Algorithmic functions

Kloudfuse extends PromQL with algorithmic advanced functions for anomaly detection, outlier detection, and forecasting. They run in the advanced-functions service and are described in depth in the AI/ML algorithms section; this page covers their PromQL syntax. These functions fit a model per input series, so cost grows with the number of series — aggregate first (for example, sum by (service) (…​)) rather than applying them to high-cardinality selections.

dbscan

Kloudfuse extension. Clusters the input series by shape using DBSCAN and flags series that do not belong to any cluster — the fleet members behaving unlike their peers. See DBSCAN.

Syntax

dbscan(<expr>, <tolerance>, <norm-constant>, <result-type>)
none

Parameters

Parameter Required Description

<tolerance>

Required

Sensitivity, between 0.33 and 5.0 inclusive; lower values are more sensitive to deviations.

<norm-constant>

Required

Normalization constant; use 1.

<result-type>

Required

Result selector; use 1.

Example

Find Kloudfuse services whose goroutine counts behave unlike the rest of the fleet.

dbscan(sum by (app_kubernetes_io_name) (go_goroutines{app_kubernetes_io_instance="kfuse"}), 2.0, 1, 1)
Expected output
app_kubernetes_io_name Value

analytics-service

0

archive-writer

0

az-service

0

config-mgmt-service

0

envoy-gateway

0

Advance functions run in the Kloudfuse advanced-functions service, not in the PromQL engine, and fit a model per input series. Expect higher latency than standard functions, and aggregate first so the function receives few series — high-cardinality inputs degrade performance or time out.

kf_rolling_quantile

Kloudfuse extension. Computes a rolling quantile band over each series and flags samples that fall outside it — a robust, assumption-free anomaly detector. See Rolling quantile.

Syntax

kf_rolling_quantile(<expr>, <window>, <bound>, <band>)
none

Parameters

Parameter Required Description

<window>

Required

Rolling window in milliseconds — 1800000 for a 30-minute window.

<bound>

Required

Band width in standard deviations: 1, 2, or 3.

<band>

Required

4 = lower band, 5 = upper band, 6 = both; 0–3 return the raw prediction series instead (0 predictions, 1 lower, 2 upper, 3 all).

Example

Band the query-service goroutine count with a 30-minute rolling quantile at two standard deviations, returning both bands.

kf_rolling_quantile(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 1800000, 2, 6)
Expected output
result_type Value

anomaly_both

0

Advance functions run in the Kloudfuse advanced-functions service, not in the PromQL engine, and fit a model per input series. Expect higher latency than standard functions, and aggregate first so the function receives few series — high-cardinality inputs degrade performance or time out.

prophet

Kloudfuse extension. Fits Meta’s Prophet model — additive trend plus multi-scale seasonality — to each series for forecasting and anomaly banding. See Prophet.

Syntax

prophet(<expr>, <seasonality>, <bound>, <band>)
none

Parameters

Parameter Required Description

<seasonality>

Required

0 = hourly, 1 = daily, 2 = weekly.

<bound>

Required

Band width in standard deviations: 1, 2, or 3.

<band>

Required

4 = lower band, 5 = upper band, 6 = both.

Example

Band the query-service goroutine count with a Prophet model using daily seasonality at two standard deviations.

prophet(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 1, 2, 6)
Expected output
result_type Value

anomaly_both

0

Advanced functions run in the Kloudfuse advanced-functions service, not in the PromQL engine, and fit a model per input series. Expect higher latency than standard functions, and aggregate first so the function receives few series — high-cardinality inputs degrade performance or time out.

sarima

Kloudfuse extension. Fits a Seasonal Autoregressive Integrated Moving Average model to each series and returns the predicted band, flagging values that escape it. The strongest choice for metrics with clear seasonality. See SARIMA for the model parameters in depth.

Syntax

sarima(<expr>, <p>, <d>, <q>, <sp>, <sd>, <sq>, <sm>, <bound>, <band>)
none

Parameters

Parameter Required Description

<p>, <d>, <q>

Required

Autoregression order, differencing order, and moving-average order.

<sp>, <sd>, <sq>, <sm>

Required

Seasonal counterparts plus the number of timestamps per season.

<bound>

Required

Band width in standard deviations: 1, 2, or 3.

<band>

Required

4 = lower band, 5 = upper band, 6 = both.

Example

Band the query-service goroutine count with a non-seasonal ARIMA model at two standard deviations, returning both bands.

sarima(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 2, 1, 2, 0, 0, 0, 0, 2, 6)
Expected output
result_type Value

anomaly_both

1

Advance functions run in the Kloudfuse advanced-functions service, not in the PromQL engine, and fit a model per input series. Expect higher latency than standard functions, and aggregate first so the function receives few series — high-cardinality inputs degrade performance or time out.

seasonal_decompose

Kloudfuse extension. Splits each series into trend, seasonal, and residual components and flags points whose residual is anomalous. See Seasonal Decompose for the full treatment.

Syntax

seasonal_decompose(<expr>, <period>, <model>, <window>, <bound>, <band>)
none

Parameters

Parameter Required Description

<period>

Required

Data points per season — 1440 at 1-minute resolution for daily seasonality.

<model>

Required

0 = additive decomposition, 1 = multiplicative.

<window>

Required

Smoothing window in milliseconds — 1800000 for 30 minutes.

<bound>

Required

Band width in standard deviations: 1, 2, or 3.

<band>

Required

4 = lower band, 5 = upper band, 6 = both.

Example

Decompose the query-service goroutine count with a one-hour season and additive model, returning both anomaly bands.

seasonal_decompose(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 60, 0, 1800000, 2, 6)
Expected output
result_type Value

anomaly_both

0

Advance functions run in the Kloudfuse advanced-functions service, not in the PromQL engine, and fit a model per input series. Expect higher latency than standard functions, and aggregate first so the function receives few series — high-cardinality inputs degrade performance or time out.

seasonal_forecast

Kloudfuse extension. Projects each series into the future using its seasonal history — the seasonal counterpart of predict_linear for trends that repeat rather than run straight.

Syntax

seasonal_forecast(<expr>, <seasonality>, <result>, <duration>)
none

Parameters

Parameter Required Description

<seasonality>

Required

0 = hourly, 1 = daily, 2 = weekly.

<result>

Required

0 = forecast, 1 = upper band, 2 = lower band, 3 = all.

<duration>

Required

Forecast duration in timestamps.

Example

Forecast the query-service goroutine count an hour ahead using daily seasonality.

seasonal_forecast(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 1, 0, 60)
Expected output
result_type Value

mean

65,133.97

Advanced functions run in the Kloudfuse advanced-functions service, not in the PromQL engine, and fit a model per input series. Expect higher latency than standard functions, and aggregate first so the function receives few series — high-cardinality inputs degrade performance or time out.