# Setup a Machine Learning rule is not active **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [May 15, 2025, 10:14am UTC](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170 "2025-05-15T10:14:31Z")\ **Posts on this page:** 6\ **Page:** 2
**Author:** ![nzeland149](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nzeland149/32/143060_2.png) [@nzeland149](https://discuss.elastic.co/u/nzeland149)\ **Post date:** [May 21, 2025, 8:48am UTC](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170/21 "2025-05-21T08:48:01Z")
> [@stephenb](#): > > Can you clearly define the use case, because you might want to use another approach all together but I am not even clear on your use case. > > Can you clearly define the use case? in detail? i m using packetbeat to collect data with port mirroiung and i want to be alerted if there is any anomalie or attack or so,mething that the goal u have any other suggestion better than ml here and thank u and im sorry ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [May 21, 2025, 3:45pm UTC](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170/22 "2025-05-21T15:45:16Z")
> [@nzeland149](#): > > why it should be a fraction because you want a round number of collection intervals per bucket\_span. In your case, you have 2 collection intervals if your `frequency` is `7.5m`. If your `frequency` were `5m`, you'd have 3 intervals. If your `frequency` were `3m` you'd have 5 intervals. If your `frequency` were `1m` you'd have 15 intervals per 15-minute bucket\_span. The more intervals you have, the more close to "real-time" you can get. You should also know that the `query_delay` parameter also affects how far behind real-time the ML job runs. Usually, you need 1-2 minutes so that you give time for the data to be there and "findable" in Elasticsearch before ML tries to analyze it. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 22, 2025, 3:24am UTC](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170/23 "2025-05-22T03:24:20Z")
@richcollier Question The frequency will help with the Max or Sum etc aggregations , something that could be determined before the entire bucket is calculated... But for aggregation such as count you would still need entire bucket correct? ---
**Author:** ![nzeland149](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nzeland149/32/143060_2.png) [@nzeland149](https://discuss.elastic.co/u/nzeland149)\ **Post date:** [May 22, 2025, 9:47am UTC](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170/24 "2025-05-22T09:47:55Z")
> [@richcollier](#): > > `y_delay` parameter also affects how far behind real-time the ML job runs. Usually, you need 1-2 minutes so that you give time for the data to be there and "findable" in Elasticsearch before ML tries to analyze it. my query delay is 60s do u rocommended if i reduced the bucket to 5min and uinsg a frequency of 2.5min to get more closer to real time ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [May 22, 2025, 11:52am UTC](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170/25 "2025-05-22T11:52:17Z")
> [@stephenb](#): > > The frequency will help with the Max or Sum etc aggregations , something that could be determined before the entire bucket is calculated... But for aggregation such as count you would still need entire bucket correct? No, you don't need the entire bucket if you're using `count`. For example, the model may say that the typical count of events during that 15m interval is 200 events but in the first 5 minutes (assuming you've set `frequency` to `5m`) you get 10,000 events - you already know that the bucket is going to be anomalous regardless of what happens in the remaining 10 minutes of the bucket. However, if the detector function was `mean`, for example, you must wait for the entire bucket's worth of data before calculating the mean. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [May 22, 2025, 2:03pm UTC](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170/26 "2025-05-22T14:03:26Z")
> [@nzeland149](#): > > do u rocommended if i reduced the bucket to 5min and uinsg a frequency of 2.5min to get more closer to real time Not necessarily. Remember that the choice for `bucket_span` should be tied to "the duration of the anomaly that you care about". What I mean by that is - whatever you're trying to detect... the count of errors in a bucket of time, the value of a field, whatever....you should choose your bucket span based on whether or not the detection lasting for the duration of the bucket\_span is meaningful to you or not (i.e. "it was anomalous for only 2 minutes and that's insignificant to me, but if was anomalous for 15 minutes, I'd care" \<---therefore a `2m` `bucket_span` is too small). So, choose your `bucket_span` according to this philosophy, then choose a `frequency` such that you can hope to detect the situation as soon as possible. [Previous page](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170.md?page=1)