WITH avg_runtimes AS (
  SELECT
    resource.labels.function_name AS function_name
    , AVG(CAST(REGEXP_EXTRACT(textPayload, r"\d+") AS INT64)) AS avg_runtime
  FROM `<dataset_id>.logging.cloudfunctions_googleapis_com_cloud_functions_*`
  WHERE _TABLE_SUFFIX BETWEEN '20190101' AND '20190315'
    AND REGEXP_CONTAINS(textPayload, r"^Function execution took \d+ ms.*")
  GROUP BY resource.labels.function_name
)
SELECT
  resource.labels.function_name
  , labels.execution_id
  , timestamp
  , CAST(REGEXP_EXTRACT(textPayload, r"\d+") AS INT64) AS runtime
  , avg_runtime
  , (CAST(REGEXP_EXTRACT(textPayload, r"\d+") AS INT64) - avg_runtime) AS delta_ms
  , (((CAST(REGEXP_EXTRACT(textPayload, r"\d+") AS INT64)) - avg_runtime)/avg_runtime) * 100 AS delta_pct
FROM
  `<dataset_id>.logging.cloudfunctions_googleapis_com_cloud_functions_*` AS cf_logs
  JOIN avg_runtimes ON avg_runtimes.function_name = cf_logs.resource.labels.function_name
WHERE REGEXP_CONTAINS(textPayload, r"^Function execution took \d+ ms.*")
  AND CAST(REGEXP_EXTRACT(textPayload, r"\d+") AS INT64) > avg_runtime * 1.3
ORDER BY delta_pct DESC