# No anomalies on live data **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-machine-learning\ **Created:** [September 20, 2018, 10:34am UTC](https://discuss.elastic.co/t/no-anomalies-on-live-data/149272 "2018-09-20T10:34:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![vinay\_2498](https://avatars.discourse-cdn.com/v4/letter/v/d78d45/32.png) [@vinay\_2498](https://discuss.elastic.co/u/vinay_2498)\ **Post date:** [September 20, 2018, 10:34am UTC](https://discuss.elastic.co/t/no-anomalies-on-live-data/149272/1 "2018-09-20T10:34:27Z")
Hi, The machine learning advance job of detecting anomalies in the network data is trained with two months of data. But when I test the model with real-time live data I can see the spike on the graph but no anomalies are detected, where as the anomaly points can be seen on trained data. ![P_20180920_155614-01](https://us1.discourse-cdn.com/elastic/original/3X/a/e/aef68a72dc8e79b9ba9f4d389f0d437664d2ac0e.jpeg) Thanks. ---
**Author:** ![dmitri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmitri/32/17997_2.png) [@dmitri](https://discuss.elastic.co/u/dmitri)\ **Post date:** [September 20, 2018, 12:22pm UTC](https://discuss.elastic.co/t/no-anomalies-on-live-data/149272/2 "2018-09-20T12:22:28Z")
Could you please mention the version you are using? ---
**Author:** ![vinay\_2498](https://avatars.discourse-cdn.com/v4/letter/v/d78d45/32.png) [@vinay\_2498](https://discuss.elastic.co/u/vinay_2498)\ **Post date:** [September 20, 2018, 12:43pm UTC](https://discuss.elastic.co/t/no-anomalies-on-live-data/149272/3 "2018-09-20T12:43:38Z")
Hi, I have kibana 6.3.2 version. I found that this problem is with less amount of trained data, but I have trained the model with 800k records. ---
**Author:** ![dmitri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmitri/32/17997_2.png) [@dmitri](https://discuss.elastic.co/u/dmitri)\ **Post date:** [September 20, 2018, 1:20pm UTC](https://discuss.elastic.co/t/no-anomalies-on-live-data/149272/4 "2018-09-20T13:20:07Z")
The most probable explanation is that the datafeed advances that time interval before the data is available for search. To verify this use the [get-buckets API](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/ml-get-bucket.html) for the interval where you have the big spike and check the `event_count`. Could you post the outcome of this? ---
**Author:** ![vinay\_2498](https://avatars.discourse-cdn.com/v4/letter/v/d78d45/32.png) [@vinay\_2498](https://discuss.elastic.co/u/vinay_2498)\ **Post date:** [September 21, 2018, 6:54am UTC](https://discuss.elastic.co/t/no-anomalies-on-live-data/149272/5 "2018-09-21T06:54:49Z")
The output I am getting for get\_bucket\_api is { "Count":0, "Buckets":[] } ---
**Author:** ![dmitri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmitri/32/17997_2.png) [@dmitri](https://discuss.elastic.co/u/dmitri)\ **Post date:** [September 21, 2018, 9:26am UTC](https://discuss.elastic.co/t/no-anomalies-on-live-data/149272/6 "2018-09-21T09:26:04Z")
Hi Vinay, Machine Learning results have `buckets` at the top level. A bucket is written out for each interval that equals the configured `bucket_span`. Buckets are written out regardless of whether there were any anomalies in them. Based on your screenshot above, the number of buckets should definitely be non-zero. If you try the request without any additional parameters, e.g.: ```auto GET _xpack/ml/anomaly_detectors/{job_id}/results/buckets ``` you should get a count that is non-zero. For debugging the issue you experience, you could use ```auto GET _xpack/ml/anomaly_detectors/{job_id}/results/buckets?start={time_before_big_spike} ``` where {time\_before\_big\_spike} should be in format, say: "2018-09-20T00:00:00Z". If that returns you `0` buckets, then it suggests that the datafeed did not actually run up to that point in time. For completeness, it would help if you also posted the job configuration (paste the JSON you see in the JSON tab for the job in question) and the job messages (as they help understand what was the operational timeline). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 19, 2018, 9:26am UTC](https://discuss.elastic.co/t/no-anomalies-on-live-data/149272/7 "2018-10-19T09:26:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.