fluent-plugin-anomalydetect 0.0

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in fluent-plugin-anomalydetect.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2012 muddydixon
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,47 @@
+# Fluent::Plugin::Anomalydetect
+
+To detect anomaly for log stream, use this plugin.
+Then you can find changes in logs casually.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'fluent-plugin-anomalydetect'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install fluent-plugin-anomalydetect
+
+## Usage
+
+```
+<source>
+  type file
+  ...
+  tag access.log
+</source>
+
+<match access.**>
+  type anomalydetect
+  tag anomaly.access
+  tick 86400
+</match>
+
+<match anomaly.access>
+  type file
+  ...
+</match>
+```
+
+Then the plugin output anomaly log counts in each day.
+
+## Theory
+"データマイニングによる異常検知" http://amzn.to/XHXNun
+
+
+

data/Rakefile

@@ -0,0 +1,10 @@
+require "bundler/gem_tasks"
+
+require 'rake/testtask'
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/test_*.rb'
+  test.verbose = true
+end
+
+task :default => :test

data/fluent-plugin-anormalydetect.gemspec

@@ -0,0 +1,21 @@
+# -*- encoding: utf-8 -*-
+lib = File.expand_path('../lib', __FILE__)
+
+Gem::Specification.new do |gem|
+  gem.name          = "fluent-plugin-anomalydetect"
+  gem.version       = 0.0
+  gem.authors       = ["Muddy Dixon"]
+  gem.email         = ["muddydixon@gmail.com"]
+  gem.description   = %q{detect anomal sequential input casually}
+  gem.summary       = %q{detect anomal sequential input casually}
+  gem.homepage    = "https://github.com/muddydixon/fluent-plugin-anomalydetect"
+
+
+  gem.files         = `git ls-files`.split($/)
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.require_paths = ["lib"]
+  
+  gem.add_development_dependency "fluentd"
+  gem.add_runtime_dependency "fluentd"
+end

data/lib/fluent/plugin/change_finder.rb

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*-
+module Fluent
+  class ChangeFinder
+    require 'matrix'
+
+    def initialize(term, r)
+      @term = term
+      @r = r
+      @data = []
+      @mu = 0
+      @sigma = 0
+      @c = (0..@term - 1).map do |i| rand end
+    end
+    def next(x)
+      len = @data.size
+
+      # update @mu
+      @mu = (1 - @r) * @mu + @r * x
+
+      # update @c
+      c = @sigma
+      for j in 0..@term - 1
+        if @data[len - 1 - j]
+          @c[j] = (1 - @r) * @c[j] + @r * (x - @mu) * (@data[len - 1 - j] - @mu) 
+        end
+      end
+      
+      cc = Matrix.zero(@term).to_a
+      for j in 0..(@term - 1)
+        for i in j..@term - 1
+          cc[j][i] = cc[i][j] = @c[i - j]
+        end
+      end
+      w = (Matrix.rows(cc).inv * Vector.elements(@c)).to_a
+      xt = @data.each.with_index.inject(@mu) do |sum, (v, idx)|
+        sum += w[idx] * (v - @mu)
+      end
+      @sigma = (1 - @r) * @sigma + @r * (x - xt) * (x - xt)
+
+      @data.push x
+      if @data.size > @term
+        @data.shift
+      end
+
+      score(prob xt, @sigma, x)
+    end
+
+    def prob (mu, sigma, v)
+      return 0 if sigma == 0
+        
+      Math.exp( - 0.5 * (v - mu) ** 2 / sigma) / ((2 * Math::PI) ** 0.5 * sigma ** 0.5)
+    end
+
+    def score (p)
+      return 0 if p <= 0
+      -Math.log(p)
+    end
+
+    def smooth(size)
+      _end = @data.size
+      _begin = [_end - size, 0].max
+      @data.slice(_begin, _end).inject(0.0) do |sum, v| sum += v end / (_end - _begin)
+    end
+
+    def showStatus
+      {:sigma => @sigma, :mu => @mu, :data => @data, :c => @c}
+    end
+  end
+end

