Skip to content

Commit a34f4ed

Browse files
andrewm4894andrewm4894
committed
add some notebooks for debugging
1 parent dee1dc9 commit a34f4ed

File tree

3 files changed

+670
-0
lines changed

3 files changed

+670
-0
lines changed

‎notebooks/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Notebooks
2+
3+
It can be useful for debugging or doing adhoc analysis to have notebooks you can use to query against your anomstack instance.
4+
5+
Some example notebooks i have been using live in here.

‎notebooks/qry.sql‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
-- read_sql() is about to read this qry:
2+
/*
3+
Template for generating the input data for the alert job.
4+
5+
Written for SQLite but will be translated to target dialect based on `db` param via sqlglot.
6+
*/
7+
WITH "metric_value_data" /* Filter the data to the relevant metric batch for metrics */ AS (
8+
SELECT
9+
"metric_timestamp",
10+
"metric_batch",
11+
"metric_name",
12+
AVG("metric_value") AS "metric_value"
13+
FROM "metrics_prometheus"
14+
WHERE
15+
"metric_batch" = 'prometheus'
16+
AND "metric_type" = 'metric'
17+
AND "metric_timestamp" >= DATE('now', '-45 day')
18+
GROUP BY
19+
"metric_timestamp",
20+
"metric_batch",
21+
"metric_name"
22+
), "metric_score_data" /* Filter the data to the relevant metric batch for scores */ AS (
23+
SELECT
24+
"metric_timestamp",
25+
"metric_batch",
26+
"metric_name",
27+
AVG("metric_value") AS "metric_score"
28+
FROM "metrics_prometheus"
29+
WHERE
30+
"metric_batch" = 'prometheus'
31+
AND "metric_type" = 'score'
32+
AND "metric_timestamp" >= DATE('now', '-45 day')
33+
GROUP BY
34+
"metric_timestamp",
35+
"metric_batch",
36+
"metric_name"
37+
), "metric_alert_data" /* Filter the data to the relevant metric batch for alerts */ AS (
38+
SELECT
39+
"metric_timestamp",
40+
"metric_batch",
41+
"metric_name",
42+
AVG("metric_value") AS "metric_alert_historic"
43+
FROM "metrics_prometheus"
44+
WHERE
45+
"metric_batch" = 'prometheus'
46+
AND "metric_type" = 'alert'
47+
AND "metric_timestamp" >= DATE('now', '-45 day')
48+
GROUP BY
49+
"metric_timestamp",
50+
"metric_batch",
51+
"metric_name"
52+
), "metric_score_recency_ranked" /* Rank the score data by recency */ AS (
53+
SELECT
54+
"metric_timestamp",
55+
"metric_batch",
56+
"metric_name",
57+
"metric_score",
58+
ROW_NUMBER() OVER (PARTITION BY "metric_name" ORDER BY "metric_timestamp" DESC) AS "metric_score_recency_rank"
59+
FROM "metric_score_data"
60+
), "metric_value_recency_ranked" /* Rank the value data by recency */ AS (
61+
SELECT
62+
"metric_timestamp",
63+
"metric_batch",
64+
"metric_name",
65+
"metric_value",
66+
ROW_NUMBER() OVER (PARTITION BY "metric_name" ORDER BY "metric_timestamp" DESC) AS "metric_value_recency_rank"
67+
FROM "metric_value_data"
68+
), "data_ranked" /* Join the data together */ AS (
69+
SELECT
70+
"m"."metric_timestamp",
71+
"m"."metric_batch",
72+
"m"."metric_name",
73+
"m"."metric_value",
74+
"s"."metric_score",
75+
COALESCE("a"."metric_alert_historic", 0) AS "metric_alert_historic",
76+
"m"."metric_value_recency_rank",
