Metric anomaly detection and root cause analysis for PostgreSQL
Give Metron a read-only Postgres role and a timestamp column. It checks whether a KPI really moved, finds the segment behind the change and lists what happened nearby.
Updated · Zello Labs
Metron runs metric anomaly detection and root cause analysis against PostgreSQL. You give it a read-only role, pick a table with a timestamp column, and define a KPI from real columns. When you run a check, Metron decides whether a change is real, finds the segment that holds most of it and lists deploys and events near its start.
What you need
- A PostgreSQL database that Metron can reach from where it runs.
- A role that can SELECT the tables behind your metric. Metron never writes.
- A table with a timestamp column that dates each row.
- A column, or an expression over columns, for the value you want to track.
- The columns you want to slice by, such as region, plan or channel.
- A language model endpoint you supply, for the write-up.
How do you connect Postgres to Metron?
- Open Connections and choose PostgreSQL.
- Enter the host, port, database, username and password.
- Save. Metron tests the connection before it stores anything, and a failed test saves nothing.
- Metron puts the password in a HashiCorp Vault secrets backend, each secret at its own path, outside Metron’s own database. API responses never include it, and deleting the connection deletes the secret.
Browse the schema and see column types
The schema browser has three panes for schemas, tables and columns. Each column shows its Postgres type next to the type Metron detected. In a typical orders table, occurred_at is timestamp with time zone and detected as a timestamp, revenue_usd is numeric, and region is text, detected as categorical. Views appear in the table list alongside base tables.
Define a KPI by pointing at real columns
The metric builder fills its dropdowns from the live schema. An example revenue metric:
| Field | Example value |
|---|---|
| Table | public.orders |
| Timestamp column | occurred_at |
| Value expression | revenue_usd |
| Denominator expression | None. Add one to make the metric a rate. |
| Slice by | region, platform, channel |
Metron adds up the value expression for each time period. With a denominator, it adds up both and divides. A trial conversion rate, for example, uses CASE WHEN converted THEN 1 ELSE 0 END as the value and 1 as the denominator.
Metron validates each expression when you save it. It parses the expression and rebuilds it from the parsed form, so the text that runs against your database is Metron’s own rebuild. It accepts arithmetic, numbers, strings, column names, CASE WHEN and a short list of functions (COALESCE, NULLIF, ABS, ROUND, and CAST to a fixed set of types). It rejects a second statement, a comment, a subquery, any other function and any column the table doesn’t have. The error message says what it found, for example unexpected character ';' at position 11. The timestamp column and slice columns are checked against the same list of real columns.
What does an investigation return?
An investigation starts when you run a check or when someone asks about a change. Before detection, Metron checks the data itself for staleness, a collapse in row count, a spike in nulls and a slice value that disappears. A metric that fails those checks is recorded as a data issue and never reaches detection, so a broken load doesn’t show up as a business anomaly.
| Claim | What you get | Confidence |
|---|---|---|
| Something changed | Expected and actual values, judged after the weekly pattern and trend are removed | Lower for a new metric, which gets a simpler model |
| Where it sits | The segment that holds most of the change, its share, and whether the rate changed or the mix shifted | Scored on its own |
| What happened near it | Deploys and logged events near the start, with the time gap | Scored on its own, labeled as timing only |
| Why | Not claimed | Warehouse data can’t prove cause |
A language model you supply words those findings, and it never sees your tables. Follow-ups are answered from the same evidence. You can mark a result useful or not, and have each write-up sent to a webhook or an email address.
For the general method, read why did my metric drop. To see a full investigation on a rate metric, follow the activation rate example.
Other warehouses
PostgreSQL and Google BigQuery are live. Snowflake is coming soon, and Amazon Redshift and Azure Synapse are planned. If your metrics live in BigQuery, see running Metron on BigQuery.
Metron is in private beta, and we set up each team by hand. If you have a Postgres metric your team can’t explain, request beta access and tell us about it.
Common questions
How do I run anomaly detection on a Postgres metric?
Connect Metron to your database with a read-only role, pick a table, choose its timestamp column, write a value expression over real columns and tick the columns to slice by. When you run a check, Metron compares the metric against its own normal and investigates any change that falls outside it.
What Postgres permissions does Metron need?
A role that can SELECT the tables behind your metrics. Metron never writes to your database. You enter the host, port, database, username and password once. Metron tests the connection before it saves anything, then keeps the password in a HashiCorp Vault secrets backend, outside its own application database.
Can Metron do root cause analysis on a Postgres KPI?
Yes. For any KPI you define, Metron tests each segment of each slice column against that segment's own history and names the one that holds most of the change. It lines the change up with GitHub deploys and logged events, then writes it up. It scores where and when separately and never claims cause.
Does Metron support Snowflake or Redshift?
Not yet. PostgreSQL and Google BigQuery are live today. Snowflake is coming soon, and Amazon Redshift and Azure Synapse are planned. If you run one of those, name it in the beta form. Every request helps decide which connector comes next, and Metron only needs SQL and a timestamp column.