# What is the Machine learning algorithm in Elastic? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-machine-learning\ **Created:** [March 12, 2018, 10:31am UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527 "2018-03-12T10:31:33Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![NOUR](https://avatars.discourse-cdn.com/v4/letter/n/df788c/32.png) [@NOUR](https://discuss.elastic.co/u/NOUR)\ **Post date:** [March 12, 2018, 10:31am UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527/1 "2018-03-12T10:31:33Z")
Hello world, I'm using kibana 6.2.2 and elastic 6.2.2 for my final academic project. I prepared some analyses using ml plugin under x-pack like this ![1](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e68be287a9f1ce9fd280a9b5cde29b4bd56d81a1.PNG) But i still confused about the algorithm using in background. why there are some empty squares even when i looked into the data i found values.. for example the second line ![3](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9c6ca9b911026076d2fcdfd3222434aea5be767.PNG) analyse the data Throughout the month of January as you see in the last picture the 9 first days are empty (no results ) but when i check if there are data during these days using line chart graph ![2](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c4eec56fb50fd941392bd37f3d0e67d333d1759e.PNG) NB: i used an average of a metric for all the graphs Please help. NOUR. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [March 15, 2018, 10:38am UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527/2 "2018-03-15T10:38:38Z")
The algorithms are a mixture of techniques, including: - Clustering - Various types of time series decomposition - Bayesian distribution modeling - Correlation analysis The "empty" squares do not mean there was no data to be analyzed. It means that the algorithms determined that the data wasn't anomalous enough at that moment in time to give it a non-zero score. To understand better what the scoring means, please refer to this blog: > **[Machine Learning Anomaly Scoring and Elasticsearch - How it Works | Elastic](https://www.elastic.co/blog/machine-learning-anomaly-scoring-elasticsearch-how-it-works)** > > We often get questions about Elastic’s Machine Learning “anomaly score” and how the various scores presented in the dashboards relate to the “unusualness” of individual occurrences within the da... ---
**Author:** ![NOUR](https://avatars.discourse-cdn.com/v4/letter/n/df788c/32.png) [@NOUR](https://discuss.elastic.co/u/NOUR)\ **Post date:** [March 15, 2018, 3:45pm UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527/3 "2018-03-15T15:45:59Z")
Thank you @richcollier for you answer ! I have a look at your blog , it is very interesting and useful 😃 But, i can't understand why some values are considered anomalies and other not even when i compare the two anomaly scores , there is a clear anomaly here an exemple: ![4](https://us1.discourse-cdn.com/elastic/original/3X/6/3/632373bb48f43808fb4ec83f31cb1d2e4257a957.PNG) the graph show an anomaly the February 1st 2018 at 10:00 am but there are many others anomalies (with a higher value than the red anomaly) but the color is just blue Please help, NOUR. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [March 15, 2018, 7:12pm UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527/4 "2018-03-15T19:12:38Z")
Nour, You need to think about how this data is presented to ML - in chronological order. The first time the big spike is seen, it is flagged as a red anomaly because it's the "worst thing" that's been seen so far. However, as time goes on ML sees that spikes of that magnitude are actually not that unexpected. They happen quite frequently after all. Therefore, ML chooses to score those subsequent anomalies with a lower score (since their probability of occurring gets higher and higher). Hope that helps ---
**Author:** ![NOUR](https://avatars.discourse-cdn.com/v4/letter/n/df788c/32.png) [@NOUR](https://discuss.elastic.co/u/NOUR)\ **Post date:** [March 16, 2018, 9:49am UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527/6 "2018-03-16T09:49:18Z")
@richcollier, thank you again for your support! i really appreciate your effort , you help me a lot from the beginning of my project 😃 Well , i understand and it is very logical. In your blog you said that "the plugin construct a baseline probability model based on the observed past behavior" which confirm exactly what you explain here... In the Bayesian distribution modeling, Which type of distribution you admet (Normal, Poisson,Binomial...)? And in the Clustering which alogorithm is used(kmeans, Mean-Shift ,DBSCAN...)? ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [March 16, 2018, 2:02pm UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527/7 "2018-03-16T14:02:35Z")
Nour, Perhaps you will find this video interesting and will answer your questions: [https://www.elastic.co/elasticon/conf/2017/sf/machine-learning-and-statistical-methods-for-time-series-analysis](https://www.elastic.co/elasticon/conf/2017/sf/machine-learning-and-statistical-methods-for-time-series-analysis) This describes some of the math(s) behind our Machine Learning ---
**Author:** ![NOUR](https://avatars.discourse-cdn.com/v4/letter/n/df788c/32.png) [@NOUR](https://discuss.elastic.co/u/NOUR)\ **Post date:** [March 16, 2018, 2:04pm UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527/8 "2018-03-16T14:04:16Z")
ok thanks a lot 😃 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2018, 2:04pm UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527/9 "2018-04-13T14:04:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.