# Moving average values differ in elasticsearch and Kibana
**URL:** https://discuss.elastic.co/t/moving-average-values-differ-in-elasticsearch-and-kibana/81012
**Category:** Kibana
**Created:** [April 3, 2017, 2:14pm UTC](https://discuss.elastic.co/t/moving-average-values-differ-in-elasticsearch-and-kibana/81012 "2017-04-03T14:14:47Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Sureya](https://discuss.elastic.co/u/Sureya)
#### Post date: [April 3, 2017, 2:14pm UTC](https://discuss.elastic.co/t/moving-average-values-differ-in-elasticsearch-and-kibana/81012/1 "2017-04-03T14:14:47Z")
I am using Kibana to visualise a POC on monitoring total transactions occurred and compares it with moving average of window 10, to raise alerts.
My alerting code is in Python which queries elastic search (using index name) and redirects users to Kibana to visualise the change in trend. I see that Moving average values calculated in Kibana differs from the moving average values I from elastic search queries. As a consequence, our alerting system alerts for an anomaly but visualisation isn't plotting it as errors.
Can someone please explain how I can sync both moving average values !?
---
### Author:  [@simianhacker](https://discuss.elastic.co/u/simianhacker)
#### Post date: [April 3, 2017, 8:06pm UTC](https://discuss.elastic.co/t/moving-average-values-differ-in-elasticsearch-and-kibana/81012/2 "2017-04-03T20:06:00Z")
What are you using to visualize the moving average? Timelion?
---
### Author:  [@simianhacker](https://discuss.elastic.co/u/simianhacker)
#### Post date: [April 3, 2017, 8:12pm UTC](https://discuss.elastic.co/t/moving-average-values-differ-in-elasticsearch-and-kibana/81012/3 "2017-04-03T20:12:18Z")
The other thought I just had come to mind is what is the interval you're using in Kibana vs. Elasticsearch? Window will be the number of buckets the interval creates. So a window of 10 on a 1 hour chart with 10 second interval will give you a different result then a window of 10 on a 24 hour chart with a 1 hour interval.
---
### Author:  [@Sureya](https://discuss.elastic.co/u/Sureya)
#### Post date: [April 4, 2017, 9:26am UTC](https://discuss.elastic.co/t/moving-average-values-differ-in-elasticsearch-and-kibana/81012/4 "2017-04-04T09:26:42Z")
Sorry for the confusion. Yes the Visualization is in Timelion in Kibana
In Both Timelion and in Elastic search queries the data is aggregated over 2 mins , data considered is past 24 hrs of data
Timelion formula
> .es(index="local-live\_data",timefield="created\_at",metric="count:created\_at",q="event\_type=event.started\_transaction").color("green"),.es(index="local-live\_data",timefield="created\_at",metric="count:created\_at",q="event\_type=event.started\_transaction").movingaverage(10).sum(15).color("red"),.es(index="local-live\_data",timefield="created\_at",metric="count:created\_at",q="event\_type=event.started\_transaction").movingaverage(10).subtract(15).color("red")
ES query
> GET local-live\_data/\_search
> {
> "size": 0,
> "query":{
> "bool":{
> "must":[
> {
> "range":{
> "created\_at":{
> "gte":"now-24h",
> "lte": "now"
> }
> }
> },
> {
> "match":{
> "event\_type":"event.started\_transaction"
> }
> }
> ]
> }
> },
> "aggs":{
> "my\_date\_histo":{
> "date\_histogram":{
> "field":"created\_at",
> "interval":"2m",
> "time\_zone": "Europe/London"
> },
> "aggs":{
> "the\_count":{
> "value\_count": {
> "field": "created\_at"
> }
> },
> "the\_movavg":{
> "moving\_avg":{
> "buckets\_path":"the\_count",
> "window":10
> }
> },
> "final\_filter":{
> "bucket\_selector":{
> "buckets\_path":{
> "TheCount":"the\_count",
> "TheMovAvg":"the\_movavg"
> },
> "script": "params.TheCount \> (params.TheMovAvg == null ? 0 : params.TheMovAvg)+15 || params.TheCount \< (params.TheMovAvg == null ? 0 : params.TheMovAvg)-15 "
> }
> }
> }
> }
> }
> }
>
> 
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 2, 2017, 9:26am UTC](https://discuss.elastic.co/t/moving-average-values-differ-in-elasticsearch-and-kibana/81012/5 "2017-05-02T09:26:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.