detection/382487/2 "2025-10-08T23:15:37Z")

</div>

How much data has been fed to the job so far…just what is shown? If so, that’s not enough. You need “hundreds” of `bucket_span`s worth of data for the ML job to build a proper statistical model.