# Latest Timestamp Machine learning doesn't change

**URL:** <https://discuss.elastic.co/t/latest-timestamp-machine-learning-doesnt-change/267362>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [March 16, 2021, 11:57am UTC](https://discuss.elastic.co/t/latest-timestamp-machine-learning-doesnt-change/267362 "2021-03-16T11:57:42Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [March 19, 2021, 1:52pm UTC](https://discuss.elastic.co/t/latest-timestamp-machine-learning-doesnt-change/267362/6 "2021-03-19T13:52:14Z")

</div>

See this for explanations of query\_delay, frequency, and bucket\_span: [Are these values right for Query delay, Frequency and Bucket Span? - #4 by richcollier](https://discuss.elastic.co/t/are-these-values-right-for-query-delay-frequency-and-bucket-span/239498/4)

In short, query\_delay is what lags the entire job behind "real-time". If you only ingest data once per day then indeed, you will need to lag your job with a query\_delay of at least 1 day. It also matters what the bucket\_span of your job is.

Keep in mind that the anomaly detection jobs can either be running in real-time (with a delay, of course) or they could be invoked periodically (with a script that hits the [datafeed API](https://www.elastic.co/guide/en/elasticsearch/reference/7.11/ml-start-datafeed.html) with a `start` and `end` time, for example) to process previously ingested documents.

What you DON'T want is for the Anomaly Detection job to search for data in the ES index for a certain time range, but have no documents in the index because they are not ingested yet.

---

_[View the full topic](https://discuss.elastic.co/t/latest-timestamp-machine-learning-doesnt-change/267362)._