find_cost_change_factors
Find which dimension values drove a cost change between two periods. This is a before/after analysis — compare is required ({} auto-derives the previous window, same as query). Prefer suggest_groupby / search / get_context first, then pass 2–4 columns (max 8). Do not invent columns. filterCel omitted or "" is unfiltered (not AWS-only). nestingEdges: a child's spend sits inside the parent — do not sum a contributor with its ancestors or descendants; independent contributors may be summed. Prefer omitting aggregationMethod (SUM).
EXAMPLES:
• "Why did last month's EC2 cost change?" → { datePreset: "LAST_MONTH", compare: {}, filterCel: "cos_service_name in ["AmazonEC2"]", columns: ["cos_region", "cos_usage_type"] }
• "What drove the RDS jump in May?" → { from: "2026-05-01", to: "2026-05-31", compare: { from: "2026-04-01", to: "2026-04-30" }, filterCel: "cos_provider in ["AWS"] && cos_service_name in ["AmazonRDS"]", columns: ["cos_sub_account_id", { column: "cos_charge_description", contains: "IOPS" }] }
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Current period end (YYYY-MM-DD), inclusive. Omit when using datePreset. | |
| from | No | Current period start (YYYY-MM-DD). Omit when using datePreset. | |
| slug | No | Organization slug. Omit to auto-detect from your account (fails if you belong to multiple orgs). | |
| columns | Yes | 2–4 dimensions to investigate (max 8). Prefer suggest_groupby / search / get_context names (e.g. "cos_service_name"), or { column, contains } for a single-token substring (e.g. { column: "cos_charge_description", contains: "GPU" }). Do not invent columns. | |
| compare | Yes | Previous period. `{}` auto-derives from the current window (same helper as query). `{ from, to }` pins it. | |
| filterCel | No | Optional CEL scope. Omit or "" for unfiltered (Billy where_clause TRUE). That is not an AWS-only filter even though columns_where_clause falls back to ["cos_provider"]. | |
| datePreset | No | ||
| aggregationMethod | No | Prefer omitting this (SUM). AVG is rarely right for cost. |