data/lib/fluent/plugin/out_anomalydetect.rb

@@ -0,0 +1,139 @@
+# -*- coding: utf-8 -*-
+module Fluent
+  class AnomalyDetectOutput < Output
+    Fluent::Plugin.register_output('anomalydetect', self)
+    
+    require 'fluent/plugin/change_finder'
+
+    config_param :outlier_term, :integer, :default => 28
+    config_param :outlier_discount, :float, :default => 0.05
+    config_param :smooth_term, :integer, :default => 7
+    config_param :score_term, :integer, :default => 14
+    config_param :score_discount, :float, :default => 0.1
+    config_param :tick, :integer, :default => 60 * 5
+    config_param :tag, :string, :default => "anomaly"
+    config_param :target, :string, :default => ""
+
+    attr_accessor :outlier
+    attr_accessor :score
+    attr_accessor :recordCount
+
+    attr_accessor :outliers
+
+    attr_accessor :records
+
+    def configure (conf)
+      super
+      unless 0 < @outlier_discount and @outlier_discount < 1 
+        raise Fluent::ConfigError, "discount ratio should be between (0, 1)" 
+      end
+      unless 0 < @score_discount and @score_discount < 1 
+        raise Fluent::ConfigError, "discount ratio should be between (0, 1)"
+      end
+      if @outlier_term < 1
+        raise Fluent::ConfigError, "outlier term should be greater than 0"
+      end
+      if @score_term < 1
+        raise Fluent::ConfigError, "score term should be greater than 0"
+      end
+      if @smooth_term < 1
+        raise Fluent::ConfigError, "smooth term should be greater than 0"
+      end
+      if @tick < 1
+        raise Fluent::ConfigError, "tick timer should be greater than 1 sec"
+      end
+      
+      @outliers = []
+      @outlier  = ChangeFinder.new(@outlier_term, @outlier_discount)
+      @score    = ChangeFinder.new(@score_term, @score_discount)
+
+      @records = []
+      @mutex = Mutex.new
+
+      if @target == ""
+        @recordCount = true 
+      else
+        @recordCount = false
+      end
+    end
+
+    def start
+      super
+      init_records
+      start_watch
+    end
+
+    def shutdown
+      super
+      if @watcher
+        @watcher.terminate
+        @watcher.join
+      end
+    end
+
+    def start_watch
+      @watcher = Thread.new(&method(:watch))
+    end
+
+    def watch
+
+      @last_checked = Fluent::Engine.now
+      while true
+        sleep 0.5
+        if Fluent::Engine.now - @last_checked >= @tick
+          now = Fluent::Engine.now
+          flush_emit(now - @last_checked)
+          @last_checked = now
+        end
+      end
+    end
+
+    def init_records
+      @records = []
+    end
+
+    def flush_emit(step)
+      output = flush
+      Fluent::Engine.emit(@tag, Fluent::Engine.now, output)
+    end
+
+    def flush
+      flushed, @records = @records, init_records
+
+      val = 0
+      if @recordCount
+        val = flushed.size
+      else
+        val = flushed.inject(0.0) do |sum, record| sum += record[@target].to_f if record[@target]; end / flushed.size
+      end
+
+      outlier = @outlier.next(val)
+      @outliers.push outlier
+      @outliers.shift() if @outliers.size > @smooth_term
+      score = @score.next(@outliers.inject(0) do |sum, v| sum += v end / @outliers.size)
+
+      {"outlier" => outlier, "score" => score, "target" => val}
+
+    end
+
+    def tickTime (time)
+      (time - time % @tick).to_s
+    end
+
+    def pushRecords (records)
+      @mutex.synchronize do
+        @records.concat(records)
+      end
+    end
+
+    def emit (tag, es, chain)
+      records = []
+      es.each do |time, record|
+        records.push record
+      end
+      pushRecords records
+
+      chain.next
+    end
+  end
+end

data/test/helper.rb

@@ -0,0 +1,28 @@
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'test/unit'
+
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'fluent/test'
+unless ENV.has_key?('VERBOSE')
+  nulllogger = Object.new
+  nulllogger.instance_eval {|obj|
+    def method_missing(method, *args)
+      # pass
+    end
+  }
+  $log = nulllogger
+end
+
+require 'fluent/plugin/out_anomalydetect'
+
+class Test::Unit::TestCase
+end

