Outlier Detection

Example alert

Exact wording varies — the detector generates titles from the anomaly it finds. This is representative of what an alert looks like when it fires.

How it works

Builds a multi-dimensional feature profile per service from structured log fields (status codes, latencies, sizes). Isolation forest scoring identifies requests that are rare across multiple dimensions simultaneously. Learning period: 7 days.

Availability

Runs on these tiers:

Related detectors

• Volume Anomaly

  Detects spikes, drops, and flatlines in log volume vs daily and weekly baselines per service.

• Silence Detection

  Catches services that stop logging when they normally log every N seconds. The most dangerous failure mode: no errors, just absence.

• Error Rate Anomaly

  Per-service error percentage anomalies vs baseline, with sustained-elevation guards so a single noisy minute doesn't fire and slow ramps still get caught.

• Recurring Pattern Detection

  Identifies log patterns that recur on a schedule — daily batch jobs, hourly cron runs, weekly reports — and flags when one fails to fire on its expected cadence.