Lindorm:Time series anomaly detection

anomaly_detect() parameters

Common parameters

These parameters apply to all algorithms.

Training parameters

Training parameters define the model the algorithm learns during detection. Parameter names are not case-sensitive. Values cannot be NULL and must be within the specified range.

Training parameter values are cleared when LindormTSDB restarts. Reconfigure them after a restart to retrain the model.

Supported time units for `frequency` and `periods`:

Inference parameters

Inference parameters affect each detection run and are not case-sensitive.

nsigma

Same columns as esd, except upperBound, lowerBound, and median are not included. The threshold column represents the judgment threshold for anomalyScore.

istl-esd

istl-nsigma

Same structure as istl-esd, using nsigma columns instead. Enable with nsigma.verbose=true.

Example 1: Detect anomalies across all devices (esd)

SELECT device_id, region, time, anomaly_detect(temperature, 'esd') AS detect_result
FROM sensor
WHERE time >= '2022-01-01 00:00:00' AND time < '2022-01-01 00:01:00'
SAMPLE BY 0;

The query scans every data point in the specified time range and returns a boolean result per point. A value of true means the algorithm flagged that point as anomalous.

+-----------+----------+---------------------------+---------------+
| device_id |  region  |           time            | detect_result |
+-----------+----------+---------------------------+---------------+
| F07A1260  | north-cn | 2022-01-01T00:00:00+08:00 | true          |
| F07A1260  | north-cn | 2022-01-01T00:00:01+08:00 | false         |
| F07A1260  | north-cn | 2022-01-01T00:00:02+08:00 | true          |
| F07A1261  | south-cn | 2022-01-01T00:00:00+08:00 | false         |
| F07A1261  | south-cn | 2022-01-01T00:00:01+08:00 | false         |
| F07A1261  | south-cn | 2022-01-01T00:00:02+08:00 | false         |
| F07A1261  | south-cn | 2022-01-01T00:00:03+08:00 | false         |
+-----------+----------+---------------------------+---------------+

Example 2: Filter by device before detection (esd)

SELECT device_id, region, time, anomaly_detect(temperature, 'esd') AS detect_result
FROM sensor
WHERE device_id IN ('F07A1260') AND time >= '2022-01-01 00:00:00' AND time < '2022-01-01 00:01:00'
SAMPLE BY 0;

+-----------+----------+---------------------------+---------------+
| device_id |  region  |           time            | detect_result |
+-----------+----------+---------------------------+---------------+
| F07A1260  | north-cn | 2022-01-01T00:00:00+08:00 | true          |
| F07A1260  | north-cn | 2022-01-01T00:00:01+08:00 | false         |
| F07A1260  | north-cn | 2022-01-01T00:00:02+08:00 | true          |
+-----------+----------+---------------------------+---------------+

Example 3: Tune detection parameters (esd)

Pass detection parameters as a comma-separated key=value string to adjust sensitivity.

SELECT device_id, region, time,
       anomaly_detect(temperature, 'esd', 'lenHistoryWindow=30,maxAnomalyRatio=0.1') AS detect_result
FROM sensor
WHERE device_id IN ('F07A1260') AND time >= '2022-01-01 00:00:00' AND time < '2022-01-01 00:01:00'
SAMPLE BY 0;

+-----------+----------+---------------------------+---------------+
| device_id |  region  |           time            | detect_result |
+-----------+----------+---------------------------+---------------+
| F07A1260  | north-cn | 2022-01-01T00:00:00+08:00 | false         |
| F07A1260  | north-cn | 2022-01-01T00:00:01+08:00 | false         |
| F07A1260  | north-cn | 2022-01-01T00:00:02+08:00 | true          |
+-----------+----------+---------------------------+---------------+

Example 4: Downsample before detection (MAX, 1-minute interval)

Use a downsampling operator inside anomaly_detect() together with SAMPLE BY <interval>.

SELECT time, anomaly_detect(max(temperature), 'esd') AS ad_result, max(temperature) AS rawVal
FROM sensor
SAMPLE BY 1m;

+---------------------------+-----------+-------------+
|           time            | ad_result |   rawVal    |
+---------------------------+-----------+-------------+
| 2022-04-12T06:00:00+08:00 | null      | 923091.3175 |
| 2022-04-11T08:00:00+08:00 | null      | 8035700     |
| 2022-04-11T09:00:00+08:00 | null      | 8035690.25  |
| 2022-04-11T10:00:00+08:00 | null      | 3306277.545 |
| 2022-04-11T11:00:00+08:00 | null      | 5921167.787 |
| 2022-04-11T12:00:00+08:00 | null      | 833541.304  |
+---------------------------+-----------+-------------+

ad_result is null because the algorithm is still in the warmup phase (insufficient data points collected).

Example 5: Apply a non-downsampling operator (LATEST)

Use SAMPLE BY 0 with operators like LATEST, DELTA, or RATE.

SELECT time, anomaly_detect(latest(temperature), 'esd') AS ad_result, latest(temperature) AS latestVal
FROM sensor
SAMPLE BY 0;

+---------------------------+-----------+-------------+
|           time            | ad_result |  latestVal  |
+---------------------------+-----------+-------------+
| 2022-04-12T06:00:00+08:00 | false     | 923091.3175 |
| 2022-04-13T07:00:00+08:00 | false     | 8037506.75  |
| 2022-04-13T07:00:00+08:00 | false     | 50490.2     |
+---------------------------+-----------+-------------+