data/test/plugin/test_out_anomalydetect.rb

@@ -0,0 +1,139 @@
+require 'helper'
+
+class AnomalyDetectOutputTest < Test::Unit::TestCase
+  def setup
+    Fluent::Test.setup
+  end
+
+  CONFIG = %[
+    tag test.anomaly
+    outlier_term 28
+    outlier_discount 0.05
+    score_term 28
+    score_discount 0.05
+    tick 10
+    smooth_term 3
+    target y
+  ]
+  
+  def create_driver (conf=CONFIG, tag="debug.anomaly")
+    Fluent::Test::OutputTestDriver.new(Fluent::AnomalyDetectOutput, tag).configure(conf)
+  end
+
+  def test_configure
+    d = create_driver('')
+    assert_equal 28, d.instance.outlier_term
+    assert_equal 0.05, d.instance.outlier_discount
+    assert_equal 7, d.instance.smooth_term
+    assert_equal 14, d.instance.score_term
+    assert_equal 0.1, d.instance.score_discount
+    assert_equal 300, d.instance.tick
+    assert_equal "", d.instance.target
+    assert_equal true, d.instance.recordCount
+
+    d = create_driver
+    assert_equal 28, d.instance.outlier_term
+    assert_equal 0.05, d.instance.outlier_discount
+    assert_equal 3, d.instance.smooth_term
+    assert_equal 28, d.instance.score_term
+    assert_equal 0.05, d.instance.score_discount
+    assert_equal 10, d.instance.tick
+    assert_equal "y", d.instance.target
+    assert_equal 'test.anomaly', d.instance.tag
+    assert_equal false, d.instance.recordCount
+
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        outlier_discount 1.3
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        score_discount 1.3
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        outlier_discount -0.3
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        score_discount -0.3
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        outlier_term 0
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        score_term 0
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        smooth_term 0
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        tick 0
+      ]
+    }
+  end
+
+  def test_array_init
+    d = create_driver
+    assert_equal [], d.instance.outliers
+    assert_equal [], d.instance.records
+  end
+
+  def test_sdar
+    d = create_driver
+    assert_instance_of Fluent::ChangeFinder, d.instance.outlier
+    assert_instance_of Fluent::ChangeFinder, d.instance.score
+  end
+
+  def test_emit_record_count
+    d = create_driver %[
+      tag test.anomaly
+      outlier_term 28
+      outlier_discount 0.05
+      score_term 28
+      score_discount 0.05
+      tick 10
+      smooth_term 3
+    ]
+
+    data = (0..10).map do || (rand * 100).to_i end
+    data.push 0
+    d.run do 
+      data.each do |val|
+        (0..val - 1).each do ||
+          d.emit({'y' => 1})
+        end
+        r = d.instance.flush
+        assert_equal val, r['target']
+      end
+    end
+  end
+
+  def test_emit_stock_data
+    require 'csv'
+    reader = CSV.open("test/stock.2432.csv", "r")
+    header = reader.take(1)[0]
+    d = create_driver
+    d.run do 
+      reader.each_with_index do |row, idx|
+        break if idx > 5
+        d.emit({'y' => row[4].to_i})
+        r = d.instance.flush
+        assert r['target']
+        assert r['outlier']
+        assert r['score']
+      end
+    end
+  end
+end

