Baseline Alerts

Overview

Baseline alerts use a moving average to establish a historical norm for a metric, then compare the current value against that baseline. If the current value deviates from the baseline by more than a configured percentage, the alert fires. This approach detects anomalies without requiring you to set a fixed numeric threshold.

Every baseline alert rule uses the Baseline Metric rule type. Baseline alerts are supported for Browser and APM products.

Available metrics

Browser baseline metrics

APM baseline metrics

All baseline metrics use % as the threshold unit because you are configuring the maximum allowed percentage deviation from the moving average. For example, a threshold of 20 means the alert fires when the current value deviates by more than 20% from the baseline.

Targets

Baseline alert rules use appId for targeting, which scopes the rule to a specific project. The baseline and current values are computed for the selected project only.

Filters

Baseline rules inherit the standard filter mechanism. Filters narrow the data set before the baseline and current values are computed.

Group By

Group By is not typically used with baseline alerts. The rule evaluates the aggregate metric value for the targeted project.

Evaluation logic

Baseline evaluation runs in three steps:

1. Query historical and current values

The alerting engine queries ClickHouse for two values:

• previousValue (baseline): The metric value over the baseline period, defined by baselineMovingAvgDuration and baselineMovingAvgDurationUnit.
• currentValue: The metric value over the current evaluation period.

2. Calculate percentage deviation

The engine computes how far the current value has deviated from the baseline:

percentage = (currentValue - previousValue) / previousValue * 100

A positive percentage means the current value is higher than the baseline. A negative percentage means it is lower.

3. Compare against threshold

The comparison depends on the operator:

Configuration fields

Examples

Response time deviation alert

Detect when web response time spikes significantly compared to the recent historical average, which may indicate a performance regression.

This rule computes the average web response time over the past 2 hours as the baseline. If the current response time is 50% or more above that baseline, an incident is opened. For example, if the 2-hour baseline is 200 ms and the current value is 320 ms, the deviation is 60%, which exceeds the 50% threshold.

Throughput drop detection

Alert when page view throughput drops significantly, which may indicate an outage or routing issue preventing users from reaching the application.

This rule computes the average page view throughput over the past hour. If the current throughput drops to 30% or more below that baseline, an incident is opened. For example, if the 1-hour baseline is 1,000 page views per minute and the current value is 650, the deviation is -35%, which exceeds the -30% threshold.