HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
etsy
skyline
Python2013–2018
etsy / skyline · Archived

skyline

It'll detect your anomalies! Part of the Kale stack.

Explore on GitHubRead Hacker News discussions
9Distinct people
13Mentions
0Explicit recommenders
2.1KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

It'll detect your anomalies! Part of the Kale stack.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year13 dated mentions

Observed mentions: 2013-06-17 17:35:37 UTC to 2018-01-13 06:18:14 UTC.

0123452013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments20132014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2018

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC312
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC101
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC505
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC303
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC000
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC101

What Hacker News says

13 sources
falcolas·Jan 19, 2016
Evaluated it, and ultimately rejected it for a couple of reasons: - You must pick up Clojure to understand and configure Riemann (we're not a Clojure shop, so this is a non-trivial requirement) - Config file isn't a config file, it's an executed bit of Clojure code - Riemann is not a replacement for an alerting mechanism, it's another signal for alerting mechanisms (though since it's Clojure and the configuration file is a Clojure script, you can absolutely hack it into becoming an alerting system) - Riemann is not a replacement for a trend graphing mechanism. - There are other solutions which can be piped together to get the 80% of the functionality we wanted from Riemann (Graphite + Skyline) in much less invested time Skyline link: https://github.com/etsy/skyline
In Riemann – A network monitoring system
huac·Jan 16, 2016
Anomaly detection is very different across different domains. For CC fraud / risk, you have discrete transactions so the problem is one of classification, and generally approached with supervised learning. I don't know what you mean by combining multiple variables. Do you mean analysis methods that work with multiple variables (instead of 1-dimensional z-scores) or do you mean methods that combine multiple variables into 1, to reduce input dimensions (i.e. principal component analysis) Because data and data reporting platforms are so different across companies, there's no 'simple framework' to do reporting. You probably want something like https://github.com/etsy/skyline. You also describe an ensemble method for outlier detection, which is what Skyline uses. I want to note that there is no reason to consider ensembles "not" outlier detect
Read the rest
ion.
In Outlier Detection in SQL
falcolas·Jul 13, 2015
Former MySQL admin's advice (for OP, and others who run into this same issue): Someone probably started running queries which were doing disk sorts. Look for abusive queries coming in and kill those, the temporary files will go away at that point. Based on the size of the files, simply looking for long running queries should be sufficient; if it's the backend for a web server, it's likely that the client and server have already given up on the query (or in the worst case, re-sent the debilitating query). As stated by other users, truncating random files will cause more problems for MySQL than just restarting mysql. In fact, I'd recommend going in and restarting it now, to ensure that you're at a good state. Failing over to your slave (you do have a slave and failover procedure, right?) is less of a headache than trying to identify what pr
Read the rest
oblems were caused by manually truncating these sort files. Finally, have a look at Skyline from Etsy[1]; a trend monitoring tool like this would have alerted you when the ramp started closer to 1am, well before this was suddenly an outage event. [1] https://github.com/etsy/skyline
In Fixing a Disk Space Alert at 3 AM
iandanforth·Jan 6, 2015
Another good package to look at is Etsy's Skyline - https://github.com/etsy/skyline Their introduction of the Kale stack (which includes Skyline) is a great read - https://codeascraft.com/2013/06/11/introducing-kale/ I spent a month or so evaluating anomaly detection systems and I can tell you a few things the twitter post fails to mention 1. You can get a long way with an ensemble of simple techniques. And it's always better than any single technique. I wouldn't recommend trying to install skyline but re-implementing the ensemble of anomaly classifiers they have might take you a day or two and it will get you 90% of the way there. 2. The False Positive rate is probably your most important metric. Detecting anomalies is good, but your ops team already has plenty of alerts to deal with. If you throw false positives at them from a new syste
Read the rest
m they will hate you and ignore the new system. Most papers report ROC curve data as the metric for classification, that can be ok too. 3. Don't build something complex when a threshold will do. If a point anomaly is obvious to a human, you absolutely should not build a complex system to detect it, just use thresholds. It's only when you want to detect anomalies before they cross a threshold that you should start on this kind of task. That leads me to 4. Almost all anomalies have a temporal component. If your detector isn't ultimately looking at multiple sources of data and finding patterns that initially look like normal behavior (or odd behavior over time like a change in frequency) then its not adding as much value as it could. Slow trends, increased predictability, absent spikes which are still within threshold, those are the kind of anomalies your simple systems will miss and which will add a lot of value. Ultimately anything that makes ops life easier and alerts them sooner to real problems is good. But in anomaly detection it is easy to fool yourself into thinking you need something complex to start out with, and when you've built a complex thing that it is "working" because it finds 95% of the obvious outliers.
In Practical and robust anomaly detection in time series

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.