Welcome to InsightFinder Docs!
Categories
Metric Project Settings
Metric normalization, derived metrics, anomaly direction, escalation controls, and data-quality guardrails
Configuration Guide and Tuning Reference
| Naming & derived metrics
Pattern naming, regular-expression normalization, and aggregated metric generation. |
Metric targeting
Component association, metric typing, statistics, and per-metric behavior flags. |
| Anomaly & escalation
Positive/negative detection, duration gates, KPI promotion, flapping, and gap tolerance. |
Data-quality guardrails
Alert suppression ranges, invalid-value filtering, zero filling, cumulative and near-constant handling. |
| Source scope This guide is based on the supplied “Metric Configuration” source. That source specifically documents the Metric Configuration page and its per-metric controls; it does not enumerate every setting elsewhere in a Metric project. This guide therefore stays within the settings and behavior described in that source. |
METRIC CONFIGURATION
Configuration map
The source shows Metric Configuration as an Advanced Setting within a Metric project. The page combines project-wide naming controls with a row-by-row metric configuration grid
Figure 1 — Metric Configuration page showing naming, derived metrics, per-metric attributes, and alert/detection configuration.
What is configured here
| Area | Purpose |
|---|---|
| Pattern naming | Controls whether pattern names are generated from metric name or metric type, with optional regex-based normalization. |
| Derived metrics | Creates a new aggregate metric from a source metric across a defined list of instances using a selected operation. |
| Metric context | Associates a metric with a component, exposes average statistics for the selected period, and assigns a metric type. |
| Detection behavior | Controls anomaly direction, escalation duration, KPI behavior, flapping-only handling, and duration/gap overrides. |
| Guardrails | Suppresses alerts in configured ranges and ignores physically invalid or out-of-bound values. |
| Time-series handling | Controls near-constant behavior, ignore state, cumulative/counter handling, and zero filling. |
| Important The source does not provide universal default values for these settings. Values should be treated as metric-specific configuration rather than global recommended defaults. |
NORMALIZATION & AGGREGATION
Pattern naming and derived metrics
Pattern name generation rule
Generate unique pattern names for metrics based on either the individual metric name or the generalized metric type.
| Option | Source-defined behavior |
|---|---|
| Metric name | Generate unique pattern names directly from the specific metric name. |
| Metric type | Generate unique pattern names from the generalized category or type of the metric. |
Pattern name regular expression
The Pattern name field supports regular expressions that extract, truncate, or reformat raw text into a standardized display name. The source specifies that the matched value inside the named capture group (?<patternName>…) is mapped to the display field.
| Example The default expression (?<patternName>.*) captures the entire incoming string as the active pattern name. |
Derived metrics
Derived metrics configuration builds a new composite time-series stream by aggregating a selected source metric across multiple instances.
Figure 2 — Derived metrics configuration dialog.
| Field | What it controls |
|---|---|
| Metric name | Source baseline metric used as the input to the derived value. |
| Instance name list | Host or container instances whose telemetry is included in the aggregation. |
| Operation | Mathematical function applied across the selected instances. The source explicitly shows Sum and refers to additional options without enumerating them. |
| Derived metric name | Custom unique name for the newly generated aggregate time series. |
| Target instance name | Logical virtual instance identity to which the derived output is mapped. |
METRIC CONTEXT & TIME-SERIES BEHAVIOR
Per-metric configuration fields
Each metric row combines identity, display normalization, component mapping, statistics, alert configuration, and behavior flags. These settings determine how the metric is interpreted downstream.
| Field | Source-defined behavior |
|---|---|
| Metric | Unique telemetry identifier or performance time-series name ingested from monitored entities. |
| Pattern name | Positive and negative display-pattern names, with optional regex normalization. |
| Component | Binds the metric to a logical service, infrastructure layer, or functional component. |
| Statistics (Avg) | Average value of the metric for the time period selected in the page. |
| Alert thresholds and detection type | Opens the detailed controls for escalation, detection direction, duration, and threshold behavior. |
| Near constant detection | Flags slight changes in metrics that are normally stable or flat. |
| Ignore | Ignores anomalies for the selected metric/component context. |
| Cumulative | Treats the metric as a continuously increasing counter rather than a gauge that naturally moves up and down. |
| Zero filling | Substitutes zero for missing time-series values when enabled; otherwise missing intervals remain unpopulated/null. |
| Metric Type | Categorizes the operational nature of the metric for downstream parsing/configuration. |
Boolean behavior flags
| Setting | Enabled | Disabled |
|---|---|---|
| Near constant detection | Detect small deviations in a normally constant metric. | Use routine baseline logic that permits normal statistical variation. |
| Cumulative | Parse the series as a counter that continuously increases. | Parse the series as a gauge that can move up and down. |
| Zero filling | Insert 0 for missing points. | Keep missing points empty/null. |
| Metric semantics matter Counter, gauge, near-constant, and missing-data behavior should match the actual telemetry semantics; the source presents these as per-metric controls rather than one-size-fits-all project defaults. |
INCIDENT ESCALATION & DIRECTIONALITY
Alert thresholds and detection type
This dialog is the primary per-metric control surface for deciding where anomalies may escalate, how long they must persist, which direction is meaningful, and how gaps or flapping behavior are treated.
