{"id":15350537,"url":"https://github.com/takuti/datadog-anomaly-detector","last_synced_at":"2025-04-15T03:32:15.262Z","repository":{"id":147156190,"uuid":"64805032","full_name":"takuti/datadog-anomaly-detector","owner":"takuti","description":":dog: Anomaly detection system for Datadog multiple metrics","archived":false,"fork":false,"pushed_at":"2016-11-11T05:25:16.000Z","size":340,"stargazers_count":22,"open_issues_count":7,"forks_count":5,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-28T15:11:53.564Z","etag":null,"topics":["anomalydetection","datadog","fluentd","norikra","python"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/takuti.png","metadata":{"files":{"readme":"README.md","changelog":"changefinder.sh","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-08-03T01:34:43.000Z","updated_at":"2025-01-18T08:49:43.000Z","dependencies_parsed_at":null,"dependency_job_id":"c045d379-dcfe-4411-9aff-260acc06ca99","html_url":"https://github.com/takuti/datadog-anomaly-detector","commit_stats":{"total_commits":125,"total_committers":1,"mean_commits":125.0,"dds":0.0,"last_synced_commit":"cd3ec14d12b4f5e22933a287be4e3cdf47164b6a"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/takuti%2Fdatadog-anomaly-detector","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/takuti%2Fdatadog-anomaly-detector/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/takuti%2Fdatadog-anomaly-detector/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/takuti%2Fdatadog-anomaly-detector/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/takuti","download_url":"https://codeload.github.com/takuti/datadog-anomaly-detector/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249001599,"owners_count":21196407,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["anomalydetection","datadog","fluentd","norikra","python"],"created_at":"2024-10-01T11:58:38.632Z","updated_at":"2025-04-15T03:32:14.966Z","avatar_url":"https://github.com/takuti.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"Datadog Anomaly Detector\n===\n\n[![Build Status](https://travis-ci.org/takuti/datadog-anomaly-detector.svg?branch=master)](https://travis-ci.org/takuti/datadog-anomaly-detector)\n\nGet Datadog metrics and pass anomaly scores to Datadog itself via Fluentd.\n\nBy integrating CEP engines such as [Esper](http://www.espertech.com/esper/) and [Norikra](http://norikra.github.io/), you can implement more practical applications as the following picture illustrates. We introduce it in **[doc/norikra.md](https://github.com/takuti/datadog-anomaly-detector/blob/master/doc/norikra.md)**.\n\n![system](https://raw.githubusercontent.com/takuti/datadog-anomaly-detector/master/doc/images/system.png \"system\")\n\n## Minimal Requirements\n\n### System\n\n- Python 3.x (2.x is not supported)\n- Fluentd 0.12.x\n\n### Python packages\n\nSee **requirements.txt**\n\n## Basic Installation and Usage\n\n### 1. Setup Fluentd (td-agent)\n\nNote: You can replace `td-agent` with `fluent` depending on your system environment.\n\nFollow [Installation | Fluentd](http://docs.fluentd.org/categories/installation) and configure `/etc/td-agent/td-agent.conf` as:\n\n```apache\n\u003cmatch changefinder.**\u003e\n  @type copy\n  deep_copy true\n\n  \u003cstore\u003e\n    @type record_reformer\n    renew_record true\n    renew_time_key time\n\n    tag datadog.${tag}\n    \u003crecord\u003e\n      metric ${metric_outlier}\n      value ${score_outlier}\n      time ${record[\"time\"]}\n    \u003c/record\u003e\n  \u003c/store\u003e\n\n  \u003cstore\u003e\n    @type record_reformer\n    renew_record true\n    renew_time_key time\n\n    tag datadog.${tag}\n    \u003crecord\u003e\n      metric ${metric_change}\n      value ${score_change}\n      time ${record[\"time\"]}\n    \u003c/record\u003e\n  \u003c/store\u003e\n\u003c/match\u003e\n\n\u003cmatch datadog.changefinder.**\u003e\n  @type dd\n  dd_api_key YOUR_API_KEY\n\u003c/match\u003e\n```\n\nSince the configuration depends on [fluent-plugin-dd](https://github.com/winebarrel/fluent-plugin-dd) and [fluent-plugin-record-reformer](https://github.com/sonots/fluent-plugin-record-reformer), you need to install the plugins via `td-agent-gem`.\n\nFinally, restart td-agent: `$ sudo service restart td-agent`.\n\n### 2. Configure your detector\n\nClone this repository:\n\n\t$ git clone git@github.com:takuti/datadog-anomaly-detector.git\n\t$ cd datadog-anomaly-detector\n\nCreate `config/datadog.ini` as demonstrated in `config/example.ini`.\n\n\t$ cat config/datadog.ini\n\t[general]\n\tpidfile_path: /var/run/changefinder.pid\n\n\t; Datadog API access interval (in sec. range)\n\tinterval: 600\n\n\t[datadog.cpu]\n\tquery: system.load.norm.5{chef_environment:production,chef_role:worker6-staticip} by {host}\n\n\t; ChangeFinder hyperparameters\n\tr: 0.02\n\tk: 7\n\tT1: 10\n\tT2: 5\n\n\t[datadog.queue]\n\tquery: avg:queue.system.running{*}\n\n\tr: 0.02\n\tk: 7\n\tT1: 10\n\tT2: 5\n\nYou can insert a new config for a different query (metric) by creating a new **[datadog.xxx.yyy]** section as:\n\n```\n[datadog.add1]\nquery: additional.metric.1{foo}\n\nr: 0.02\nk: 7\nT1: 10\nT2: 5\n\n...\n```\n\nHere, the above Fluentd configuration enables to create a new Datadog metrics **changefinder.outlier.xxx.yyy** and **changefinder.change.xxx.yyy*** for a configured section **[datadog.xxx.yyy]**. Since the names are very important to monitor the anomaly scores, you have to decide it carefully.\n\nNote that `r`, `k`, `T1` and `T2` are the parameters of our machine learning algorithm. You can set different parameters for each query if you want. In case that you do not write the parameters on the INI file, default parameters will be set. In particular, optimal `k` is chosen by a model selection logic as described in **[doc/changefinder.md#model-selection](https://github.com/takuti/datadog-anomaly-detector/blob/master/doc/changefinder.md#model-selection)**.\n\n### 3. Start a detector daemon\n\nIn order to get Datadog metrics, we need to first set API and APP keys as environmental variables `DD_APP_KEY` and `DD_API_KEY`.\n\nNow, we are ready to start a detector daemon as:\n\n```\n$ python daemonizer.py start\n```\n\nFor the `.pid` file specified in `config/datadog.ini`, please make sure if the directories exist correctly and you have write permission for the path.\n\nYou can stop the daemon as follows.\n\n```\n$ python daemonizer.py stop\n```\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftakuti%2Fdatadog-anomaly-detector","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftakuti%2Fdatadog-anomaly-detector","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftakuti%2Fdatadog-anomaly-detector/lists"}