77+
"s"."metric_score_recency_rank"
78+
FROM "metric_value_recency_ranked" AS "m"
79+
LEFT JOIN "metric_score_recency_ranked" AS "s"
80+
ON "m"."metric_name" = "s"."metric_name"
81+
AND "m"."metric_batch" = "s"."metric_batch"
82+
AND "m"."metric_timestamp" = "s"."metric_timestamp"
83+
LEFT JOIN "metric_alert_data" AS "a"
84+
ON "m"."metric_name" = "a"."metric_name"
85+
AND "m"."metric_batch" = "a"."metric_batch"
86+
AND "m"."metric_timestamp" = "a"."metric_timestamp"
87+
), "data_smoothed" /* Smooth the data */ AS (
88+
SELECT
89+
"metric_timestamp",
90+
"metric_batch",
91+
"metric_name",
92+
"metric_value",
93+
"metric_score",
94+
"metric_alert_historic",
95+
"metric_value_recency_rank",
96+
"metric_score_recency_rank",
97+
(
98+
SELECT
99+
AVG("ds"."metric_score")
100+
FROM "data_ranked" AS "ds"
101+
WHERE
102+
"ds"."metric_name" = "dr"."metric_name"
103+
AND "ds"."metric_score_recency_rank" BETWEEN "dr"."metric_score_recency_rank" - 3 AND "dr"."metric_score_recency_rank"
104+
) AS "metric_score_smooth", /* Smooth the metric score using a custom window */
105+
(
106+
SELECT
107+
MAX("ds"."metric_alert_historic")
108+
FROM "data_ranked" AS "ds"
109+
WHERE
110+
"ds"."metric_name" = "dr"."metric_name"
111+
AND "ds"."metric_score_recency_rank" BETWEEN "dr"."metric_score_recency_rank" - 3 AND "dr"."metric_score_recency_rank" - 1
112+
) AS "metric_has_recent_alert" /* Check for recent alerts */
113+
FROM "data_ranked" AS "dr"
114+
), "data_alerts" /* Calculate the alerts */ AS (
115+
SELECT
116+
"metric_timestamp",
117+
"metric_batch",
118+
"metric_name",
119+
"metric_value",
120+
"metric_score",
121+
"metric_score_recency_rank",
122+
"metric_alert_historic",
123+
"metric_score_smooth",
124+
"metric_has_recent_alert",
125+
CASE
126+
WHEN "metric_score_recency_rank" <= 1
127+
AND (
128+
"metric_score_smooth" >= 0.8 OR FALSE = TRUE
129+
)
130+
AND COALESCE("metric_has_recent_alert", 0) = 0
131+
THEN 1
132+
ELSE 0
133+
END AS "metric_alert_calculated"
134+
FROM "data_smoothed"
135+
WHERE
136+
"metric_score_recency_rank" <= 250
137+
OR FALSE /* flag for always alerting if set */ = TRUE
138+
), "metrics_triggered" /* Filter the data to the metrics with triggered alerts */ AS (
139+
SELECT
140+
"metric_batch",
141+
"metric_name",
142+
MAX("metric_alert_calculated") AS "metric_alert_calculated_tmp"
143+
FROM "data_alerts"
144+
GROUP BY
145+
"metric_batch",
146+
"metric_name"
147+
HAVING
148+
MAX("metric_alert_calculated") = 1 OR FALSE = TRUE
149+
)
150+
/* Return the data */
151+
SELECT
152+
"metric_timestamp",
153+
"data_alerts"."metric_batch" AS "metric_batch",
154+
"data_alerts"."metric_name" AS "metric_name",
155+
"metric_value",
156+
"metric_score",
157+
"metric_score_smooth",
158+
IIF("metric_score_recency_rank" = 1, "metric_alert_calculated", "metric_alert_historic") AS "metric_alert"
159+
FROM "data_alerts"
160+
JOIN "metrics_triggered"
161+
ON "data_alerts"."metric_batch" = "metrics_triggered"."metric_batch"
162+
AND "data_alerts"."metric_name" = "metrics_triggered"."metric_name"

0 commit comments

Comments
 (0)