# Anomaly Job scroll\_size parameter behaviour

**URL:** https://discuss.elastic.co/t/anomaly-job-scroll-size-parameter-behaviour/348533
**Category:** Elasticsearch
**Created:** [December 4, 2023, 9:10am UTC](https://discuss.elastic.co/t/anomaly-job-scroll-size-parameter-behaviour/348533 "2023-12-04T09:10:32Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![marmai16](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@marmai16](https://discuss.elastic.co/u/marmai16)
#### Post date: [December 4, 2023, 9:10am UTC](https://discuss.elastic.co/t/anomaly-job-scroll-size-parameter-behaviour/348533/1 "2023-12-04T09:10:32Z")

</div>

Hello everyone,

a quick question regarding the `scroll_size` parameter of a datafeed in an anomaly job.

Is the `scroll_size` just limiting the number of results **per** query returned, but every document is processed (thus a reduced scroll\_size implies increased number of query executions)?

Or, let's say if we have 1000 doc's in a time range equal the bucket size of a job, and the `scroll_size` is defined as 750, does it only process 750 documents and proceeds to the next bucket (without processing the 250 remaining documents in that bucket).

Thank you in advance!

---

<div class="post-metadata">

### Author: ![marmai16](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@marmai16](https://discuss.elastic.co/u/marmai16)
#### Post date: [December 4, 2023, 2:07pm UTC](https://discuss.elastic.co/t/anomaly-job-scroll-size-parameter-behaviour/348533/2 "2023-12-04T14:07:04Z")

</div>

To answer my own question, for those interested:

" `scroll_size`: In most cases, the type of search that the datafeed executes to Elasticsearch uses the scroll API. Scroll size defines how much the datafeed queries to Elasticsearch at a time. For example, if the datafeed is set to query for log data every 5 minutes, but in a typical 5-minute window there are 1 million events, the idea of scrolling that data means that not all 1 million events will be expected to be fetched with one giant query. Rather, it will do it with many queries in increments of `scroll_size`. By default, this scroll size is set conservatively to 1,000. So, to get 1 million records returned to ML, the datafeed will ask Elasticsearch for 1,000 rows, a thousand times. Increasing `scroll_size` to 10,000 will make the number of scrolls be reduced to a hundred. In general, beefier clusters should be able to handle a larger `scroll_size` and thus be more efficient in the overall process."

Source: [Machine Learning with the Elastic Stack](https://subscription.packtpub.com/book/data/9781788477543/1/ch01lvl1sec04/operationalization)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2024, 2:07pm UTC](https://discuss.elastic.co/t/anomaly-job-scroll-size-parameter-behaviour/348533/3 "2024-01-01T14:07:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