data/test/stock.2432.csv

@@ -0,0 +1,262 @@
+x,s,M,m,y,o
+20110104,2914,2978,2906,2969,1379000
+20110105,2990,2995,2914,2931,1521100
+20110106,2949,2952,2919,2932,1086300
+20110107,2922,2969,2912,2917,1216000
+20110111,2924,2965,2919,2957,1369100
+20110112,2958,3045,2957,3025,2080700
+20110113,3050,3055,2973,3035,1570800
+20110114,3035,3095,2993,3030,2167700
+20110117,3055,3060,2970,2985,1311800
+20110118,2962,2967,2920,2940,1416800
+20110119,2951,2976,2920,2972,1357100
+20110120,2967,2985,2873,2902,2164300
+20110121,2865,2896,2706,2780,3223900
+20110124,2764,2812,2752,2778,1596100
+20110125,2759,2809,2750,2785,1616800
+20110126,2787,2901,2770,2897,2419200
+20110127,2950,2989,2932,2979,2768300
+20110128,2967,3010,2950,3005,2234200
+20110131,2935,3020,2918,2959,1434700
+20110201,3010,3145,2993,3100,4213100
+20110202,2989,3030,2925,2926,7932000
+20110203,2937,2957,2858,2890,2932700
+20110204,2872,2928,2852,2859,2080900
+20110207,2865,2909,2860,2878,1276800
+20110208,2907,2924,2840,2849,1858700
+20110209,2869,2872,2819,2862,1738000
+20110210,2872,2924,2850,2912,1878000
+20110214,2899,2916,2884,2907,1030300
+20110215,2922,3020,2915,3015,3603200
+20110216,3050,3070,3000,3040,2737100
+20110217,2991,3060,2970,3030,1493400
+20110218,3005,3070,2996,3055,1921200
+20110221,3080,3255,3080,3250,5817200
+20110222,3235,3240,3150,3150,2419800
+20110223,3095,3225,3085,3135,2376000
+20110224,3130,3150,3030,3040,2173700
+20110225,2998,3045,2970,3020,2799300
+20110228,3040,3175,3035,3155,2501700
+20110301,3185,3200,3150,3190,1605800
+20110302,3115,3215,3110,3150,1901200
+20110303,3175,3310,3165,3270,4072800
+20110304,3335,3350,3240,3275,2222900
+20110307,3280,3360,3255,3290,1993200
+20110308,3285,3320,3260,3280,1639200
+20110309,3330,3335,3245,3290,1777100
+20110310,3260,3280,3210,3260,1769400
+20110311,3190,3230,3150,3170,1913000
+20110314,2860,3040,2797,2815,4323000
+20110315,2730,2800,2490,2655,5408700
+20110316,2790,2904,2760,2852,3199900
+20110317,2762,3000,2753,2967,2674100
+20110318,2989,3030,2904,2936,1998100
+20110322,3060,3070,2973,3010,1597400
+20110323,2999,3110,2971,3035,1754400
+20110324,3035,3165,3030,3145,2141800
+20110325,3175,3205,3115,3145,2021100
+20110328,3115,3120,2994,3020,1504700
+20110329,2996,3050,2980,3005,1415100
+20110330,3000,3075,3000,3020,1783900
+20110331,3020,3040,2956,3005,2226700
+20110401,3015,3045,2986,2986,1644900
+20110404,2999,3020,2987,3005,975500
+20110405,3010,3010,2875,2889,1838900
+20110406,2900,2918,2837,2882,1293100
+20110407,2924,2998,2910,2939,1683800
+20110408,2925,2980,2901,2970,1083400
+20110411,2993,3020,2970,2981,1065800
+20110412,2965,2984,2871,2890,1512300
+20110413,2876,2945,2815,2871,2040800
+20110414,2867,2869,2817,2853,1759100
+20110415,2868,2898,2831,2852,1568200
+20110418,2855,2873,2820,2820,1217700
+20110419,2791,2798,2740,2748,1696500
+20110420,2770,2819,2725,2726,3476700
+20110421,2754,2798,2741,2785,2346600
+20110422,2805,2855,2786,2836,2522300
+20110425,2855,2892,2816,2831,1657100
+20110426,2910,3005,2906,2988,5475500
+20110427,2989,3020,2956,3000,2510500
+20110428,3005,3030,2966,3025,2697600
+20110502,2970,2989,2857,2866,6418500
+20110506,2817,2865,2776,2804,3688800
+20110509,2777,2808,2759,2791,2509300
+20110510,2783,2861,2783,2843,2327700
+20110511,2855,2898,2846,2891,2577500
+20110512,2878,2924,2865,2891,2603200
+20110513,2909,2918,2811,2827,1619700
+20110516,2812,2846,2776,2783,1116400
+20110517,2768,2821,2752,2808,1556800
+20110518,2800,2860,2798,2840,939100
+20110519,2885,2911,2863,2906,2369500
+20110520,2900,2945,2870,2883,2247900
+20110523,2879,2890,2806,2852,1609700
+20110524,2832,2934,2829,2924,1806700
+20110525,2939,2959,2893,2924,1525200
+20110526,2820,2856,2791,2818,7961100
+20110527,2853,2886,2838,2868,2808400
