# How to write conditional statements/calculations in elastic Machine Learning

**URL:** <https://discuss.elastic.co/t/how-to-write-conditional-statements-calculations-in-elastic-machine-learning/277783>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [July 5, 2021, 7:43am UTC](https://discuss.elastic.co/t/how-to-write-conditional-statements-calculations-in-elastic-machine-learning/277783 "2021-07-05T07:43:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![laiweida](https://avatars.discourse-cdn.com/v4/letter/l/7cd45c/32.png) [@laiweida](https://discuss.elastic.co/u/laiweida)\
**Post date:** [July 5, 2021, 7:43am UTC](https://discuss.elastic.co/t/how-to-write-conditional-statements-calculations-in-elastic-machine-learning/277783/1 "2021-07-05T07:43:07Z")

</div>

How can I perform a Kibana machine learning anomaly detection job to find out anomalies in query duration. Any ideas how to perform below calculation and include it in the ML detector?  
Something like this (postgresql.activity.transaction\_start \< now() - '1 minute')

Also, Is there any possible way to use KQL in ML?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [July 6, 2021, 12:57pm UTC](https://discuss.elastic.co/t/how-to-write-conditional-statements-calculations-in-elastic-machine-learning/277783/2 "2021-07-06T12:57:51Z")

</div>

The datafeed of the anomaly detection job itself will take care of querying the data to be analyzed in accordance with time. The "[bucket\_span](https://www.elastic.co/blog/explaining-the-bucket-span-in-machine-learning-for-elasticsearch)" parameter of the job determines the time intervals that the data gets modeled and analyzed.

I assume that `postgresql.activity.transaction_start` is just a number or is it a timestamp?

It would be good to see a snippet of the document that contains this field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2021, 12:58pm UTC](https://discuss.elastic.co/t/how-to-write-conditional-statements-calculations-in-elastic-machine-learning/277783/3 "2021-08-03T12:58:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.