# Machine learning "actual" value doesn't match values displayed in a vizualization **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-machine-learning\ **Created:** [December 15, 2020, 1:08am UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658 "2020-12-15T01:08:57Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Post date:** [December 15, 2020, 1:08am UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/1 "2020-12-15T01:08:57Z")
In amonaly detection I get an actual value of "75.0" when I go to a visualization of the raw data I cant find that actual value, I was thinking that maybe the agregation was blurring the value, but I choose a smaller interval in the visualization to get the raw data and still is far from the actual, the max value shown in the visualization is 35 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4dc381e4b01ce3699d431638cefa3ff69053c03d.png) the visualization is TSVB and is using percent format, the actual value in the watcher is multiplied by 100 ```auto "actual_per": { "script": { "lang": "painless", "source": """(doc["actual"].value) * 100""" } }, ``` Cant find the value in discover too ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d7a17a0b7c4246aba24f4d033abcf41bbc72781e.png) values over 0.7 are from november and I got the alert with timestamp "2020-12-04T12:30:00.000Z" another weird thing is that when I click on the link of the watcher mail to go to the anomaly explorer, it doesnt match the top records that comes in the mail ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e0eb82cefa93f4f151e5dcd338d9f030a3d5c1c.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/6/26cd82406a3214ab574aaf89f96d9fc99e090522.png) ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [December 15, 2020, 11:32am UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/2 "2020-12-15T11:32:14Z")
I cannot tell from your screenshots where you've confirmed that Anomaly Detection tells you that the actual value is `75.0`. Can you please find the record in `.ml-anomalies-*`that shows the `actual` value of `75.0` and share that here. ---
**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Post date:** [December 15, 2020, 1:53pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/3 "2020-12-15T13:53:14Z")
Hi Rich, Thats one of the problems the actual value is not there when I search for it on Discover, but when execute the watch I get the value 0.75 which later in the script I tranform to 75 multiplying it by 100 ![Sin título](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7bedd6d6802b84abb34cf0b18b824e1fca6d4d06.png) the watcher is set to look for anomalies in 30d, for testing...that should be a problem right? version 7.8 of elastic ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [December 15, 2020, 2:29pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/4 "2020-12-15T14:29:12Z")
The timestamp of 1606115700 is from November 23rd, not Dec 4th as you're showing in Discover. ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/0/3087fd39de3bc7b2dc7dc171701328cd6e081424.png) Are you sure you're looking back that far in Discover? Also keep in mind that `timestamp` is in GMT and you may need to adjust for your timezone given that by default Kibana will show you times in your local time zone. ---
**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Post date:** [December 15, 2020, 2:54pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/5 "2020-12-15T14:54:36Z")
Thanks for your answer Rich, but I dont understand, that is the range that the query returns in the bucket result, that should be the range on where the bucket anomaly was found, or Im wrong? ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1e5f4c0f64110abc69bf0e885316cdb2f3d154a1.png) ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [December 15, 2020, 3:25pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/6 "2020-12-15T15:25:37Z")
All that I was saying is that you showed me a screenshot of the `.ml-anomalies-*` index and it showed a record from Nov 23rd. Your screenshot of Discover showed Dec 4th. These are obviously two different dates and I wanted to make sure you realized that if you were looking for this specific anomaly record that you had the wrong date. In your latest screenshot, you're showing a bucket result (`result_type:bucket`) with a timestamp of `1607085000` which corresponds to Friday, December 4, 2020 12:30:00 PM GMT, but bucket results don't list `actual` values, only `result_type:record` results do. You now have me confused. ---
**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Post date:** [December 15, 2020, 4:19pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/7 "2020-12-15T16:19:03Z")
Sorry Rich, English is not my native language -Yes, the only actual value, in the last 30 days, equal to 0.75 is from Nov 23 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/765048c1f6f1bd8bdb62f0bf851dbcc731c3e9e1.png) -the range on the watcher is 30 days ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/6/06071c5aef5bbaeced993eef59d5c70e9c131a18.png) -yes, bucket result doesnt list actual values, only results do, but the timestamp of the bucket is what defines the time showed on the mail alert ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b29f4789c814a5b504b341e34173e5f8b9af9763.png) and also set the range of time on where the bucket anomaly ocurred ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/3/23d0d4b9fdbda79c13a93b4c2689e7962bd4a7ed.png) this range is used on the link of the mail alert to show the anomalies on the anomalies explorer ```auto ,time:(from:'{{ctx.payload.aggregations.bucket_results.top_bucket_hits.hits.hits.0.fields.start.0}}',mode:absolute,to:'{{ctx.payload.aggregations.bucket_results.top_bucket_hits.hits.hits.0.fields.end.0}}') ``` If the alerted record anomaly ocurred in Nov 23, why is included in a bucket anomaly which point to December 4? ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6abdcfcd32a525eb758b8a98e1d5680229013288.png) ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [December 16, 2020, 12:27pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/8 "2020-12-16T12:27:09Z")
I think I would need to see your entire Watcher configuration to know exactly what you're attempting to do, but I would _think_ that putting in a range query for the last 30 days is not philosophically compatible with real-time alerting. Why look back so far in time? Normally, you'd run the Watch every X minutes and look back in time roughly for a similar span of time (i.e. about X minutes as well, to avoid picking up the same alert conditions over and over again). Setting the frequency of the Watch execution with respect to the look-back window of time is a little trickier with ML job results because of the fact that ML job results are written with a timestamp resolution of `bucket_span` and the value of the `timestamp` is the leading edge of the bucket. Therefore, there's a general rule that the look-back window of the watch should be about `2*bucket_span` of the ML job so that no results are missed. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 13, 2021, 12:27pm UTC](https://discuss.elastic.co/t/machine-learning-actual-value-doesnt-match-values-displayed-in-a-vizualization/258658/9 "2021-01-13T12:27:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.