Alert rule evaluation for monitoring of late arriving data

Abstract

A monitoring system is configured to distinguish between two types of alert rules—namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.