Class: Fluent::AnomalyDetectOutput
- Inherits:
-
Output
- Object
- Output
- Fluent::AnomalyDetectOutput
- Defined in:
- lib/fluent/plugin/out_anomalydetect.rb
Instance Attribute Summary collapse
-
#threshold_proc ⇒ Object
readonly
Returns the value of attribute threshold_proc.
-
#thresholds ⇒ Object
readonly
for test.
Instance Method Summary collapse
- #configure(conf) ⇒ Object
- #emit(tag, es, chain) ⇒ Object
- #flush ⇒ Object
- #flush_each(records, tag, target = nil) ⇒ Object
- #flush_emit(step) ⇒ Object
- #get_score(val, tag, target = nil) ⇒ Object
- #get_value(records, target = nil) ⇒ Object
- #init_records(tags) ⇒ Object
- #load_from_file ⇒ Object
- #outlier_bufs(tag, target = nil) ⇒ Object
- #outliers(tag, target = nil) ⇒ Object
- #push_records(tag, records) ⇒ Object
- #scores(tag, target = nil) ⇒ Object
- #shutdown ⇒ Object
- #start ⇒ Object
- #start_watch ⇒ Object
- #store_to_file ⇒ Object
- #watch ⇒ Object
Instance Attribute Details
#threshold_proc ⇒ Object (readonly)
Returns the value of attribute threshold_proc.
143 144 145 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 143 def threshold_proc @threshold_proc end |
#thresholds ⇒ Object (readonly)
for test
142 143 144 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 142 def thresholds @thresholds end |
Instance Method Details
#configure(conf) ⇒ Object
44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 44 def configure (conf) super unless 0 < @outlier_discount and @outlier_discount < 1 raise Fluent::ConfigError, "discount ratio should be between (0, 1)" end unless 0 < @score_discount and @score_discount < 1 raise Fluent::ConfigError, "discount ratio should be between (0, 1)" end if @outlier_term < 1 raise Fluent::ConfigError, "outlier term should be greater than 0" end if @score_term < 1 raise Fluent::ConfigError, "score term should be greater than 0" end if @smooth_term < 1 raise Fluent::ConfigError, "smooth term should be greater than 0" end if @tick < 1 raise Fluent::ConfigError, "tick timer should be greater than 1 sec" end if @suppress_tick < 0 raise Fluent::ConfigError, "`suppress_tick` must be greater or equal to 0 sec" end if @store_file f = Pathname.new(@store_file) if (f.exist? && !f.writable_real?) || (!f.exist? && !f.parent.writable_real?) raise Fluent::ConfigError, "#{@store_file} is not writable" end end case @aggregate when 'all' raise Fluent::ConfigError, "anomalydetect: `tag` must be specified with aggregate all" if @tag.nil? when 'tag' raise Fluent::ConfigError, "anomalydetect: `add_tag_prefix` must be specified with aggregate tag" if @add_tag_prefix.nil? else raise Fluent::ConfigError, "anomalydetect: aggregate allows tag/all" end @tag_prefix = "#{@add_tag_prefix}." if @add_tag_prefix @tag_prefix_match = "#{@remove_tag_prefix}." if @remove_tag_prefix @tag_proc = if @tag_prefix and @tag_prefix_match Proc.new {|tag| "#{@tag_prefix}#{lstrip(tag, @tag_prefix_match)}" } elsif @tag_prefix_match Proc.new {|tag| lstrip(tag, @tag_prefix_match) } elsif @tag_prefix Proc.new {|tag| "#{@tag_prefix}#{tag}" } elsif @tag Proc.new {|tag| @tag } else Proc.new {|tag| tag } end if @target and @targets raise Fluent::ConfigError, "anomalydetect: Either of `target` or `targets` can be specified" end if @targets @targets = @targets.split(',') end @output_each_proc = if @targets Proc.new {|outlier, score, val, target| {"#{target}#{@outlier_suffix}" => outlier, "#{target}#{@score_suffix}" => score, "#{target}#{@target_suffix}" => val } } else Proc.new {|outlier, score, val, target| {"outlier" => outlier, "score" => score, "target" => val} } end if @threshold and @thresholds raise Fluent::ConfigError, "anomalydetect: Either of `threshold` or `thresholds` can be specified" end if thresholds = @thresholds if @targets.nil? raise Fluent::ConfigError, "anomalydetect: `thresholds` must be specified together with `targets`" end @thresholds = {} thresholds.split(',').map.with_index {|threshold, idx| @thresholds[@targets[idx]]= threshold.to_f } if @thresholds.size != @targets.size raise Fluent::ConfigError, "anomalydetect: The size of `thresholds` must be same with the size of `targets`" end else @threshold = -1.0 if @threshold.nil? # for lower compatibility end @threshold_proc = if @thresholds Proc.new {|target| @thresholds[target] } else Proc.new {|target| @threshold } end @records = {} @outliers = {} @outlier_bufs = {} @scores = {} @mutex = Mutex.new end |
#emit(tag, es, chain) ⇒ Object
291 292 293 294 295 296 297 298 299 300 301 302 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 291 def emit(tag, es, chain) records = es.map { |time, record| record } if @aggregate == 'all' push_records(:all, records) else push_records(tag, records) end chain.next rescue => e log.warn "anomalydetect: #{e.class} #{e.} #{e.backtrace.first}" end |
#flush ⇒ Object
219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 219 def flush flushed_records, @records = @records, init_records( = @records.keys) outputs = {} flushed_records.each do |tag, records| output = if @targets @targets.each_with_object({}) do |target, output| output_each = flush_each(records, tag, target) output.merge!(output_each) if output_each end elsif @target flush_each(records, tag, @target) else flush_each(records, tag) end outputs[tag] = output if output end outputs end |
#flush_each(records, tag, target = nil) ⇒ Object
