Gradient alert type

[ 1 Overview ] [ 2 What data do I need to create this alert? ] [ 3 Specific settings ] [ 4 Using field values in the Summary and Description ] [ 5 Query example ]

Overview

The gradient method triggers an alert every time an aggregated value of a grouped element varies significantly from one grouping period/set to the next. This alert type is similar in concept and execution to the deviation type; they both use deviations from values to trigger alerts, however, they differ in the value they use to calculate the deviation. In the case of the gradient type, it is from the analogous value of the previous period with data while in the deviation type, it is from the median of the values in the same period. See the following picture for a more visual explanation.

This type of alert could be useful when monitoring periodic tasks and their data patterns over time to be informed whenever an aggregated value differs too much from its analogous of the previous period with data.

What data do I need to create this alert?

To create an alert using this triggering method, your query must group events by at least one grouping key using a time-based option and add an aggregation.

If you did not group, this alert type will not appear for you to select in the alert definition window.
If you grouped without the necessary key, the alert variables will not appear and you will get the following message.

If you grouped using a no time-based option, the alert variables will not appear and you will get the following message.

If you did not aggregate, you will not have the field you need for the Add a numeric field field (see the following section) and therefore you will not be able to create the alert.

Specific settings

After selecting this type of alert, you have to define the following variables:

Threshold

This setting specifies the proportions of the deviation from the previous value, in other words, the upper and lower bound that must be exceeded for an alert to be triggered. Write the desired number.

Variation calculation (Absolute/Percentage)

This setting specifies the method to analyze, according to the designated thresholds, the value variation from one period to the next; in other words, the way in which the threshold will be considered (either as an absolute value or as a percentage). Select the desired option.
The following formulas describe the calculations performed using absolute values or percentages to check if the alert has to be triggered.

Absolute: abs(current value - previous value) > threshold
Using an absolute value means that the threshold specified will be considered as the number above and below which the alert will be triggered. For example, if the value of the previous period is 100 and the threshold specified is 50 means that an alert will be triggered if the analogous value of the next period is above 150 and below 50.
When using absolute values it is important to use a threshold that is consistent with the range of values, otherwise, you might trigger alerts constantly or hardly ever.
Percentage: abs(current value - previous value) > threshold / 100 * current value
Using a percentage means that the threshold specified will be considered as the percentage of the previous value above and below which an alert will be triggered. For example, if the previous value is 200 and the threshold specified is 25 means that an alert will be triggered if the analogous value of the next period is above 250 and below 150.

Add a numeric column

This setting specifies an aggregation field whose values will be set against the designated threshold to trigger the alert. You can choose from any of the aggregation fields added to the query but you cannot add more than one. Drag the required field into the field below or select it on the table and click the Add selected field button.
You must add one field before clicking the Create button, otherwise, you will receive error messages at the top and bottom.

Using field values in the Summary and Description

You can use the $fieldName command to display in the Summary and Description fields the field values of the events that triggered the alert. This command can be employed with the names of the fields and properties below. Using a different one will not activate the command and will be interpreted as plain text.

$eventdate
$fieldName of those resulting from grouping operations.
$fieldName of those resulting from aggregation operations.
$gradient: even though it is not the name of a field, it is a property consolidated in the alert extraData that displays the difference in value from one period to the next.

In the following query, you could use:

from demo.ecommerce.data
where statusCode = 404
group every 30m by method, timeTaken
select avg(bytesTransferred) as avgBytesTransferred

$eventdate
$method
$timeTaken
$avgBytesTransferred
$gradient

Query example

In the demo.ecommerce.data table, imagine that you want to receive an alert whenever the number of events received for client IP addresses displaying the 404 status code is 25% higher or lower than the one in the previous 30 minute-period.

First of all, you need to filter your query data using the Equal (eq, =) operation, group your query data by two keys using a time-based option and then aggregate it. Then, you need to open the alert definition window, select the gradient type alert and fill in all the details (pay special attention to the specific settings of this alert type).

To save time, you can copy the following query to reproduce the aforementioned example from the demo.ecommerce.data sample table and create a gradient type alert.

from demo.ecommerce.data
where statusCode = 404
group every 30m by clientIpAddress, statusCode
select count() as count

Related articles: