Overview
Baseline alerts use a moving average to establish a historical norm for a metric, then compare the current value against that baseline. If the current value deviates from the baseline by more than a configured percentage, the alert fires. This approach detects anomalies without requiring you to set a fixed numeric threshold. Every baseline alert rule uses the Baseline Metric rule type. Baseline alerts are supported for Browser and APM products.Available metrics
Browser baseline metrics
APM baseline metrics
All baseline metrics use % as the threshold unit because you are configuring the maximum allowed percentage deviation from the moving average. For example, a threshold of 20 means the alert fires when the current value deviates by more than 20% from the baseline.
Targets
Baseline alert rules useappId for targeting, which scopes the rule to a specific project. The baseline and current values are computed for the selected project only.
Filters
Baseline rules inherit the standard filter mechanism. Filters narrow the data set before the baseline and current values are computed.Group By
Group By is not typically used with baseline alerts. The rule evaluates the aggregate metric value for the targeted project.Evaluation logic
Baseline evaluation runs in three steps:1. Query historical and current values
The alerting engine queries ClickHouse for two values:previousValue(baseline): The metric value over the baseline period, defined bybaselineMovingAvgDurationandbaselineMovingAvgDurationUnit.currentValue: The metric value over the current evaluation period.
2. Calculate percentage deviation
The engine computes how far the current value has deviated from the baseline:3. Compare against threshold
The comparison depends on the operator:Configuration fields
Examples
Response time deviation alert
Detect when web response time spikes significantly compared to the recent historical average, which may indicate a performance regression.
This rule computes the average web response time over the past 2 hours as the baseline. If the current response time is 50% or more above that baseline, an incident is opened. For example, if the 2-hour baseline is 200 ms and the current value is 320 ms, the deviation is 60%, which exceeds the 50% threshold.
Throughput drop detection
Alert when page view throughput drops significantly, which may indicate an outage or routing issue preventing users from reaching the application.
This rule computes the average page view throughput over the past hour. If the current throughput drops to 30% or more below that baseline, an incident is opened. For example, if the 1-hour baseline is 1,000 page views per minute and the current value is 650, the deviation is -35%, which exceeds the -30% threshold.