Anomaly Merger Rules

Consider an alert that runs with hourly granularity and an incident that last 3 hours. The alert will detect an anomaly 3 times, but it is actually the same incident. ThirdEye merges the anomalies in a single one.

By default, the following rules are applied:

1. consecutive anomalies are merged
2. if an anomaly lasts for more than 7 days, a new anomaly is created

Examples

Anomaly merge

1. Default behavior
2. Custom behavior
   You can configure ThirdEye to merge anomalies that have a small gap between them using mergeMaxGap.
   For instance, with mergeMaxGap=PT2H, anomalies that have less than 2 hours between them are merged together.
3. Disable anomaly merger
   You can disable anomaly merger by setting mergeMaxGap=PT0S.

Anomaly max length

A new anomaly is created when the maximum length is reached. You can customize this maximum length with mergeMaxDuration.