Monitorama
September 20, 2013
390

# Berlin 2013 - Kale Workshop - Abe Stanway

## Monitorama

September 20, 2013

## Transcript

real time?

8. ### Q). How do you analyze a quarter million timeseries for

anomalies in real time?

18. ### Q). How do you get a quarter million timeseries into

Redis on time?

21. ### Graphite’s relay agent original graphite backup graphite [statsd.numStats, [1365603422, 82345]]

pickles [statsd.numStats, [1365603432, 80611]] [statsd.numStats, [1365603412, 73421]]
22. ### Graphite’s relay agent original graphite skyline [statsd.numStats, [1365603422, 82345]] pickles

[statsd.numStats, [1365603432, 80611]] [statsd.numStats, [1365603412, 73421]]

update

bullshit

The Analyzer

The Analyzer

50. ### Basic algorithm: “A metric is anomalous if its latest datapoint

is over three standard deviations above its moving average.”

56. ### Check which bin contains most recent data latest value is

40, tiny bin size, so...anomaly!

63. ### Median absolute deviation (calculate residuals with respect to median instead

of regression line)

68. ### A robust set of algorithms is the current focus of

this project.
69. ### Q). How do you analyze a quarter million timeseries for

correlations?

72. ### “[[975, 1365528530], [643, 1365528540], [750, 1365528550], [992, 1365528560], [580, 1365528570],

[586, 1365528580], [649, 1365528590], [548, 1365528600], [901, 1365528610], [633, 1365528620]]” Use raw timeseries instead of raw graphs

81. ### “975 643 643 750 992 992 992 580” “sharpdecrement flat

increment sharpincrement flat flat shapdecrement” Shape Description Alphabet
82. ### “975 643 643 750 992 992 992 580” “sharpdecrement flat

increment sharpincrement flat flat shapdecrement” Shape Description Alphabet “24 4 4 11 25 25 25 0 1” (normalization step)

88. ### Elasticsearch Details Phrase search for first pass scores across shape

description fingerprints
89. ### Elasticsearch Details Phrase search for first pass scores across shape

description fingerprints Custom FastDTW and euclidian distance plugins to score across the remaining filtered timeseries
90. ### Elasticsearch Structure { :id => “statsd.numStats”, :fingerprint => “sdec inc

sinc sdec”, :values => "10 1 2 15 4" }
91. ### First pass query :match => { :fingerprint => { :query

=> “sdec inc sinc sdec inc”, :type => "phrase", :slop => 20 } } shape description fingerprint
92. ### Refinement query {:custom_score => { :query => <ﬁrst_pass_query>, :script =>

"oculus_dtw", :params => { :query_value => “10 20 20 10 30”, :query_ﬁeld => "values.untouched", }, } raw timeseries