Window enrichment and statistics - ChronusQL

Enrich events instead of reducing them

Aggregate output

GROUP BY window

Many source events become one result row.

SELECT driver, AVG(speed) ...
GROUP BY driver, TumblingWindow(...)

Per-event output

WINDOW BY ... COMPUTE

Every source event keeps its identity and gains computed fields.

SELECT speed, avg_speed ...
WINDOW BY driver, TumblingWindow(...)
COMPUTE avg_speed = AVG(telemetry.speed)

Partitioned per-event averageChronusQL

SELECT ts, driver, speed, avg_speed
INTO output
FROM telemetry TIMESTAMP BY ts
WINDOW BY driver, TumblingWindow(Duration(second, 10))
COMPUTE avg_speed = AVG(telemetry.speed)

Filter with computed context

The WHERE that follows COMPUTE can reference computed aliases. This allows a query to score every event against its own window before deciding whether to emit it.

Simple z-score style filterChronusQL

SELECT * INTO anomalies
FROM input TIMESTAMP BY ts
WINDOW BY TumblingWindow(Duration(minute, 1))
COMPUTE mean_value = AVG(input.value),
        deviation = STDDEV(input.value)
WHERE deviation > 0
  AND (value - mean_value) / deviation > 1.7

Statistical toolkit

Function	Question it answers
`AVG` / `STDDEV`	How far is this event from the window's center and spread?
`PERCENTILE(field, p)`	Is this event above a selected tail threshold?
`MEDIAN` / `MAD`	Is this event unusual under robust statistics?
`REGRESSION_SLOPE(x, y)`	How does `y` trend as `x` changes?
`REGRESSION_INTERCEPT(x, y)`	Where does the fitted line cross its baseline?