Torch Log Service
Torch Log Service
Torch Log Service
Document
Product News
Product Overview
Product Billing
User Guide
TLS Agent
AgentLoop
Resource management
Host group
Data collection
LogCollector collection
Introduction to LogCollector
Installation and upgrade
Collect host logs
Collect container logs
LogCollector plugins
Manage LogCollector
general reference
Data import
Cloud product log collection
TOS log collection
DBW log collection
VPN Log collection
VKE log collection
CLB log collection
CloudTrail log collection
CFW log collection
NTA log collection
ALB log collection
APMPlus log collection
veFaaS log collection
VPC log collection
veImageX log collection
TrafficRoute DNS log collection
DDoS log collection
WAF log collection
DCDN log collection
Multi-cloud security platform log collection
APIG log collection
Machine learning task log collection
CR log collection
Volcano Ark application lab log collection
FileNAS log collection
LLM Application Firewall Service log collection
vePFS log collection
Cloud security center log collection
EFS log collection
Data storage
Query and analysis
Configure log indexes
Query log
Analyze logs
Query and analyze logs using third-party tools
Associate external data source for log query
SQL function
SQL syntax
Visualization
Query and analysis charts
Summaries of query and analysis charts
Create dashboard
Use dashboard
Add dashboard filters and variables
Use other systems to analyze logs
Log application
Log applications for product observability
Log applications for large models observability
Coding Agent log app
ModelProvider log app
No-coding Agent log app
Log applications for basic service monitoring
Data processing
Data transformation
Syntax and functions
Global operation function
expression function
Data processing best practices
general reference
Data write processor
Data consumer processor
Data consumption and shipping
Ship logs to TOS
Ship logs to Kafka
Ship logs to Splunk
Alarm
Alarm policy
Alarm notification content
Alarm notification content template
alarm notification channel
Tracing service
Monitor Log Service
API reference
Project management API
Topic management API
Shard management API
Index management API
Log management API
Host group management API
Collection configuration management API
Data import API
Data processor API
Data transformation API
Data backflow API
SQL analysis API
Alarm management API
Consumer group management API
Kafka protocol consumption API
Tag management API
Trace storage API
Account management API
SDK reference
Go SDK
Java SDK
Python SDK
iOS SDK
C++ SDK
CLI reference
Best practices
Data collection
Query and analysis
permission management
Consumption and delivery
Visualization
Alarm
FAQs
Billing and cost FAQ
Data collection FAQ
Data storage FAQ
Index configuration FAQ
Query and analysis FAQ
Scheduled SQL tasks FAQ
Alarm FAQ
- Documentation
Torch Log ServiceUser GuideQuery and analysisMachine learning functionPrediction and anomaly detection function
Copy page
Download PDFMachine learning function
Prediction and anomaly detection function
Copy pageDownload PDFPrediction and anomaly detection function
This topic introduces the syntax and common usage examples of prediction and anomaly detection functions supported in TLS.
Notice
Currently, machine learning functions are in public beta.
Function list
Function | Description |
Function | Description |
Quickly identifies anomaly curves by filtering anomaly detection results with custom exception patterns. | |
Completes model data and performs forecasting and anomaly detection using default parameters. | |
Completes model data and conducts predictions and anomaly detection with autoregressive models. | |
Conducts accurate prediction on time series data with periodic characteristics. | |
Filters anomaly detection results based on defined anomaly patterns to quickly identify exception curves. |
ts_anomaly_filter
The ts_anomaly_filter function filters anomaly detection results by custom exception patterns, efficiently identifing anomalous curves.
Function syntax
- Syntax format
- select ts_anomaly_filter(lineName, ts, ds, preds, probs, nWatch, anomalyType)
- Parameters description
- ParametersData typeDescriptionParametersData typeDescriptionlineNamevarcharName of the curve.tsarray (double)Time series: the time information for the current curve, arranged in ascending order.dsarray (double)Actual value series: the numerical information for the current curve. The length must match the ts parameter.predsarray (double)Predicted value sequence, i.e., the predicted values of the current curve. The length must match the ts parameter.probsarray (double)Anomaly detection sequence, i.e., the anomaly detection results for the current curve. The length must match the ts parameter.nWatchlongThe number of actual values that are observed most recently in the current curve. The length must be less than the actual length of the curve, that is, less than the length of the ts parameter.anomalyTypelongException types that need to be filtered.
- 0: All abnormalities.
- 1: Rising edge abnormality.
- -1: Falling edge abnormality.
- Return values
- If the input value is NULL, the function returns NULL.
Function examples
- Query and analysis statements
- *| SELECT res.name, res.ts, res.ds, res.preds, res.probs FROM (select ts_anomaly_filter(name, ts, ds, preds, probs, cast(1 as bigint), cast(1 as bigint)) as res from (select 'aa' as name, array[1731294220,1731294221,1731294222] as ts, array[1,2,3] as ds, array[3,2,1] as preds, array[4,4,4] as probs ))
- Query and analysis results
-
ts_predicate_simple
The ts_predicate_simple function completes data modeling using default parameters to predicts outcomes, and detects anomalies.
