# Conflicting data between Index Dashboard and ML anomaly detection job

**URL:** <https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [January 15, 2021, 4:19pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282 "2021-01-15T16:19:55Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![emad101](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emad101/32/82338_2.png) [@emad101](https://discuss.elastic.co/u/emad101)\
**Post date:** [January 15, 2021, 4:19pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282/1 "2021-01-15T16:19:55Z")

</div>

Hello All,  
I am trying to create a watcher to detect a high volume of error records. When I check through the index it shows that there are no Data for Dec 20th and Jan 10th, however, the watcher detected that there are anomalies on Dec 20th and Jan 20th. Both of them have the same Json query

This is from the index data

 ![Screen Shot 2021-01-15 at 11.11.56 AM](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f18fcb0acc188e4c9bbf8baae3875fc08786f498.png)

And this is from the Anomaly Job

 ![Screen Shot 2021-01-15 at 11.14.01 AM](https://us1.discourse-cdn.com/elastic/original/3X/a/8/a8ba468c45f57927c71dd42f91c3e1974d554e4f.png)

I am checking for a high count, is there anything that I am missing that gives the contradictory data?

Thank you

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [January 15, 2021, 6:27pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282/2 "2021-01-15T18:27:02Z")

</div>

Is your first screen shot using discover to view the data for that time range? What index pattern are you viewing in discover? Is your anomaly detection job using the same index pattern? How is your anomaly detection job configured?

---

<div class="post-metadata">

**Author:** ![emad101](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emad101/32/82338_2.png) [@emad101](https://discuss.elastic.co/u/emad101)\
**Post date:** [January 15, 2021, 6:55pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282/3 "2021-01-15T18:55:23Z")

</div>

@Nathan_Reese Yes, both of them use the same index. I am using the single metric with distinct count field,  
both of the discorvery tab and anonoly job have the same JSON query

```auto
      {
      "bool": {
        "must": [
          {
            "term": {
              "@source_host": "host"
            }
          },
          {
            "term": {
              "app.code": "app"
            }
          },
          {
            "bool": {
              "should": [
                {
                  "wildcard": {
                    "@message": "*Error*"
                  }
                },
                {
                  "wildcard": {
                    "@message": "*Caused*"
                  }
                },
                {
                  "wildcard": {
                    "@message": "*failure*"
                  }
                },
                {
                  "wildcard": {
                    "@message": "*exception*"
                  }
                },
                {
                  "wildcard": {
                    "@message": "*bad request*"
                  }
                }
              ]
            }
          }
        ]
      }

```

---

<div class="post-metadata">

**Author:** ![grabowskit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grabowskit/32/28977_2.png) [@grabowskit](https://discuss.elastic.co/u/grabowskit)\
**Post date:** [January 15, 2021, 9:00pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282/4 "2021-01-15T21:00:26Z")

</div>

The Actual and Typical counts from the ML anomalies data do not look like they come from the same data set as your Discover screenshot. Could you send the full screen shot of Single Metric Viewer with the Chart and Anomaly records? And include the ML Job configuration detail too?

---

<div class="post-metadata">

**Author:** ![emad101](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emad101/32/82338_2.png) [@emad101](https://discuss.elastic.co/u/emad101)\
**Post date:** [January 18, 2021, 6:20pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282/5 "2021-01-18T18:20:49Z")

</div>

Hello @grabowskit,  
I cleared cache, and now it gives more reasonable data and there are no anomalies, However, if I check at the data from the single metric viewer and the discovery board, it still gives me conflicting data.

This is from the discovery board that says there are 4 counts on Jan 4th

 ![Screen Shot 2021-01-18 at 1.14.28 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/2/0216659f8f14fba582534bf16727f8fcc58d5eec.png)

And this is from the single metric view which states that there are 17 counts on Jan 4th

 ![Screen Shot 2021-01-18 at 1.19.11 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/4/84ca0de342493509b2ee19c02f1e88f32b35d1d5.png)

Maybe there something in the settings that I am missing? for the anomaly job it is set for 1d

Here is the job config

 ![Screen Shot 2021-01-18 at 1.21.49 PM](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f27dcf683c04fd10a22cc4c76901d06dbbc712c.png)

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [January 19, 2021, 1:56pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282/6 "2021-01-19T13:56:34Z")

</div>

There are a couple of things I can think of that might cause this discrepancy:

1. Your ML detector is `distinct_count`, but your kibana Discover is showing the raw count of docs that match a query. Those aren't necessarily the same.
2. The query used in kibana Discover may not be exactly the same one you're using for the ML job's datafeed
3. You chose a `bucket_span` of `1d`. This is an unfortunate choice for one specific reason - that when bucketizing the data to a day, ML will ALWAYS choose the start and end of the day to be midnight UTC timezone - not YOUR timezone. So, if you are UTC-5hrs for example, your kibana will think that you are looking at midnight-to-midnight, but you are really looking at 7pm-7pm UTC. Therefore, ML's notion of a day is different than yours and therefore the counts could be different, per day.

---

<div class="post-metadata">

**Author:** ![emad101](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emad101/32/82338_2.png) [@emad101](https://discuss.elastic.co/u/emad101)\
**Post date:** [January 19, 2021, 2:45pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282/7 "2021-01-19T14:45:06Z")

</div>

Changing the bucket\_span from 1d to 1h seems to fix the issue. Thank you for your help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2021, 2:45pm UTC](https://discuss.elastic.co/t/conflicting-data-between-index-dashboard-and-ml-anomaly-detection-job/261282/8 "2021-02-16T14:45:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.