# Weakly repetitive pattern and real-time alert **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-machine-learning\ **Created:** [April 23, 2018, 10:14pm UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190 "2018-04-23T22:14:24Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rbeg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rbeg/32/56818_2.png) [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Post date:** [April 23, 2018, 10:14pm UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190/1 "2018-04-23T22:14:25Z")
Hello, I have Weekly repetitive pattern. Each Monday, Tuesday, Wednesday, Thursday and Friday, pattern is sensibly the same : count data is growing at 8am, decrease at 12, growing at 2 pm and finally decrease at 6pm. during the night, count data is null. On theses days, pattern look like a camel, with 2 bumps. Each saturday and sunday, data count is null, pattern look like country skyline. Finally, each week I have 5 camels and 2 country skylines. What value should I put in bucket span of a multi-metrics jobs to detect anomaly ? For exemple, there is obvious anomaly if on Monday there is no data like saturday, or if pattern don't look like camel with 2 bumps but dromedary with 1 bump. What value should I put in bucket span : 5 minutes, 15 minutes, 30 minutes, 1 hour, 2 hours, ..., 6 hours, 7 hours, 12 hours, 13 hours, ... 24 hours, ... ? I have lot of data, every second. If I put 5 hours in bucket span, is it possible to get email alert in real time when data count anormally decrease / increase or must I wait 5 hours, that is not very responsive ? Thanks ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [April 23, 2018, 10:51pm UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190/2 "2018-04-23T22:51:54Z")
This blog explains bucket\_span with respect to analysis and alerting: > **[Bucket Spans for Elasticsearch and Machine Learning](https://www.elastic.co/blog/explaining-the-bucket-span-in-machine-learning-for-elasticsearch)** > > How do I select the right bucket span for a machine learning analysis for an anomaly detection job on my Elasticsearch data? ---
**Author:** ![rbeg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rbeg/32/56818_2.png) [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Post date:** [April 23, 2018, 11:06pm UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190/3 "2018-04-23T23:06:01Z")
Thank you. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [April 23, 2018, 11:07pm UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190/4 "2018-04-23T23:07:30Z")
In general, if you want to have time-based behaviors modeled correctly, you'd choose a bucket\_span that is less than the duration of pattern. So, if from hour-to-hour, the behavior changes, then having a bucket\_span of 5 hours will "smooth out" those behaviors (and you won't be able to see the nuances of it). So, likely a choice of 5m,10m,15m would be more sensible, especially if you say that the ultimate granularity of your data is 1s (in that way, you don't run the risk of having sparse buckets) ---
**Author:** ![rbeg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rbeg/32/56818_2.png) [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Post date:** [April 24, 2018, 1:24am UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190/5 "2018-04-24T01:24:42Z")
With 5m, 10m, 15m, 30m machine learning don't detect when Saturday or Sunday pattern abnormally look like Monday, Tuesday, Wednesday, Thursday or Friday pattern. I need to put 3 hours or 6 hours bucket span for that. That is too long for me to alert real time error... ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [April 24, 2018, 1:40am UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190/6 "2018-04-24T01:40:00Z")
It will take 3+ weeks of historical data to recognize the weekend pattern. Have you run that much data through yet? Can you post a screenshot of the Single Metric Viewer UI for your job? ---
**Author:** ![rbeg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rbeg/32/56818_2.png) [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Post date:** [April 24, 2018, 1:48am UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190/7 "2018-04-24T01:48:01Z")
Perfect answer. I just have 3 weeks data... Thank you. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 30, 2018, 10:21pm UTC](https://discuss.elastic.co/t/weakly-repetitive-pattern-and-real-time-alert/129190/8 "2018-10-30T22:21:32Z")