Alert content explained

To try out the Eyer APIs directly, see the Postman - Eyer APIs collection.

{  
    "aggregate": {  
        "active": true,  
        "activeMetrics": 1,  
        "activeNodes": 1  
    },  
    "alertId": "698c6e0f02d1c0ebcc8ac0cd",  
    "changes": [  
        {  
            "nodeId": 129,  
            "nodeName": "Process Summary Reporting Service. prd-at1",  
            "statTypeId": "f09e56d5-0ce6-50d6-b776-2f86cc3a3ec8",  
            "statTypeName": "Pending Execution Count",  
            "systemId": 5,  
            "systemName": "prd-at1",  
            "type": "added",  
            "values": {  
                "closestBaselineDeviation": 0,  
                "learningStatus": 0,  
                "score": {  
                    "adjusted": 0.5,  
                    "contribution": 1  
                },  
                "severity": {  
                    "name": "yellow",  
                    "rank": 2  
                },  
                "type": "deviation"  
            }  
        }  
    ],  
    "eventId": "698c6e0f02d1c0ebcc8ac0cd|00000001",  
    "impact": {  
        "name": "low",  
        "rank": 1  
    },  
    "learningStatus": 0,  
    "occurred": "2026-02-11T11:53:00.000Z",  
    "score": 0,  
    "sequenceNumber": 1,  
    "type": "created"  
}

‌

Below are explanations of the most important data fields in the alert.

Field	Description

Field	Description
`"alertId": "69a009c582571ba0c4939f22"`	A unique identifier for the alert. This ID remains the same throughout the alert lifecycle (created, updated, closed). See Anomaly alerts - structure and data explained for more details.
`"type": "created"`	The event type for this alert payload. Can be `created`, `updated`, or `closed`. An alert is updated when severity changes or when more nodes/metrics are pulled into it.
`"sequenceNumber": 1`	The sequential update number for this alert. Starts at 1 (created) and increments with each update. Useful for ordering events in the alert lifecycle.
`"occurred": "2026-02-11T11:53:00.000Z"`	The timestamp when this alert event occurred.
`"aggregate.active": true`	Indicates the alert is currently active and ongoing. Becomes `false` when the alert is closed.
`"aggregate.activeNodes": 1`	The number of nodes currently participating in the alert. As anomalies spread to correlated nodes, this number may increase.
`"aggregate.activeMetrics": 1`	The number of metrics currently participating in the alert.
`"impact.name": "low"` / `"impact.rank": 1`	The overall impact level of the alert, calculated based on the number of nodes and metrics involved and the spread of deviations across the correlation group. See Alerting for how severity and impact are determined.
`"score": 0`	A score reflecting how many metrics in the correlation group are affected. The score is a continuous value and grows each time a new metric in “red” or “blood_red” is added to the alert. A score of `0` indicates minimal spread, with no deviations that are in “red” or “blood_red”. A score of `1` that at least one metric involved in the alert is in “red” or “blood_red” state. A score of `2` means that the alert is spreading and either there are two nodes with “red” or “blood_red” state or one node has at least 75% of the metrics in “red” or “blood_red”.
`"learningStatus": 0`	The mean learning status across all metrics in the alert. Indicates how well Eyer has learned the baseline behavior. `0` = fully learned and reliable. Higher values indicate less confidence. See Learning status flag for the full scale. Recommended to filter on `learningStatus <= 1` for the most reliable alerts.
`"changes[].type": "added"`	Indicates what changed for this metric in this event. `added` means the metric has newly joined the alert. Can also be `updated` (severity changed) or `removed` (metric anomaly resolved).
`"changes[].values.type": "deviation"`	The anomaly type for this metric. `deviation` means the metric value has deviated from its learned baseline range. The alternative is `missing_data`, indicating a data gap rather than an out-of-range value. See Product update - January 7th, 2026 for details on anomaly classification.
`"changes[].values.severity.name": "yellow"` / `"severity.rank": 2`	The deviation severity for this individual metric. Reflects how likely the deviation is to be a true anomaly, based on how far outside the baselines the metric has moved. See Alerting - Severity of deviations for the full severity scale.
`"changes[].values.closestBaselineDeviation": 0`	A signed numeric value quantifying how far the data point is from the nearest baseline boundary, normalized by the baseline width. `0` = within baseline. Positive values indicate upward deviation; negative values indicate downward deviation. Example: if the baseline is 5–15 and the data point is 35, the deviation score is (35–15)/10 = 2. See Product update - January 7th, 2026 for the full calculation.
`"changes[].values.learningStatus": 0`	The learning status for this specific metric. See Learning status flag for the full scale.
`"changes[].values.score.adjusted": 0.5`	The anomaly score adjusted to calculate the severity of the anomaly. it is max(contribution - 0.5, 0). This filters out anomalies with low anomaly score.
`"changes[].values.score.contribution": 1`	The anomaly score at the level of the single metric reflect the evolution of the anomaly, it goes from `0` (the value is in the main baseline) to `2` (the value is outside all the baseline).