Given the keys to the values of the average and standard deviation of a distribution, this transform identifies whether the value of a particular variable is an outlier with respect to that distribution. This enrichment returns a user-specified key with an * anomaly * field that contains _True_ or _False_

anomaly_detection.hpy

#!/bin/sh
"exec" "twxec" "-e" "anomaly_detection" "$0" "$@"
import json

{{ docstring "Given the keys to the values of the average and standard deviation of a distribution, this transform 
  identifies whether the value of a particular variable is an outlier with respect to that distribution.  This enrichment returns
  a user-specified key with an * anomaly * field that contains _True_ or _False_." }}

avg_key = {{string Key_name_of_distribution_average_value}}
std_key = {{string Key_name_of_distribution_standard_deviation_value}}
val_key = {{string Key_name_of_variable_value_in_question}}
result_key = {{string Result_key_name}}


def anomaly_detection(msg):
    threshold = 2.0 * msg[std_key] + msg[avg_key]
    if msg[val_key] > threshold:
        msg[result_key] = {"anomaly": True} 
    else:
        msg[result_key] = {"anomaly": False} 
    return msg