Figure 3 — Alert thresholds and detection type configuration.
| Control | What it does |
|---|---|
| Components with incident escalation | Select the components where an anomaly should automatically escalate to an incident. |
| Incident duration threshold (min) | Minimum anomaly duration required before escalation. Source example: 5 minutes means escalation occurs only when the anomaly lasts longer than 5 minutes. |
| KPI | Marks the incident metric as KPI so it generates a critical incident; otherwise it appears as a normal incident. |
| Flapping only anomaly | True: detect only flapping anomalies for this metric. False: detect both persistent and flapping anomalies. Source example: ICMP Response Time. |
| Low anomaly ratio duration threshold override (min) | Custom minimum duration for anomalies with a low ratio. |
| High anomaly ratio duration threshold override (min) | Custom minimum duration for anomalies with a high ratio. |
| Anomaly gap tolerance duration override | Maximum gap allowed between anomaly segments while still treating them as one continuous anomaly. |
THRESHOLD LOGIC
Detection direction and alert suppression
Detection type
Detection can be configured for positive anomalies, negative anomalies, or both.
| Direction | Meaning | Examples given in source |
|---|---|---|
| Positive | Detect values that are higher than normal. | CPU Usage, Memory Usage |
| Negative | Detect values that are lower than normal. | InterfaceSpeed, FreeDiskSpace |
Negative-direction threshold controls
| Setting | Source-defined behavior |
|---|---|
| Anomaly threshold (<) | Boundary threshold required to trigger negative-direction anomaly detection. |
| No alert min | Source wording: no anomaly is generated when the metric value is higher than this value. |
| No alert max | Source wording: no anomaly is generated when the metric value is lower than this value. |
| Source wording note The source defines “No alert min” and “No alert max” using the behaviors above. Because the names can read counterintuitively, validate the actual suppression behavior in the target project before applying broad ranges. |
Ignore thresholds for invalid data
Ignore thresholds are used to discard out-of-bound values before anomaly detection. They are intended for physically impossible values or collection errors, not for suppressing valid but undesirable behavior.
| Setting | Behavior | Source example |
|---|---|---|
| Invalid value threshold (>) | Values above this threshold are considered invalid and ignored. | Disk usage > 100% |
| Invalid value threshold (<) | Values below this threshold are considered invalid and ignored. | Disk usage < 0% |
PRACTICAL WORKFLOW
Configuration sequence
The source describes individual settings rather than a prescribed implementation order. The following sequence is a practical way to apply those controls while preserving the source-defined relationships between naming, metric semantics, detection, and escalation. Steps 1 – 3 typically do not need to be manually configured or changed!
| 1 | Normalize pattern names
Choose Metric name or Metric type, then apply regex normalization only where the display name needs extraction or truncation. |
| 2 | Create derived metrics where needed
Select the source metric, contributing instances, operation, derived metric name, and target virtual instance. |
| 3 | Assign metric context
Map each metric to the correct component and metric type; use the Statistics (Avg) view to understand the selected period. |
| 4 | Set time-series semantics
Configure near-constant, cumulative, zero-filling, or ignore behavior according to the metric’s real meaning. |
| 5 | Choose detection direction
Enable Positive, Negative, or both based on whether higher values, lower values, or either direction represents degradation. |
| 6 | Configure escalation
Select eligible components, set duration gates, KPI behavior, flapping-only behavior, and gap tolerance. |
| 7 | Add guardrails
Use no-alert and invalid-value thresholds to suppress intended ranges and remove physically impossible collection artifacts. |
| Validation principle The supplied source does not define universal recommended values. Validate each setting against the metric’s real operating range, directionality, time-series type, and incident escalation intent. |
METRIC CONFIGURATION
Quick reference
Use this table as a compact reference to the controls explicitly described in the source document.
| Setting | Purpose |
|---|---|
| Pattern name generation rule | Generate pattern names from Metric name or Metric type. |
| Pattern name | Regex-based display naming using (?<patternName>…). |
| Metric name | Source metric for the row or derived-metric calculation. |
| Instance name list | Instances included in a derived aggregation. |
| Operation | Mathematical aggregation function; source explicitly shows Sum. |
| Derived metric name | Name of the generated aggregate series. |
| Target instance name | Virtual instance receiving the derived series. |
| Component | Logical service/infrastructure association. |
| Statistics (Avg) | Average metric value for the selected period. |
| Components with incident escalation | Components where anomalies may promote to incidents. |
| Incident duration threshold | Minimum anomaly duration before escalation. |
| KPI | Promotes metric incident to critical incident behavior. |
| Flapping only anomaly | Restricts detection to flapping-only when enabled. |
| Low anomaly ratio duration override | Custom duration threshold for low-ratio anomalies. |
| High anomaly ratio duration override | Custom duration threshold for high-ratio anomalies. |
| Anomaly gap tolerance override | Gap allowed while treating anomaly segments as continuous. |
| Detection type | Positive, Negative, or both. |
| Anomaly threshold (<) | Negative-direction trigger boundary. |
| No alert min / max | Suppresses anomaly generation within source-defined conditions. |
| Invalid value threshold > / < | Ignores physically invalid/out-of-bound metric values. |
| Near constant detection | Detects small deviations on normally flat metrics. |
| Ignore | Ignores anomaly behavior for the chosen metric/component. |
| Cumulative | Treats the series as an increasing counter. |
| Zero filling | Replaces missing data points with zero when enabled. |
| Metric Type | Operational classification of the performance stream. |
| Source boundary No additional metric-project settings, defaults, or algorithms are asserted here beyond what the supplied Metric Configuration source describes. |
From the Blog
Blogs 
See how InsightFinder helps your team deliver reliable services across every layer of the stack
Take InsightFinder AI for a no-obligation test drive. We’ll provide you with a detailed report on your outages to uncover what could have been prevented.
