Skip to content
Start free

Learn what normal looks like, and flag what is not

Anomaly jobs learn the usual range of each series, with daily or weekly seasonality, and score what falls outside it from 0 to 100. Metric jobs alert through your notification policies, while rare values, new log patterns and outliers become signals to investigate.

Start freeBook a demoRead the alerting docs
  • Scores 0 to 100
  • Daily or weekly seasonality
  • 30-day backtests

How it works

From a series to a score you can act on

Every workspace runs its own anomaly worker. Nothing is watched until you create a job or enable one from the catalog.

  1. 01ChoosePick a job type and a data source, or enable a catalog job for a signal you already collect.
  2. 02ShapeSet the function, the split per service or host, the bucket span and seasonality, or draft it with AI.
  3. 03BacktestSee what the job would have flagged over the last 7 days, or up to 30, before you save it.
  4. 04LearnThe first run backfills up to 90 days of history, 14 by default, then scores each completed bucket.
  5. 05ScoreEach anomaly gets a score from 0 to 100, a kind, and the reasons it was flagged.
  6. 06AlertMetric jobs alert through a linked monitor; other job types raise signals to investigate.

Job types

Five kinds of job, from one metric to the whole fleet

A metric job learns a baseline per series and can page. Rare-value, population, log-pattern and fleet-outlier jobs find leads: the value that never shows up, the host unlike its peers, the log line nobody has seen before.

  • Seasonality is detected for you, or set to daily, weekly or off
  • Count, rate, sum, mean, minimum, maximum, percentiles or distinct values, watched high, low or both ways
  • 36 catalog jobs cover logs, traces, real users, hosts, Kubernetes, network devices, CI pipelines and synthetic checks

Alerting

Alerts only when an anomaly lasts, and matters

Each job owns a linked monitor. A metric job alerts when its series stays far enough from expected for long enough, and recovers only on evidence, so a gap in the data never closes an alert.

  • Sustained, not single spikes

    By default, 2 of the latest 3 buckets must score 75 or more.

  • Honest recovery

    Three healthy buckets recover it; missing data never counts.

  • Signals, not pages

    Rare values, log patterns and outliers are info signals that never notify.

  • Same routing

    Job tags carry to the linked monitor, so your policies decide where it goes.

Explorer

Why it was flagged, and what changed nearby

The explorer shows what is unusual right now, where and since when, across every enabled job. Open a record to see its actual and typical values, the reasons behind the score, and the anomalies and changes around it.

  • Kinds say what happened: a spike, a sustained move, a slow drift, a new or rare value, or an outlier
  • Changes in the same window sit beside the anomalies they may explain
  • Mute a noisy entity for 1, 4 or 24 hours without touching the job

Better together

Anomalies in the same flow as every other alert

Anomaly alerts use the same monitors, routing and problems as the rest of your alerting, so a learned baseline and a fixed threshold can page the same team.

FAQ

Questions teams ask before trusting a model

Talk to an engineer
Does anomaly detection run without setup?
No. Nothing is watched until you create a job or enable one from the catalog, so you choose which series are scored and which ones may page.
Can it forecast when a disk will fill?
Not yet. Jobs score what happened against what was expected; there is no forecasting today.
Does it catch a step change in a metric?
Partly. Jobs flag sustained moves, where several buckets in a row go the same way, and slow drifts over hours, but they have no dedicated step-change detector. For services, the APM service page marks level shifts in error rate, p95 latency and throughput.
How many series can one job watch?
Up to 1,000 by default and 10,000 at most. Series beyond the limit are not scored, so split a large job by service or host.

Turn on your first anomaly job

Enable a catalog job for a signal you already collect, backtest it, and save it with its linked monitor.

Start freeRead the guide