+20110530,2870,2873,2829,2837,2032900
+20110531,2835,2885,2821,2885,2953500
+20110601,2923,3050,2908,3050,5114700
+20110602,3010,3080,2981,3045,3222100
+20110603,3060,3080,2991,3035,2027800
+20110606,3030,3150,3020,3130,2989800
+20110607,3155,3175,3105,3170,2845300
+20110608,3140,3275,3135,3265,3878000
+20110609,3200,3255,3165,3205,2879000
+20110610,3150,3220,3105,3150,2851500
+20110613,3120,3235,3105,3230,2363200
+20110614,3230,3345,3225,3240,4376800
+20110615,3215,3220,3150,3185,2041000
+20110616,3155,3220,3130,3130,1423000
+20110617,3300,3325,3235,3240,4231300
+20110620,3310,3340,3200,3250,2633200
+20110621,3295,3455,3290,3440,4401300
+20110622,3490,3510,3430,3455,2961400
+20110623,3520,3545,3405,3425,2430000
+20110624,3425,3430,3285,3360,2639300
+20110627,3360,3405,3325,3350,1244400
+20110628,3325,3360,3290,3300,1298300
+20110629,3365,3470,3355,3450,2755000
+20110630,3455,3480,3400,3455,1821500
+20110701,3450,3475,3410,3425,1310100
+20110704,3500,3520,3440,3460,1232100
+20110705,3490,3495,3450,3485,866400
+20110706,3500,3515,3450,3500,928100
+20110707,3510,3605,3495,3595,2170600
+20110708,3665,3800,3660,3785,4691500
+20110711,3775,3865,3725,3755,3158200
+20110712,3795,3815,3680,3690,2665900
+20110713,3700,3835,3695,3825,2636500
+20110714,3890,4025,3865,4025,5563300
+20110715,4000,4020,3895,3920,3766600
+20110719,3855,3910,3815,3820,3735400
+20110720,3870,3895,3825,3835,1651900
+20110721,3860,3945,3855,3940,2109200
+20110722,3985,4000,3910,3940,1966300
+20110725,3935,3980,3920,3950,1201100
+20110726,3985,4055,3955,4050,3881600
+20110727,4025,4070,3975,3995,2057200
+20110728,3955,4055,3890,3955,2461500
+20110729,3935,3960,3795,3845,2868700
+20110801,3805,4025,3805,3960,2637700
+20110802,3920,4045,3920,4020,3095900
+20110803,3970,4000,3910,3960,2052300
+20110804,4070,4090,3900,3915,3133100
+20110805,3795,3985,3660,3985,4110100
+20110808,3920,3930,3595,3635,6041600
+20110809,3550,3705,3450,3640,6167500
+20110810,3780,3870,3705,3800,4560200
+20110811,3730,3945,3685,3945,5398400
+20110812,3940,3965,3840,3890,3894800
+20110815,3890,3930,3815,3910,2538600
+20110816,3915,4150,3895,4040,6665100
+20110817,4110,4185,4015,4135,5588600
+20110818,4185,4330,4155,4255,8056300
+20110819,4115,4210,4015,4030,6759900
+20110822,4100,4150,3765,3780,5888500
+20110823,3785,3860,3600,3775,8136200
+20110824,3845,3850,3555,3580,5260500
+20110825,3585,3655,3500,3530,5926300
+20110826,3580,3780,3555,3775,5545000
+20110829,3810,3935,3785,3920,5392600
+20110830,3920,4040,3880,4005,4572100
+20110831,4070,4070,3910,3960,4496300
+20110901,4000,4010,3925,3960,2999100
+20110902,3970,4055,3950,4030,4258900
+20110905,3980,4050,3965,3965,3150300
+20110906,3905,3915,3655,3700,4819200
+20110907,3840,4010,3815,3995,5131500
+20110908,4040,4040,3815,3915,4423100
+20110909,3930,3980,3835,3885,2635000
+20110912,3745,3905,3730,3815,2946000
+20110913,3840,3935,3760,3850,3049600
+20110914,3825,3910,3720,3745,2772700
+20110915,3820,3830,3595,3615,3546300
+20110916,3655,3755,3580,3740,3091400
+20110920,3690,3730,3555,3585,2840100
+20110921,3545,3590,3450,3455,3331700
+20110922,3360,3425,3230,3245,4986400
+20110926,3255,3345,3230,3290,4330000
+20110927,3360,3370,3080,3190,4788000
+20110928,3185,3360,3175,3300,4141600
+20110929,3260,3380,3230,3350,3908500
+20110930,3335,3345,3210,3270,3186900
+20111003,3190,3325,3180,3220,2449200
+20111004,3175,3305,3175,3265,3160900
+20111005,3430,3545,3410,3530,7924400
+20111006,3530,3610,3480,3555,3090200
+20111007,3560,3605,3515,3600,1896400
+20111011,3660,3670,3535,3540,1835000
+20111012,3525,3525,3390,3405,1977000
+20111013,3390,3535,3365,3510,2241000
+20111014,3515,3580,3465,3495,1564700
+20111017,3540,3555,3485,3490,1119000
+20111018,3470,3490,3335,3405,1254900
