# Autonomous FinOps Sentinel: Orchestrating TimescaleDB Anomaly Detection with Google Gemini AI in Kestra

> Source: <https://dev.to/satanic47/autonomous-finops-sentinel-orchestrating-timescaledb-anomaly-detection-with-google-gemini-ai-in-2m2n>
> Published: 2026-10-14 23:27:14+00:00

What I Built

For this week's Hacktoberfest Open-Source AI & Database Challenge, I built and submitted an official community blueprint to Kestra

: the Autonomous TimescaleDB + Gemini AI FinOps Sentinel.

It creates a real-time, automated financial surveillance system that monitors cloud spending timeseries in TimescaleDB Continuous Aggregates (CAGGs), detects statistical spending spikes, invokes Google Gemini 1.5 Flash for contextual root-cause diagnosis, and orchestrates remediation alerts directly into Slack.

🐙 Upstream Pull Request: kestra-io/blueprints (Timescale + Gemini Sentinel)

🐯 Database Engine: TimescaleDB / Tiger Cloud

🤖 AI Engine: Google Gemini 1.5 Flash API

⚡ Workflow Orchestrator: Kestra

The Problem: The "Silent Cloud Bill Surge"

Every engineering team has experienced the dreaded end-of-month cloud billing surprise:

Uncoordinated Provisioning: A developer spins up on-demand GPU clusters (p4d.24xlarge) or an unthrottled LLM embedding pipeline, forgetting to terminate it on Friday night.

Static Alert Fatigue: Traditional alerts rely on rigid threshold rules (e.g., "notify if spend > $1,000"). When baseline traffic naturally grows, alerts cry wolf and engineers ignore them.

Missing Context: A raw metric alert like [ALERT] Spend is $3,200 doesn't explain why it spiked or what to do, forcing on-call engineers to spend hours triaging raw AWS/GCP dashboards.

The Architecture

[TimescaleDB Hypertables & CAGGs]

              │

              ▼ (Hourly Rollups)

[Statistical Z-Score Anomaly Isolation]

              │

              ▼ (Anomaly JSON Payload)

[Google Gemini 1.5 Flash Root-Cause Diagnosis]

              │

              ▼ (Structured JSON: Severity + Remedy)

[Kestra Declarative Flow Control (If Severity >= HIGH)]

        ┌─────┴─────┐

        ▼           ▼

  [CRITICAL/HIGH]  [NOMINAL]

        │           │

        ├─► [Slack Block Kit Alert]

        └─► [Kestra Audit Trail KV Store]

How It Works in Kestra

The entire pipeline is orchestrated as an event-driven declarative workflow in Kestra (timescale-gemini-financial-anomaly-sentinel.yaml):

The workflow triggers at the top of every hour (io.kestra.plugin.core.trigger.Schedule). It calculates rolling standard deviations over recent hourly buckets from Timescale continuous aggregates:

for cat in categories:

    mean = sum(baseline_spends) / len(baseline_spends)

    variance = sum((x - mean) ** 2 for x in baseline_spends) / len(baseline_spends)

    std_dev = math.sqrt(variance) if variance > 0 else 1.0

    z_score = (current_spend - mean) / std_dev

    if z_score >= threshold:

        anomalies.append({

            "category": cat,

            "current_spend_usd": round(current_spend, 2),

            "historical_mean_usd": round(mean, 2),

            "z_score": round(z_score, 2),

            "percentage_spike": round(((current_spend - mean) / mean) * 100, 1),

            "vendor_hints": ["AWS US-East GPU instances", "Overlapping on-demand EC2 clusters"]

        })

Rather than sending a cryptic number to Slack, the anomaly vector is dispatched to Google Gemini 1.5 Flash. Gemini evaluates historical variance, correlates vendor hints, and outputs a structured incident response:

json

{

  "severity": "CRITICAL",

  "summary": "Cloud Infrastructure spend surged by 470% (Z-Score: 4.2) due to uncoordinated on-demand GPU instance provisioning.",

  "remediation_action": "Audit active AWS us-east EC2 clusters and terminate orphaned p4d.24xlarge on-demand instances immediately.",

  "urgency_score": 9

}

Kestra's io.kestra.plugin.core.flow.If evaluates the urgency returned by Gemini:

If CRITICAL or HIGH: It formats an interactive Slack Block Kit alert directed at #finops-alerts with the exact remediation steps, and commits the incident ID into Kestra's persistent KV store.

If LOW or MODERATE: It silently logs nominal status, completely eliminating alert fatigue.

yaml

Key Lessons & Hacktoberfest Takeaways

Continuous Aggregates in Timescale + AI = Real-Time FinOps: Calculating rolling metrics on raw transaction tables takes hundreds of milliseconds; Timescale's continuous aggregates pre-compute the time buckets, enabling sub-millisecond anomaly feeds into Gemini.

AI-Enriched Alerts Change Incident Response: An on-call engineer receiving a pre-diagnosed Slack notification with immediate action items can resolve incidents in minutes rather than spending hours chasing dashboard charts.

Open-Source Power: By packaging this as an upstream Kestra Blueprint, any team running Kestra and PostgreSQL can deploy this automated sentinel in under 5 minutes.

Built with TimescaleDB, Google Gemini, and Kestra for Hacktoberfest 2026!