239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 239 def flush_each(records, tag, target = nil) val = get_value(records, target) outlier, score, mu = get_score(val, tag, target) if val threshold = @threshold_proc.call(target) return nil if @suppress if score and threshold < 0 or (threshold >= 0 and score > threshold) case @trend when :up return nil if val < mu when :down return nil if val > mu end @output_each_proc.call(outlier, score, val, target) else nil end end |
#flush_emit(step) ⇒ Object
211 212 213 214 215 216 217 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 211 def flush_emit(step) outputs = flush outputs.each do |tag, output| emit_tag = @tag_proc.call(tag) Fluent::Engine.emit(emit_tag, Fluent::Engine.now, output) if output and !output.empty? end end |
#get_score(val, tag, target = nil) ⇒ Object
268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 268 def get_score(val, tag, target = nil) outlier = outliers(tag, target).next(val) mu = outliers(tag, target).mu outlier_buf = outlier_bufs(tag, target) outlier_buf.push outlier outlier_buf.shift if outlier_buf.size > @smooth_term outlier_avg = outlier_buf.empty? ? 0.0 : outlier_buf.inject(:+).to_f / outlier_buf.size score = scores(tag, target).next(outlier_avg) log.debug "out_anomalydetect:#{Thread.current.object_id} tag:#{tag} val:#{val} outlier:#{outlier} outlier_buf:#{outlier_buf} score:#{score} mu:#{mu}" [outlier, score, mu] end |
#get_value(records, target = nil) ⇒ Object
258 259 260 261 262 263 264 265 266 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 258 def get_value(records, target = nil) if target compacted_records = records.map {|record| record[target] }.compact return nil if compacted_records.empty? compacted_records.inject(:+).to_f / compacted_records.size # average else records.size.to_f # num of records end end |
#init_records(tags) ⇒ Object
160 161 162 163 164 165 166 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 160 def init_records() records = {} .each do |tag| records[tag] = [] end records end |
#load_from_file ⇒ Object
304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 304 def load_from_file return unless @store_file f = Pathname.new(@store_file) return unless f.exist? begin f.open('rb') do |f| stored = Marshal.load(f) if (( stored[:outlier_term] == @outlier_term ) && ( stored[:outlier_discount] == @outlier_discount ) && ( stored[:score_term] == @score_term ) && ( stored[:score_discount] == @score_discount ) && ( stored[:smooth_term] == @smooth_term ) && ( stored[:aggregate] == @aggregate )) then @outliers = stored[:outliers] @outlier_bufs = stored[:outlier_bufs] @scores = stored[:scores] @outliers.each {|outlier| outlier.log = log } # @log is not dumped, so have to set at here else log.warn "anomalydetect: configuration param was changed. ignore stored data" end end rescue => e log.warn "anomalydetect: Can't load store_file #{e}" end end |
#outlier_bufs(tag, target = nil) ⇒ Object
145 146 147 148 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 145 def outlier_bufs(tag, target = nil) @outlier_bufs[tag] ||= {} @outlier_bufs[tag][target] ||= [] end |
#outliers(tag, target = nil) ⇒ Object
150 151 152 153 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 150 def outliers(tag, target = nil) @outliers[tag] ||= {} @outliers[tag][target] ||= ChangeFinder.new(log, @outlier_term, @outlier_discount) end |
#push_records(tag, records) ⇒ Object
284 285 286 287 288 289 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 284 def push_records(tag, records) @mutex.synchronize do @records[tag] ||= [] @records[tag].concat(records) end end |
#scores(tag, target = nil) ⇒ Object
155 156 157 158 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 155 def scores(tag, target = nil) @scores[tag] ||= {} @scores[tag][target] ||= ChangeFinder.new(log, @score_term, @score_discount) end |
#shutdown ⇒ Object
176 177 178 179 180 181 182 183 184 185 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 176 def shutdown super if @watcher @watcher.terminate @watcher.join end store_to_file rescue => e log.warn "anomalydetect: #{e.class} #{e.} #{e.backtrace.first}" end |
#start ⇒ Object
168 169 170 171 172 173 174 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 168 def start super load_from_file start_watch rescue => e log.warn "anomalydetect: #{e.class} #{e.} #{e.backtrace.first}" end |
#start_watch ⇒ Object
187 188 189 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 187 def start_watch @watcher = Thread.new(&method(:watch)) end |
#store_to_file ⇒ Object
332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 332 def store_to_file return unless @store_file begin Pathname.new(@store_file).open('wb') do |f| Marshal.dump({ :outliers => @outliers, :outlier_bufs => @outlier_bufs, :scores => @scores, :outlier_term => @outlier_term, :outlier_discount => @outlier_discount, :score_term => @score_term, :score_discount => @score_discount, :smooth_term => @smooth_term, :aggregate => @aggregate, }, f) end rescue => e log.warn "anomalydetect: Can't write store_file #{e}" end end |
#watch ⇒ Object
191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 |
# File 'lib/fluent/plugin/out_anomalydetect.rb', line 191 def watch @started = @last_checked = Fluent::Engine.now @suppress = true loop do begin sleep 0.5 now = Fluent::Engine.now if @suppress and (now - @started >= @suppress_tick) @suppress = false end if now - @last_checked >= @tick flush_emit(now - @last_checked) @last_checked = now end rescue => e log.warn "anomalydetect: #{e.class} #{e.} #{e.backtrace.first}" end end end |