DBSCAN

Kloudfuse provides Density-based spatial clustering of applications with noise (DBSCAN) implementation of Outlier Detection.

Parameters

tolerance

In DBSCAN, the tolerance level, or eps, determines the clustering radius of the neighborhood around each point. The eps controls the sensitivity of outlier detection. A lower tolerance detects more subtle outliers, while a higher tolerance detects only the most significant deviations.

How it works

DBSCAN groups the input series by similarity: series whose behavior falls within a small neighborhood of each other form dense clusters, and clusters grow outward through chains of neighboring series. Series that end up in no cluster are the outliers — fleet members behaving unlike their peers. The tolerance parameter scales the neighborhood size, so lower values flag smaller deviations as outliers.

In Dashboards

To use dbscan in a dashboard, apply the following function:

dbscan( 
  ${promql}, 
  ${tolerance}, 
  1, 1 
)

For the operator reference — syntax, parameters, and a validated example — see dbscan in the PromQL documentation.

Limitations

• The alert rule evaluates all data points pulled by the query. When used in a dashboard, it evaluates the whole data collection, not individual time slices. If a time series triggers an alert, then the whole time range is in active alerting state. This presents differently from other alert functions used in the dashboard.

• DBSCAN clusters the set of input series against each other, so it needs enough peer series to form a meaningful cluster — applying it to one or two series cannot distinguish an outlier from a cluster.

• Conversely, very wide inputs (hundreds of series) increase comparison cost; group to the fleet dimension you actually want to compare, such as one series per pod or per service.

Next steps

For an in-depth discussion of the DBSCAN algorithm, see these external resources:

• DBSCAN Key Concepts and Parameters in DataCamp Tutorials
• DBSCAN in Wikipedia