Monitors

Configure a monitor to observe a metric at regular intervals and issue alerts when the detection rules are satisfied.

The metric transforms events into time series. The monitor follows those series and signals behaviors outside the expected range: an abnormal increase in declines, a sharp drop in transaction volume or the crossing of a manually defined threshold.

Data source

The source defines which data the monitor analyzes:

  • Metric: which metric will be observed. Cannot be changed after creation.
  • Aggregation: which calculation of the metric will be analyzed by anomaly detection. New aggregations can be created in the metric configuration.
  • Filters (optional): restricts the scope of the monitor to a subset of the events. Only the dimensions of the monitored metric can be used, with up to 10 values per filter.

Without filters, the monitor analyzes each segment of the metric separately: a metric with the status dimension produces an independent analysis for each value of that field.

Analysis interval

The interval defines how frequently the analysis runs. At each cycle, the platform evaluates the most recent value of the aggregation and checks whether the detection rules are satisfied.

The available options are the granularities at which the metric is consolidated. Changing the interval resets tracking: the next analysis restarts from the current interval.

Notifications

With a notification channel configured, the platform sends a notification whenever an alert is opened. Without a configured channel, alerts are only available in the panel.

Identification and status

  • Name: displayed in the panel and in notifications. Left blank, the monitor uses the metric name.
  • Description: internal notes from the team, such as context or motivation. Visible only in the panel.
  • Status: active or inactive. When inactive, the analysis is suspended and open alerts are closed.

Alerts

An alert is opened when the detection rules are satisfied in a measurement. With both methods enabled, the anomaly and the conditions must be satisfied at the same time. The alert remains open until the behavior returns to normal for the configured number of consecutive measurements, or until it expires by time.

When a monitor is deactivated, the platform closes all open alerts. The same occurs when the monitor is removed.

Following the execution

The monitor screen reports the state of the analysis:

  • Cardinality: approximate number of distinct segments analyzed over the last 30 days. It indicates how many series the monitor follows in parallel.
  • Last analysis and next analysis: the periods already evaluated and the next one queued.
  • Latency: delay accumulated when the analysis does not run at the expected time.

Limits

  • Maximum of 20 monitors per event type.
  • Maximum of 10 values per filter and per condition.
  • A monitor depends on an active metric: a metric in use by one or more monitors cannot be removed.

Table of contents