# What is Query delay and bucket span

**URL:** <https://discuss.elastic.co/t/what-is-query-delay-and-bucket-span/340886>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [August 16, 2023, 8:35am UTC](https://discuss.elastic.co/t/what-is-query-delay-and-bucket-span/340886 "2023-08-16T08:35:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [August 16, 2023, 8:35am UTC](https://discuss.elastic.co/t/what-is-query-delay-and-bucket-span/340886/1 "2023-08-16T08:35:52Z")

</div>

Hi Team

We are running two jobs of anomaly detection where for one job we are using 10 min of bucket span and for second one we are using 1 hour bucket span. Query delay is same for both jobs i.e. default value.

For both jobs i was getting data latency warning so i changed for one job to look the difference.

Is there any relation between bucket span and Query Delay ?

---

<div class="post-metadata">

**Author:** ![valeriy42](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/valeriy42/32/82758_2.png) [@valeriy42](https://discuss.elastic.co/u/valeriy42)\
**Post date:** [August 21, 2023, 7:26am UTC](https://discuss.elastic.co/t/what-is-query-delay-and-bucket-span/340886/2 "2023-08-21T07:26:21Z")

</div>

Hello @Aniket_Pant ,

The primary motivation for query delay is to [handle delayed data](https://www.elastic.co/guide/en/machine-learning/current/ml-delayed-data-detection.html).

To figure out the correct query delay value for your anomaly jobs, do the following:

1. Create a `date_histogram` aggregation for the last 24 hours, using the `bucket_span` value as `fixed_interval`.
2. Run this aggregation several times with different delays. For instance, if your bucket span is 10m, you can run the aggregation once, then after 10 minutes, after 20 minutes, etc.
3. Look at the `doc_count`s of the results for the same time intervals.
4. Once the `doc_counts`s for the overlapping histogram buckets no longer change, this gives you the effective `query_delay` parameter.

Alternatively, if both event time and ingest time for your data are available, you can look at the difference between those to figure out the correct query delay value.

You can also calculate ingest lag as described in [this article](https://www.elastic.co/blog/calculating-ingest-lag-and-storing-ingest-time-in-elasticsearch-to-improve-observability). This will indicate the query delay you need to set.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2023, 7:26am UTC](https://discuss.elastic.co/t/what-is-query-delay-and-bucket-span/340886/3 "2023-09-18T07:26:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.