Forecast alerts

The forecast rule kind

A forecast rule fires when a metric is predicted to cross a threshold within a horizon, for example "a disk is full within 3 days":

{"name": "Disk full in 3 days", "kind": "forecast",
 "query": {"forecast": {"expr": "max by (host_name, mountpoint) (system_filesystem_utilization)",
                        "algorithm": "linear", "horizon_s": 259200}},
 "condition": {"threshold": {"op": "ge", "value": 0.95}}, "every_s": 300}

The condition must be a threshold with gt, ge, lt or le. The rule's value per series is the forecast's highest point within the horizon for gt/ge and its lowest for lt/le, so the threshold holds exactly when the forecast crosses it before the horizon. warn tiers, for_s, recovery hysteresis, no-data handling and routing work as for any metric rule.

History is read at 5 minute steps up to 7 days, hourly beyond. A seasonal forecast needs three full seasons of history (3 days for daily, 3 weeks for weekly); with less, a weekly season falls back to a daily one and a daily one to linear. A series with fewer than two points is no data for its group, never a firing. A forecast rule evaluates only its latest due tick after an outage.

Preview in the rule editor

Choosing the forecast kind shows a forecast preview under the condition: per series (first five) the history, the forecast with a band of two residual standard deviations, the threshold line, and the time the forecast first crosses it. The preview calls GET /v1/projects/{prj}/forecast with the rule's method and history.

Forecast condition on a metric rule

The older form, a metric rule with "condition": {"forecast": {"method", "horizon_s", "op", "value"}}, keeps working; capacity_forecast templates use it. New rules should use the forecast kind, which has a seasonal choice, its own history and the editor preview.