Kapacitor anamoly detection with Morgoth

Telegraf
1

{“id”:“cpu:nil”,“message”:“cpu:nil is INFO”,“details”:"{\u0026#34;Name\u0026#34;:\u0026#34;cpu\u0026#34;,\u0026#34;TaskName\u0026#34;:\u0026#34;pilotmogroth\u0026#34;,\u0026#34;Group\u0026#34;:\u0026#34;nil\u0026#34;,\u0026#34;Tags\u0026#34;:null,\u0026#34;ServerInfo\u0026#34;:{\u0026#34;Hostname\u0026#34;:\u0026#34;localhost\u0026#34;,\u0026#34;ClusterID\u0026#34;:\u0026#34;4dac1e81-43f4-4130-ad0c-7c71fd46f714\u0026#34;,\u0026#34;ServerID\u0026#34;:\u0026#34;34416692-d818-4d99-82a5-8c2f49b80c6e\u0026#34;},\u0026#34;ID\u0026#34;:\u0026#34;cpu:nil\u0026#34;,\u0026#34;Fields\u0026#34;:{\u0026#34;anomalous\u0026#34;:False,\u0026#34;anomaly_score\u0026#34;:0.6666666666666667,\u0026#34;usage_guest\u0026#34;:0,\u0026#34;usage_guest_nice\u0026#34;:0,\u0026#34;usage_idle\u0026#34;:88.42281879209804,\u0026#34;usage_iowait\u0026#34;:0.03355704697984836,\u0026#34;usage_irq\u0026#34;:0,\u0026#34;usage_nice\u0026#34;:0,\u0026#34;usage_softirq\u0026#34;:0.01677852348992418,\u0026#34;usage_steal\u0026#34;:0,\u0026#34;usage_system\u0026#34;:1.0738255033551476,\u0026#34;usage_user\u0026#34;:10.453020134225435},\u0026#34;Level\u0026#34;:\u0026#34;INFO\u0026#34;,\u0026#34;Time\u0026#34;:\u0026#34;2018-12-17T11:49:00Z\u0026#34;,\u0026#34;Duration\u0026#34;:0,\u0026#34;Message\u0026#34;:\u0026#34;cpu:nil is INFO\u0026#34;}\n",“time”:“2018-12-17T11:49:00Z”,“duration”:0,“level”:“INFO”,“data”:{“series”:[{“name”:“cpu”,“columns”:[“time”,“anomalous”,“anomaly_score”,“cpu”,“host”,“usage_guest”,“usage_guest_nice”,“usage_idle”,“usage_iowait”,“usage_irq”,“usage_nice”,“usage_softirq”,“usage_steal”,“usage_system”,“usage_user”],“values”:[[“2018-12-17T11:49:00Z”,False,0.6666666666666667,“cpu0”,“ip-172-31-46-193”,0,0,88.42281879209804,0.03355704697984836,0,0,0.01677852348992418,0,1.0738255033551476,10.453020134225435],[“2018-12-17T11:49:00Z”,False,0.6666666666666667,“cpu1”,“ip-172-31-46-193”,0,0,93.27020629000843,0.01690902942175465,0,0,0.13527223537346053,0,0.9638146770356899,5.613797767995248],[“2018-12-17T11:49:00Z”,False,0.6666666666666667,“cpu-total”,“ip-172-31-46-193”,0,0,90.86850307484256,0.01684778030493479,0,0,0.06739112121983491,0,1.0108668182960872,8.036391205468068]]}]},“previousLevel”:“OK”,“recoverable”:True}
{“id”:“cpu:nil”,“message”:“cpu:nil is INFO”,“details”:"{\u0026#34;Name\u0026#34;:\u0026#34;cpu\u0026#34;,\u0026#34;TaskName\u0026#34;:\u0026#34;pilotmogroth\u0026#34;,\u0026#34;Group\u0026#34;:\u0026#34;nil\u0026#34;,\u0026#34;Tags\u0026#34;:null,\u0026#34;ServerInfo\u0026#34;:{\u0026#34;Hostname\u0026#34;:\u0026#34;localhost\u0026#34;,\u0026#34;ClusterID\u0026#34;:\u0026#34;4dac1e81-43f4-4130-ad0c-7c71fd46f714\u0026#34;,\u0026#34;ServerID\u0026#34;:\u0026#34;34416692-d818-4d99-82a5-8c2f49b80c6e\u0026#34;},\u0026#34;ID\u0026#34;:\u0026#34;cpu:nil\u0026#34;,\u0026#34;Fields\u0026#34;:{\u0026#34;anomalous\u0026#34;:False,\u0026#34;anomaly_score\u0026#34;:0.75,\u0026#34;usage_guest\u0026#34;:0,\u0026#34;usage_guest_nice\u0026#34;:0,\u0026#34;usage_idle\u0026#34;:97.1946917519887,\u0026#34;usage_iowait\u0026#34;:0.01679825298166674,\u0026#34;usage_irq\u0026#34;:0,\u0026#34;usage_nice\u0026#34;:0,\u0026#34;usage_softirq\u0026#34;:0.03359650596338123,\u0026#34;usage_steal\u0026#34;:0,\u0026#34;usage_system\u0026#34;:0.4199563245420505,\u0026#34;usage_user\u0026#34;:2.334957164452823},\u0026#34;Level\u0026#34;:\u0026#34;INFO\u0026#34;,\u0026#34;Time\u0026#34;:\u0026#34;2018-12-17T11:50:00Z\u0026#34;,\u0026#34;Duration\u0026#34;:60000000000,\u0026#34;Message\u0026#34;:\u0026#34;cpu:nil is INFO\u0026#34;}\n",“time”:“2018-12-17T11:50:00Z”,“duration”:60000000000,“level”:“INFO”,“data”:{“series”:[{“name”:“cpu”,“columns”:[“time”,“anomalous”,“anomaly_score”,“cpu”,“host”,“usage_guest”,“usage_guest_nice”,“usage_idle”,“usage_iowait”,“usage_irq”,“usage_nice”,“usage_softirq”,“usage_steal”,“usage_system”,“usage_user”],“values”:[[“2018-12-17T11:50:00Z”,False,0.75,“cpu0”,“ip-172-31-46-193”,0,0,97.1946917519887,0.01679825298166674,0,0,0.03359650596338123,0,0.4199563245420505,2.334957164452823],[“2018-12-17T11:50:00Z”,False,0.75,“cpu1”,“ip-172-31-46-193”,0,0,97.03991880939247,0.016914749661724262,0,0,0.05074424898517279,0,0.45669824086693966,2.4357239512944475],[“2018-12-17T11:50:00Z”,False,0.75,“cpu-total”,“ip-172-31-46-193”,0,0,97.1012050221856,0.016853459172553143,0,0,0.05056037751741992,0,0.43818993848465726,2.393191202488176]]}]},“previousLevel”:“INFO”,“recoverable”:True}

stream
|from()
.database(‘metricsData’)
.retentionPolicy(‘autogen’)
.measurement(‘cpu’)
|window()
.period(1m)
.every(1m)
@morgoth()
.field(‘usage_idle’)
.scoreField(‘anomaly_score’)
.sigma(3.0)
|alert()
.info(lambda: “anomaly_score” > 0.5)
.crit(lambda: “anomaly_score” > 0.9)
.log(’/tmp/cpu_idle.log’)

Can someone please explain how these 2 alerts got raised.I am kinda new to Morgoth and anamoly detection.