Skip to content

Commit 9e281d6

Browse files
authored
[DOCS] Adds important admonition to handling delayed data page (#97753) (#97805)
1 parent 7136a06 commit 9e281d6

File tree

2 files changed

+7
-1
lines changed

2 files changed

+7
-1
lines changed

docs/reference/ml/anomaly-detection/ml-delayed-data-detection.asciidoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ if it is set too high, analysis drifts farther away from real-time. The balance
1616
that is struck depends upon each use case and the environmental factors of the
1717
cluster.
1818

19+
IMPORTANT: If you get an error that says
20+
`Datafeed missed XXXX documents due to ingest latency`, consider increasing
21+
the value of `query_delay'. If it doesn't help, investigate the ingest latency and its
22+
cause. You can do this by comparing event and ingest timestamps. High latency
23+
is often caused by bursts of ingested documents, misconfiguration of the ingest
24+
pipeline, or misalignment of system clocks.
1925
== Why worry about delayed data?
2026

2127
If data are delayed randomly (and consequently are missing from analysis), the

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/job/messages/Messages.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ public final class Messages {
154154
public static final String JOB_AUDIT_DATAFEED_NO_DATA = "Datafeed has been retrieving no data for a while";
155155
public static final String JOB_AUDIT_DATAFEED_MISSING_DATA =
156156
"Datafeed has missed {0} documents due to ingest latency, latest bucket with missing data is [{1}]."
157-
+ " Consider increasing query_delay";
157+
+ " Consider increasing query_delay and investigate the cause of high latency in your ingestion process.";
158158
public static final String JOB_AUDIT_DATAFEED_RECOVERED = "Datafeed has recovered data extraction and analysis";
159159
public static final String JOB_AUDIT_DATAFEED_STARTED_FROM_TO = "Datafeed started (from: {0} to: {1}) with frequency [{2}]";
160160
public static final String JOB_AUDIT_DATAFEED_STARTED_REALTIME = "Datafeed started in real-time";

0 commit comments

Comments
 (0)