# Are these values right for Query delay, Frequency and Bucket Span? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-machine-learning\ **Created:** [July 1, 2020, 1:46pm UTC](https://discuss.elastic.co/t/are-these-values-right-for-query-delay-frequency-and-bucket-span/239498 "2020-07-01T13:46:01Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Post date:** [July 1, 2020, 1:46pm UTC](https://discuss.elastic.co/t/are-these-values-right-for-query-delay-frequency-and-bucket-span/239498/1 "2020-07-01T13:46:01Z")
I am trying out the anomaly detection job. The data is coming from logstash at interval of 5 mins. But sometimes there will be no data in those 5 mins. The data itself will be randomly distrubuted in the 5 min slot. Sometimes there will be 5 data points at start of the time slot. Sometimes in middle. Sometime at end. Like all these are possible scenarios: No data: 00000 Data at start: D0000 Data in middle: 00D00 Data in end: 0000D I have kept the Query delay and Frequency delay to 5m. My idea is to not miss any data. The suggested Bucket Span was 30m. Should it not have been 5 mins? ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [July 1, 2020, 2:47pm UTC](https://discuss.elastic.co/t/are-these-values-right-for-query-delay-frequency-and-bucket-span/239498/2 "2020-07-01T14:47:56Z")
Think of [bucket\_span](https://www.elastic.co/blog/explaining-the-bucket-span-in-machine-learning-for-elasticsearch) as the analysis aggregation interval. This is different than the frequency and delay of getting the data from the source index. ---
**Author:** ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Post date:** [July 2, 2020, 1:38am UTC](https://discuss.elastic.co/t/are-these-values-right-for-query-delay-frequency-and-bucket-span/239498/3 "2020-07-02T01:38:42Z")
Thanks for response @richcollier. Is it fine that I keep Query delay equal to 1d? I assume the datafeed keeps a track of the point till which it has taken in the data to avoid the duplicate issues. And the only cost for me will be a more expensive query since the time range is bigger. I am asking this since the data is actually coming from production line. And they run the line when needed. There is no schedule. There maybe days during which they do not make anything. And few days when the run the line 24hrs non stop. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [July 3, 2020, 12:39pm UTC](https://discuss.elastic.co/t/are-these-values-right-for-query-delay-frequency-and-bucket-span/239498/4 "2020-07-03T12:39:12Z")
There are 3 important parameters: `bucket_span`, `query_delay`, and `frequency` `bucket_span` is the analytics aggregation interval `frequency` is how often the data is queried via the datafeed `query_delay` is the total offset (from "now") ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/953ca8c39df8e3ebc91fd383a93211546914aef0.jpeg) In other words, having a `query_delay` of `1d` doesn't make the query more expensive or the time range bigger. It is purely a lag behind real-time. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 31, 2020, 12:39pm UTC](https://discuss.elastic.co/t/are-these-values-right-for-query-delay-frequency-and-bucket-span/239498/5 "2020-07-31T12:39:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.