Anomaly alert timeline explained

An anomaly alert will always have the following events:

1. Alert started (=1 event)

2. Alert updated (>=0 events)

3. Alert closed (=1 event)

For instance, we can have an initial anomaly alert started with timestamp 2024-01-04T03:55:00Z and only HeapMemoryUsage is affected. At 2024-01-04T04:30:00Z there is an anomaly alert update, that now also includes AverageExecutionTime. At 2024-01-04T04:47:00Z there is an anomaly alert closed, meaning that both metrics are back within their normal ranges and the alert is ended.

All alerts will contain fields for started timestamp and last updated timestamp (updates can also include closed timestamp as it is an update)

We recommend that you use both the from / to parameters when you check for anomaly alerts with the Eyer - Partner Connector. Depending on the alert timeline and the time range of the query, the response can return different responses as seen below.

Open