+20111019,3300,3340,3125,3135,5804200
+20111020,3200,3250,3140,3180,3698900
+20111021,3175,3210,3060,3105,2284600
+20111024,3075,3230,3020,3215,2450400
+20111025,3200,3240,3140,3180,1358400
+20111026,3185,3235,3155,3215,1121800
+20111027,3185,3315,3150,3290,2582900
+20111028,3335,3415,3275,3340,3205100
+20111031,3365,3510,3365,3425,2603900
+20111101,2725,2884,2725,2725,24491800
+20111102,2649,2708,2572,2640,17998500
+20111104,2640,2667,2510,2627,14766700
+20111107,2658,2777,2652,2759,14467300
+20111108,2790,2831,2694,2731,12980300
+20111109,2734,2757,2662,2707,5999100
+20111110,2652,2776,2642,2762,6639700
+20111111,2750,2783,2736,2762,3749300
+20111114,2794,2819,2758,2786,3658500
+20111115,2790,2800,2752,2781,2722300
+20111116,2762,2766,2668,2670,4120300
+20111117,2650,2713,2616,2651,3286100
+20111118,2604,2648,2578,2627,3266300
+20111121,2560,2594,2285,2302,11355900
+20111122,2152,2310,2104,2229,16013500
+20111124,2250,2310,2173,2181,6894800
+20111125,2162,2270,2150,2215,5068300
+20111128,2255,2298,2220,2267,3058700
+20111129,2280,2346,2270,2309,4831400
+20111130,2324,2378,2315,2357,3798700
+20111201,2399,2414,2296,2330,5295400
+20111202,2412,2528,2410,2519,9853900
+20111205,2558,2563,2476,2519,5885100
+20111206,2500,2531,2446,2450,4426100
+20111207,2472,2509,2446,2484,3075600
+20111208,2450,2479,2412,2424,3698700
+20111209,2390,2419,2376,2392,2761100
+20111212,2411,2445,2397,2413,2608100
+20111213,2395,2405,2345,2378,2478400
+20120223,2613,2637,2573,2587,3856400
+20120224,2531,2647,2520,2638,7743200
+20120316,2273,2296,2227,2244,7611000
+20120319,2245,2270,2160,2167,5324000
+20120321,2187,2280,2179,2236,8134000
+20120322,2268,2288,2233,2259,5919700
+20120323,2262,2283,2231,2260,3544800
+20120326,2268,2277,2146,2199,7376500
+20120327,2200,2264,2168,2247,4001700
+20120328,2192,2247,2178,2202,2892200
+20120329,2232,2355,2230,2340,6893700
+20120330,2305,2320,2248,2293,6171500
+20120402,2354,2384,2340,2371,4993400
+20120403,2350,2371,2274,2321,5195300
+20120404,2358,2417,2344,2393,7283400
+20120405,2393,2432,2335,2393,6148800
+20120406,2416,2430,2365,2384,4419100
+20120409,2359,2419,2340,2390,3065200
+20120410,2375,2390,2291,2302,3968700
+20120411,2286,2381,2256,2377,4988300
+20120412,2381,2425,2356,2413,4470100
+20120413,2401,2469,2383,2422,4478700
+20120416,2408,2429,2393,2406,1897500
+20120417,2415,2526,2406,2519,6338900
+20120418,2510,2545,2474,2521,4773300
+20120419,2521,2592,2510,2549,4322200
+20120420,2533,2575,2491,2539,3876000
+20120423,2544,2643,2544,2635,5467000

metadata

@@ -0,0 +1,81 @@
+--- !ruby/object:Gem::Specification
+name: fluent-plugin-anomalydetect
+version: !ruby/object:Gem::Version
+  version: '0.0'
+  prerelease: 
+platform: ruby
+authors:
+- Muddy Dixon
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2013-01-11 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: &2152223980 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: *2152223980
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: &2152223420 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: *2152223420
+description: detect anomal sequential input casually
+email:
+- muddydixon@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- Gemfile
+- LICENSE.txt
+- README.rdoc
+- Rakefile
+- fluent-plugin-anormalydetect.gemspec
+- lib/fluent/plugin/change_finder.rb
+- lib/fluent/plugin/out_anomalydetect.rb
+- test/helper.rb
+- test/plugin/test_out_anomalydetect.rb
+- test/stock.2432.csv
+homepage: https://github.com/muddydixon/fluent-plugin-anomalydetect
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.11
+signing_key: 
+specification_version: 3
+summary: detect anomal sequential input casually
+test_files:
+- test/helper.rb
+- test/plugin/test_out_anomalydetect.rb
+- test/stock.2432.csv