# Find sequences in time series data

**URL:** <https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965>\
**Category:** Elasticsearch\
**Created:** [March 11, 2021, 3:24pm UTC](https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965 "2021-03-11T15:24:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![markdturner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markdturner/32/85400_2.png) [@markdturner](https://discuss.elastic.co/u/markdturner)\
**Post date:** [March 11, 2021, 3:24pm UTC](https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965/1 "2021-03-11T15:24:05Z")

</div>

Hi,

I'm trying to find example queries for returning sequences of events in a time series. My dataset is rainfall values at 10-minute intervals, and I want to find all storm events. A storm event would be considered continuous rainfall for more than 12 hours. This would equate to 72 consecutive records with a rainfall value greater than zero. I could do this in code, but to do so I'd have to page through thousands of records so I'm hoping for a query-based solution.

I'm working in a University research group, so any solutions that involve premium tier licences are probably out due to budget.

Thanks!

---

<div class="post-metadata">

**Author:** ![markdturner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markdturner/32/85400_2.png) [@markdturner](https://discuss.elastic.co/u/markdturner)\
**Post date:** [March 12, 2021, 1:43pm UTC](https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965/2 "2021-03-12T13:43:36Z")

</div>

I've discovered EQL is what I need and have this query

```auto
GET /rabt-rainfall-*/_eql/search
{
  "timestamp_field": "@timestamp",
  "event_category_field": "type",
  "size": 100,
  "query": """
    sequence
      [rainfall where `rain-last-10-mins` > 0]
      [rainfall where `rain-last-10-mins` > 0]
    until [rainfall where `rain-last-10-mins` == 0]
  """
}

```

This returns results but only of length 2, I need to adapt it to find arbitrary sequences when the rainfall value is above zero.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2021, 1:44pm UTC](https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965/3 "2021-04-09T13:44:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.