Detect cost anomalies
Learn how Cost Explorer and the dashboard flag days when a service spent more than the median of its previous 14 days plus three median deviations.
A cost anomaly is a day on which a service spent clearly more than on the days before. The console checks every service's daily spend of the last 30 days, and when a day stands out, it shows the warning Unusual spend detected above Cost Explorer and on the dashboard's cost card.
The rule
For each service and each complete day, the console compares the day's spend with the service's spend on the 14 complete days before it:
| Value | How it's calculated |
|---|---|
| Expected spend | The median of the 14 days' spend. |
| Deviation | The median of how far each of the 14 days is from the expected spend (median absolute deviation, MAD). |
| Threshold | Expected spend + 3 × deviation. |
A day is flagged when its spend is higher than the threshold. The warning states the rule: Flagged when a service spends more on a day than the median of its previous 14 days plus 3 × the median absolute deviation.
Example. A service's expected spend is 100 a day, with a deviation of 4. Its threshold is 112: a day with 115 is flagged, and a day with 110 isn't. Amounts are in your subscription's currency.
The median ignores single outliers, so one earlier spike doesn't widen the band and hide the next one.
Which days are judged
- Complete days only. Days run in UTC. Today is only partly metered, so it's never judged.
- Days with a full baseline. The check reads the last 30 days, and a day needs 14 complete days before it in that window. So the last 16 complete days are judged.
- Per service. Services are judged separately: compute, storage, networking, and so on. Projects, regions, and tags aren't judged.
- Days without usage count as zero. A service with spend on fewer than 7 of the 14 days before a day has an expected spend and a deviation of zero, so any spend on that day is flagged. A service that you started using recently is therefore flagged on each of its first 7 days.
- Steady spend. When at least 8 of the 14 days had exactly the same spend, the deviation is zero, so any day above that amount is flagged. Instances that run all day cost the same every day, so adding even one small instance gets the day flagged for compute.
The warning
The warning lists up to three flagged days, newest first, each with the service, the day, the day's spend, and the expected spend, for example Compute on Sep 14: 250.00 (typical 100.00). More flagged days are summed up in one line. Select Review budgets to open your budgets.
The warning always reads the same report, the last 30 days by service and by day, so Cost Explorer and the dashboard flag the same days whatever you select in the controls. It covers the same scope as Cost Explorer: the subscription, or only your project if your role covers one project.
What anomaly detection doesn't do
- No notifications. A flagged day appears in the console only. It doesn't send an email or a webhook. To be alerted, create a budget. See Create budgets and threshold alerts.
- No history or settings. Detection runs in your browser each time you open the page. Flagged days aren't stored, and you can't change the 14 days or the factor of 3.
- No automatic action. Nothing is stopped or limited.
Related tasks
- Analyze spend with Cost Explorer: group by service and expand the flagged service to find the resources behind the day.
- Create budgets and threshold alerts: get an email or webhook before spend passes a limit.