Function syntax
- Syntax format
- ts_predicate_simple(x, y, nPred, isSmooth)
- Parameters description
- ParametersData typeDescriptionParametersData typeDescriptionxStringColumn name of the time column. The format is a Unixtime timestamp; measured in seconds.yStringColumn name of the value column. Each value represents the corresponding data at a specific time.nPredLongNumber of future data points. Value must be greater than or equal to 1.isSmoothBooleanDetermines whether the original data needs to be smoothed.The value is true by default, meaning the original data will be smoothed.
- Return values
- If the input value is NULL, the function returns NULL.
Function examples
- Query and analysis statements
- *| SELECT ts_predicate_simple(stamp, value, 10) FROM(SELECT stamp, value LIMIT 500)
- Query and analysis results
-
- Result columnDescriptionResult columnDescriptionunixtimeTime column, measured in seconds.srcOriginal data.predictThe data that is obtained from prediction.upperUpper bound of predicted data. The current confidence level is fixed at 0.85.lowerLower bound of predicted data. The current confidence level is fixed at 0.85.anomaly_probThe probability that this data point is an anomaly point.
ts_predicate_ar
The ts_predicate_ar function uses an autoregressive model for data modeling, forecasting, and anomaly detection.
Function syntax
- Syntax format
- ts_predicate_ar(x, y, p, nPred, isSmooth)
- Parameters description
- ParametersData typeDescriptionParametersData typeDescriptionxStringColumn name of the time column. The format is a Unixtime timestamp; measured in seconds.yStringColumn name of the value column. Each value represents the corresponding data at a specific time.pLongThe order of the autoregressive model. The value range is 2 to 8.nPredLongNumber of future data points. The value range is 1 to 5*p.isSmoothBooleanDetermines whether the original data needs to be smoothed.The value is true by default, meaning the original data will be smoothed.
- Return values
- If the input value is NULL, the function returns NULL.
Function examples
- Query and analysis statements
- *| SELECT ts_predicate_ar(stamp, value, 6,10) FROM(SELECT stamp, value LIMIT 500)
- Query and analysis results
-
- Result columnDescriptionResult columnDescriptionunixtimeTime column, measured in seconds.srcOriginal data.predictThe data that is obtained from prediction.upperUpper bound of predicted data. The current confidence level is fixed at 0.85.lowerLower bound of predicted data. The current confidence level is fixed at 0.85.anomaly_probThe probability that this data point is an anomaly point.
ts_predicate_arima
The ts_predicate_arima function accurately predicts periodic time series data.
Function syntax
ts_predicate_arima(x, y, p, d, q, nPred, isSmooth)
The parameters are described as follows:
Parameters | Data type | Description |
Parameters | Data type | Description |
x | String | Column name of the time column. The format is a Unixtime timestamp; measured in seconds. |
y | String | Column name of the value column. Each value represents the corresponding data at a specific time. |
p | Long | The order of the autoregressive model. The value range is 2 to 8. |
d | Long | The order of the differenced model. The value range is 1 to 3. |
q | Long | The order of the moving average model. The value range is 2 to 8. |
nPred | Long | Number of future data points. The value range is 1 to 5*p. |
isSmooth | Boolean | Determines whether the original data needs to be smoothed. The value is true by default, meaning the original data will be smoothed. |
- Return values
- If the input value is NULL, the function returns NULL.
Function examples
- Query and analysis statements
- *| SELECT ts_predicate_arima(stamp, value, 6,1,4,10) FROM(SELECT stamp, value LIMIT 500)
- Query and analysis results
-
- Result columnDescriptionResult columnDescriptionunixtimeTime column, measured in seconds.srcOriginal data.predictThe data that is obtained from prediction.upperUpper bound of predicted data. The current confidence level is fixed at 0.85.lowerLower bound of predicted data. The current confidence level is fixed at 0.85.anomaly_probThe probability that this data point is an anomaly point.
ts_regression_predict
The ts_regression_predict function detects exceptions in time series data and filters the results based on defined exception patterns. This helps quickly identify abnormal curves.
Function syntax
- Syntax format
- ts_regression_predict(x, y, nPred, algotype,processType)
- Parameters description
- ParametersData typeDescriptionParametersData typeDescriptionxStringColumn name of the time column. The format is a Unixtime timestamp; measured in seconds.yStringColumn name of the value column. Each value represents the corresponding data at a specific time.nPredLongNumber of future data points. The value range is 1–500.algotypeStringPrediction algorithm types; options include:
- origin: Use the GBRT (Gradient Boosted Regression Tree) algorithm for prediction.
- forest: Using the results of STL time series decomposition, predict the decomposed trend series via the GBRT algorithm. The decomposed series are then summed and returned according to the additive model.
- linear: Using the results of STL time series decomposition, predict the decomposed trend series via the Linear Regression algorithm. The decomposed series are then summed and returned according to the additive model.
processTypeStringData preprocessing types. Optional values include:- 0: No additional data preprocessing.
- 1: Remove anomaly from the data before prediction processing.
- Return values
- If the input value is NULL, the function returns NULL.
Function examples
- Query and analysis statements
- * | SELECT ts_regression_predict(stamp, value, 200, 'forest', 0) FROM(SELECT stamp, value LIMIT 500)
- Query and analysis results
-
- Result fieldDescriptionResult fieldDescriptionunixtimeTime column, measured in seconds.srcOriginal data.predictThe data that is obtained from prediction.
Last updated: 2026.05.07 17:31:09
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
