Algorithmic functions :: Kloudfuse Docs
Algorithmic functions
Kloudfuse extends PromQL with algorithmic advance functions for anomaly detection, outlier detection, and forecasting. They run in the advanced-functions service and are described in depth in the AI/ML algorithms section; this page covers their PromQL syntax. These functions fit a model per input series, so cost grows with the number of series — aggregate first (for example, sum by (service) (...)) rather than applying them to high-cardinality selections.
dbscan
Kloudfuse extension. Clusters the input series by shape using DBSCAN and flags series that do not belong to any cluster — the fleet members behaving unlike their peers. See DBSCAN.
Syntax
dbscan(<expr>, <tolerance>, <norm-constant>, <result-type>)
Parameters
| Parameter | Required | Description |
|---|---|---|
<tolerance> |
Required | Sensitivity, between 0.33 and 5.0 inclusive; lower values are more sensitive to deviations. |
<norm-constant> |
Required | Normalization constant; use 1. |
<result-type> |
Required | Result selector; use 1. |
Example
Find Kloudfuse services whose goroutine counts behave unlike the rest of the fleet.
dbscan(sum by (app_kubernetes_io_name) (go_goroutines{app_kubernetes_io_instance="kfuse"}), 2.0, 1, 1)
| app_kubernetes_io_name | Value |
|---|---|
| analytics-service | 0 |
| archive-writer | 0 |
| az-service | 0 |
| config-mgmt-service | 0 |
| envoy-gateway | 0 |
Expected output
| Advance functions run in the Kloudfuse advanced-functions service, not in the PromQL engine, and fit a model per input series. Expect higher latency than standard functions, and aggregate first so the function receives few series — high-cardinality inputs degrade performance or time out. |
kf_rolling_quantile
Kloudfuse extension. Computes a rolling quantile band over each series and flags samples that fall outside it — a robust, assumption-free anomaly detector. See Rolling quantile.
Syntax
kf_rolling_quantile(<expr>, <window>, <bound>, <band>)
Parameters
| Parameter | Required | Description |
|---|---|---|
<window> |
Required | Rolling window in milliseconds — 1800000 for a 30-minute window. |
<bound> |
Required | Band width in standard deviations: 1, 2, or 3. |
<band> |
Required | 4 = lower band, 5 = upper band, 6 = both; 0–3 return the raw prediction series instead (0 predictions, 1 lower, 2 upper, 3 all). |
Example
Band the query-service goroutine count with a 30-minute rolling quantile at two standard deviations, returning both bands.
kf_rolling_quantile(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 1800000, 2, 6)
| result_type | Value |
|---|---|
| anomaly_both | 0 |
Expected output
prophet
Kloudfuse extension. Fits Meta’s Prophet model — additive trend plus multi-scale seasonality — to each series for forecasting and anomaly banding. See Prophet.
Syntax
prophet(<expr>, <seasonality>, <bound>, <band>)
Parameters
| Parameter | Required | Description |
|---|---|---|
<seasonality> |
Required | 0 = hourly, 1 = daily, 2 = weekly. |
<bound> |
Required | Band width in standard deviations: 1, 2, or 3. |
<band> |
Required | 4 = lower band, 5 = upper band, 6 = both. |
Example
Band the query-service goroutine count with a Prophet model using daily seasonality at two standard deviations.
prophet(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 1, 2, 6)
| result_type | Value |
|---|---|
| anomaly_both | 0 |
Expected output
| Advanced functions run in the Kloudfuse advanced-functions service, not in the PromQL engine, and fit a model per input series. Expect higher latency than standard functions, and aggregate first so the function receives few series — high-cardinality inputs degrade performance or time out. |
sarima
Kloudfuse extension. Fits a Seasonal Autoregressive Integrated Moving Average model to each series and returns the predicted band, flagging values that escape it. The strongest choice for metrics with clear seasonality. See SARIMA for the model parameters in depth.
Syntax
sarima(<expr>, <p>, <d>, <q>, <sp>, <sd>, <sq>, <sm>, <bound>, <band>)
Parameters
| Parameter | Required | Description |
|---|---|---|
<p>, <d>, <q> |
Required | Autoregression order, differencing order, and moving-average order. |
<sp>, <sd>, <sq>, <sm> |
Required | Seasonal counterparts plus the number of timestamps per season. |
<bound> |
Required | Band width in standard deviations: 1, 2, or 3. |
<band> |
Required | 4 = lower band, 5 = upper band, 6 = both. |
Example
Band the query-service goroutine count with a non-seasonal ARIMA model at two standard deviations, returning both bands.
sarima(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 2, 1, 2, 0, 0, 0, 0, 2, 6)
| result_type | Value |
|---|---|
| anomaly_both | 1 |
Expected output
seasonal_decompose
Kloudfuse extension. Splits each series into trend, seasonal, and residual components and flags points whose residual is anomalous. See Seasonal Decompose for the full treatment.
Syntax
seasonal_decompose(<expr>, <period>, <model>, <window>, <bound>, <band>)
Parameters
| Parameter | Required | Description |
|---|---|---|
<period> |
Required | Data points per season — 1440 at 1-minute resolution for daily seasonality. |
<model> |
Required | 0 = additive decomposition, 1 = multiplicative. |
<window> |
Required | Smoothing window in milliseconds — 1800000 for 30 minutes. |
<bound> |
Required | Band width in standard deviations: 1, 2, or 3. |
<band> |
Required | 4 = lower band, 5 = upper band, 6 = both. |
Example
Decompose the query-service goroutine count with a one-hour season and additive model, returning both anomaly bands.
seasonal_decompose(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 60, 0, 1800000, 2, 6)
| result_type | Value |
|---|---|
| anomaly_both | 0 |
Expected output
seasonal_forecast
Kloudfuse extension. Projects each series into the future using its seasonal history — the seasonal counterpart of predict_linear for trends that repeat rather than run straight.
Syntax
seasonal_forecast(<expr>, <seasonality>, <result>, <duration>)
Parameters
| Parameter | Required | Description |
|---|---|---|
<seasonality> |
Required | 0 = hourly, 1 = daily, 2 = weekly. |
<result> |
Required | 0 = forecast, 1 = upper band, 2 = lower band, 3 = all. |
<duration> |
Required | Forecast duration in timestamps. |
Example
Forecast the query-service goroutine count an hour ahead using daily seasonality.
seasonal_forecast(sum(go_goroutines{app_kubernetes_io_name="query-service"}), 1, 0, 60)
| result_type | Value |
|---|---|
| mean | 65,133.97 |
Expected output