Insights

Everything that arrives becomes an event, and the event log is the honest record of what your systems actually did. Insights is the view over that record: how much is arriving, whether it is changing, and whether today looks like a normal day.

It answers a narrow but useful question — is this normal? — without you having to define what normal is.

Why it is worth looking at

Integrations fail quietly. A webhook stops firing because a token expired, a system is taken out of service, a scheduled export silently doubles. None of these raise an error in RunDis: nothing broke here, the events simply stopped arriving, or started arriving twice as fast.

Volume is the signal that catches those. A provider that sent 400 events a day for a month and sent 4 today has a problem somewhere upstream, and the event log knows before anyone files a ticket.

Volume, and the trailing average

The Insights page charts event volume in buckets — hourly, daily or weekly, picked with the range. Over a longer range the buckets widen, because ninety days of hourly bars is two thousand of them and no one can read that.

Buckets are gap-filled: a period with no events shows as a zero rather than vanishing, which is the entire point when you are looking for a provider that went quiet.

Drawn alongside is a trailing average over the preceding buckets. It is the line the volume is compared against, which is why the two share an axis — an anomaly is a bar sitting far from that line, and separating them would hide the relationship being asserted.

All buckets are UTC. A daily bucket is a UTC day, not a day in your timezone.

Anomalies

An anomaly is a bucket whose volume sits far from the average, measured in standard deviations:

Deviation	Severity
More than 2σ	Warning
More than 3σ	Critical

Each one is listed with the count, the expected count, and the deviation, so the severity is something you can check rather than something you are asked to trust.

Two honest limits on what that means:

• It needs history. Fewer than three buckets produces nothing, and a provider connected yesterday has no normal to deviate from yet.
• Perfectly steady volume produces no anomalies at all, even for a large number. If every bucket is identical the standard deviation is zero, and nothing can be far from the average.

A spike is not automatically a problem, and a drop is not automatically a failure. An anomaly says this is unlike the recent past, and what that means is yours to judge.

Running it

Aggregation happens when something asks for it — opening the page, or querying the API. Nothing is precomputed and nothing runs on a schedule.

That has a consequence worth knowing: nothing alerts you about an anomaly. An anomaly is visible when you look. If you want to be told, poll eventAnomalies from something that can notify you. Correlations are different: each new one is published and can fire a trigger (see Correlation), its row links to the runs that trigger started — or says it fired none — and a phone that asked for it under Notifications is told the moment one is published.

Correlation messages from the built-in Correlations provider are events, so they count towards volume like any other provider's.

What this is not

• Not forecasting. There is no prediction of future volume, and no model. The arithmetic is a moving average and a standard deviation over what already happened.
• Not per-provider health. Volume can be filtered to a provider, but there is no uptime, latency or success-rate tracking.
• Not the same as run history. Insights counts events arriving. Whether a workflow succeeded is in Workflows and steps.

For finding related events across two providers rather than measuring one, see Correlation.