Baseline Learning

The problem with flat averages

Most monitoring tools define “normal” as a single threshold or a rolling average. This breaks down immediately for any real application because traffic has strong temporal patterns:

• Tuesday at 3am is very different from Tuesday at 3pm
• Monday mornings are different from Sunday afternoons
• Black Friday is different from the preceding Tuesday

A flat average creates two problems: false alerts during expected quiet periods (low-traffic nights get flagged) and missed alerts during expected busy periods (a real drop looks normal because it’s still above the flat average).

Heartbeet’s approach: 168 windows

Heartbeet builds a separate expected range for every hour of every day of the week — 7 days × 24 hours = 168 time windows, each stored independently in the beet_baselines_hourly table.

Each window stores:

• avg_count — the rolling average event count for this hour
• stddev_count — the standard deviation
• sample_count — how many historical data points were used

The baseline is expressed as a range: avg ± (multiplier × stddev).

How the baseline is updated

After each cron run, the baseline for the current hour × day-of-week is updated using an exponential moving average (EMA) that weights recent observations more heavily than old ones. This means:

• The baseline adapts automatically as your product grows
• Seasonal shifts (e.g. new marketing campaigns driving more traffic) are absorbed over time
• You never need to manually adjust thresholds

The learning period

A baseline is considered reliable only after 14 days of data across the relevant time window. During the learning period, no alerts fire — the beet status shows Learning.

Once the baseline is established, Heartbeet begins detecting anomalies against it. The status moves to Healthy, Warning, or Critical as appropriate.

Inspecting the baseline

The current baseline for an active alert is surfaced in the AI explanation panel on the beet detail page. It shows the normal average and standard deviation for the hour and day the alert fired.