Skip to main content

Field watch

Field watch notices when a sending system quietly stops sending a field. When a feed goes live, NEEV learns how often every field arrives: the fields the mapping reads and every other field in the traffic. It then compares new messages with that pattern and raises a field anomaly when a field that used to arrive reliably goes missing.

A typical cause is an upgrade on the sending side. For example, after an upgrade the patient administration system stops filling in PID-3, the patient identifier. Every message still arrives and is acknowledged, but each one now lacks its identifier. Field watch catches that within one check.

No patient data

Field watch keeps only field positions and percentages, never values. The screens and alert emails never show a patient value.

How a field anomaly is decided​

  • A field is watched when it was in more than 90% of messages when the pattern was learned.
  • A watched field is a field anomaly when it now arrives at least 20 percentage points less often and the drop is at least 99% certain not to be chance, or when it falls below 50% whatever the test says.
  • A smaller or less certain drop shows as Dipping and raises nothing.
  • Fields that come and go, such as next of kin or allergies, are Optional and are never flagged.
  • A field that starts arriving after the pattern was learned is New. It is shown for information and never alerted.

The check runs every 15 minutes on the newest messages of each feed.

See a feed's fields​

  1. Open Health and find the Field watch panel, or select View fields on a field anomaly banner.
  2. Select the feed. The Field watch dialog opens.

The field watch for a feed with one field anomaly

  • Anomalies lists the watched fields, with the missing and dipping ones first. Each row shows the field, its name, the Learned rate and the rate Now. Fields that no mapping reads carry Not mapped; they are watched all the same.
  • All fields lists every field the feed carries, grouped by segment, with Learned, Now, Change, Confidence and a status. Filter by Anomalies, Watched, Optional, New or Not mapped, or search by name.
  • Check now runs the check straight away instead of waiting for the next one.
Rehearse it on a staging workspace

On local and staging workspaces, a feed can be a simulated feed. Its dialog has a Simulated traffic panel that plays the sending system: Stop sending PID-3 sends 10 messages with the chosen fields empty, Send normal traffic sends 50 realistic messages, and Send alert now runs your field anomaly rules straight away. Field watch is not told which fields were dropped; it finds them the way it would on a real feed. The panel never appears on a production feed.

See the evidence​

Select Open analysis in the dialog, or Field watch in the left sidebar, then pick the feed.

Field watch analysis: learned against now, with 95% intervals

  1. The figures at the top: messages analysed, how many the pattern was learned from, how many were compared now, how many fields are watched, how many anomalies there are, and Completeness, the average share of watched fields each message carried.
  2. Learned vs now, with 95% intervals: one row per field. The grey bar is the learned share and the coloured bar is the share now, each drawn as the range the true share is likely in. Bars that pull apart are a real change; overlapping bars are noise.
  3. Over time: select any row to chart that field batch by batch, with its 95% band, the learned rate as a dashed line, and the learned period shaded.

PID-3 over time: it stops arriving at a batch, then comes back

  1. Every field, batch by batch: a heatmap of every field. A field that stopped turns red from the batch it stopped in. Tick Show optional and new fields to include fields that come and go.

Every field, batch by batch

  1. Further down, Event mix and Fields per message compare the traffic itself, so a change in message types is not mistaken for a lost field, and The numbers lists the counts, intervals and test result for every field.

When the sender is fixed​

Once the field arrives again in the newest messages, the next check marks it Arriving again, the Health banner goes, and the alert is cleared with a RESOLVED email.

Re-learn​

If the sending system stopped a field on purpose, select Re-learn in the field watch dialog. The newest messages become the new normal. If a field is missing when you re-learn, NEEV asks first, because that field will stop being watched and its alert will clear.

Get an email​

Field anomalies are emailed by an alert rule. One rule covers every field on every feed. See Alerts.