---
title: "Scaling ClickStack alerting with built-in anomaly detection"
description: "Managed ClickStack now supports statistical anomaly detection on query-builder charts using z-scores, allowing teams to move alerting workloads from tools like Grafana. The detection calculates the expected value from a moving average of seven one-minute buckets and the standard deviation from a two-hour baseline, with a 5% minimum change threshold to prevent false positives from stable metrics. Users configure sensitivity, baseline duration, and direction of change, and preview how often the alert would have fired over the previous 24 hours, with the chart updating as settings are adjusted. The alerting framework scales to tens of thousands of alerts through an improved scheduler and sharding that distributes evaluation across multiple workers, with a backfill mechanism for skipped evaluations and improved search, filtering, and evaluation histories in the alerts UI. Future plans include support for seasonality, median-based estimates for noisy data, and alerting on PromQL queries."
---

# Scaling ClickStack alerting with built-in anomaly detection

[Clickhouse](https://yomu.fyi/company/clickhouse) · Oct 15, 2026

**Type:** Announcement

## Summary

Managed ClickStack now supports statistical anomaly detection on query-builder charts using z-scores, allowing teams to move alerting workloads from tools like Grafana. The detection calculates the expected value from a moving average of seven one-minute buckets and the standard deviation from a two-hour baseline, with a 5% minimum change threshold to prevent false positives from stable metrics. Users configure sensitivity, baseline duration, and direction of change, and preview how often the alert would have fired over the previous 24 hours, with the chart updating as settings are adjusted. The alerting framework scales to tens of thousands of alerts through an improved scheduler and sharding that distributes evaluation across multiple workers, with a backfill mechanism for skipped evaluations and improved search, filtering, and evaluation histories in the alerts UI. Future plans include support for seasonality, median-based estimates for noisy data, and alerting on PromQL queries.

## Context

Managed ClickStack is a hosted ClickHouse service. The post describes new alerting features including built-in anomaly detection and scalability improvements to support tens of thousands of alerts.

## Approach / What changed

The anomaly detection uses z-scores with a moving average of seven historical one-minute buckets for expected value and a two-hour baseline for standard deviation, plus a 5% minimum change threshold. The alerting scheduler was improved with sharding to distribute evaluation across multiple workers, and a backfill mechanism checks skipped evaluations.

## Takeaways

- Anomaly detection in ClickStack uses z-scores with separate periods for mean (short moving average) and standard deviation (longer baseline) to avoid false positives from stable metrics.
- A 5% minimum change threshold relative to the expected value prevents tiny fluctuations from triggering alerts even when the z-score is high.
- The alerting scheduler now uses sharding to evaluate tens of thousands of alerts across multiple workers, with a backfill mechanism for skipped evaluations.

## FAQ

### How does ClickStack anomaly detection avoid false positives from stable metrics?

It calculates the expected value from a moving average of seven one-minute buckets and the standard deviation from a two-hour baseline. It also requires at least a 5% change relative to the expected value, preventing tiny fluctuations from triggering alerts.

### Can I preview how often an anomaly alert would have fired?

Yes, the editor includes a 24-hour preview showing the expected range and marking where notifications would have been sent. The preview updates as you adjust the sensitivity.

### What are the limitations of the current anomaly detection?

It may miss gradual deteriorations as the baseline follows them, and it does not account for seasonality or recurring daily/weekly patterns. The post notes these limitations and plans to address them in future releases.

**Tags:** [Alerting](https://yomu.fyi/topic/alerting), [Anomaly Detection](https://yomu.fyi/topic/anomaly-detection), [ClickHouse](https://yomu.fyi/topic/clickhouse), [Monitoring](https://yomu.fyi/topic/monitoring), [Observability](https://yomu.fyi/topic/observability)

- Source: [Clickhouse](https://clickhouse.com/blog/scaling-clickstack-alerting-anomaly-detection)
- Source URL: https://clickhouse.com/blog/scaling-clickstack-alerting-anomaly-detection
- Ingested by Yomu: 2026-10-16T15:00:13.037Z

[Read original post](https://clickhouse.com/blog/scaling-clickstack-alerting-anomaly-detection)