Repository Docs & Knowledge Base

id: 019cb9fd-149b-7d64-9312-bc042987c6ca name: Order Surge Monitor kind: Anomaly cron: 0 0 * * * * analysis_window: 1h comparison_periods: [1d, 7d]

Detect sudden surges in order volume -- when the order arrival rate spikes well above the expected rate for the time of day.

Known Tables & Columns

curated.kitchen_orders

• guid (varchar, PK) - order identifier
• store_guid (varchar) - which store/restaurant
• items_count (int) - number of items in the order
• order_type (varchar) - DINE_IN, TO_GO, DELIVERY
• destination (varchar) - Kitchen, Bar, Window, Expo
• pos_terminal (varchar) - POS terminal that created the order (POS-1, POS-2, POS-3, Bar, Drive-Thru)
• done (tinyint) - whether the order is complete
• is_deleted (tinyint) - soft delete flag
• create_time (int, unix timestamp) - when the order was created
• is_priority (tinyint) - whether the order is priority

Analysis Approach

1. Count the number of orders created in the last {AnalysisWindow} from curated.kitchen_orders, grouped into 15-minute buckets using create_time (is_deleted=0).
2. Compute the historical baseline: for the same 15-minute windows {ComparisonPeriods}, calculate the average and standard deviation of order counts.
3. Verify that each baseline window has at least 15 orders. If the baseline is too sparse, call emit_no_anomaly — low-volume periods naturally have high variance.
4. Flag any 15-minute window where the order count exceeds the baseline by more than 3 standard deviations AND is at least 3x the baseline average.
5. A true order surge should show a sudden, sharp increase sustained over 3+ consecutive windows, not just a single high-count bucket. A single elevated window is NOT an anomaly.
6. Optionally break down by order_type or pos_terminal to identify the source of the surge (e.g., a rush of delivery orders, or all orders coming from Drive-Thru).
7. Check whether the elevated volume correlates with increased kitchen load (longer prep times, order backlog).

Severity Guidance

• Low: 3x the expected arrival rate sustained for 3+ consecutive windows
• Medium: 3x+ the expected arrival rate sustained over 4+ consecutive windows with early signs of kitchen strain
• High: 3x+ arrival rate sustained for 15+ minutes with visible impact on kitchen throughput (e.g., growing order backlog, increased prep times)