Anomaly Detector
A RocketRide filter node that monitors numeric text or document metadata and marks statistically unusual values. Pick it when a pipeline needs a rolling, per-run check for outliers rather than a fixed rule for every value.
What it does
The node accepts text and documents lanes and returns data on the matching
lane. Text is inspected for one numeric value; documents are copied and
enriched with anomaly metadata based on the configured metadata field. Use it
for changing measurements whose usual range must be learned from recent data,
instead of a rule-based validation node that compares each item against a
known limit.
The detector is created once per pipeline execution and shares one thread-safe, fixed-size history across its instances. Each value is evaluated against the existing history and only then added to it, so the history is discarded when the run ends. This node is experimental.
Lanes
| Lane in | Lane out | Description |
|---|---|---|
text | text | Inspect a numeric value in text; anomalous values receive a suffix. |
documents | documents | Inspect the configured metadata metric and add detection metadata. |
Profiles
Default: Z-Score - Standard deviation based detection (z_score).
| Profile | Method | Default window | Warning / critical threshold |
|---|---|---|---|
z_score (default) | Z-Score | 100 | 2.0 / 3.0 |
iqr | Interquartile range | 100 | 1.5 / 3.0 |
rolling_avg | Rolling Average - Moving average deviation detection | 50 | 2.0 / 3.0 |
Configuration
Start with the profile whose kind of change you need to detect, then point Metric field at the numeric document-metadata key to monitor. The defaults are conservative starting points; every method needs a warm-up period before it can identify an outlier.
Detection method and sensitivity
Choose z_score when distance in standard deviations is meaningful, iqr
when you want quartile-based outlier bounds, or rolling_avg when percentage
change from recent values is more useful. sensitivity controls the IQR bounds
and normalizes the rolling-average score; lowering it makes both methods flag
smaller deviations. It has no effect on Z-Score, whose score is calculated
from the window standard deviation.
Window size
Window size retains 10 to 10,000 recent values, with 100 by default. Use a
larger window for a stable long-term baseline and a smaller one when the normal
level changes quickly. Z-Score and Rolling Average need at least two existing
values; IQR needs four. Before that, a value is returned as normal with
insufficient data, so a very large window does not delay the minimum
warm-up but does make the baseline slower to adapt.
Metric field
For documents, set Metric field to the metadata key containing the number;
the default is value. A missing or non-numeric key does not stop the
pipeline: the copied document is marked normal and receives an explanatory
anomaly_details value. Text input first attempts to parse all of the text,
then uses its first integer, decimal, or scientific-notation token; text with
no number passes through unchanged.
Warning and critical thresholds
The detector labels a score at or above Critical threshold as critical,
then a score at or above Warning threshold as warning; lower scores are
normal. Raise these values to reduce alerts and lower them to surface more
borderline changes. With the default rolling-average settings, warning begins
at a 40% deviation and critical at 60%; changing sensitivity changes those
effective percentages as well.
Notes
Output details
For anomalous text, the node appends a suffix such as
[ANOMALY: critical score=3.4119]; normal text remains unchanged. Documents
receive anomaly_score, anomaly_severity, anomaly_is_anomalous, and
anomaly_details metadata. Non-finite numeric input is treated as normal and
is not added to the history.
Method edge cases
Z-Score produces a normal result when the history has zero variance, IQR does the same when the interquartile range is zero, and Rolling Average does so when its local mean is zero. IQR marks any value outside its sensitivity-based bounds as anomalous even if its resulting score remains below the configured warning threshold; its severity still uses the warning and critical thresholds.
Schema
| Field | Type | Description | Default |
|---|---|---|---|
anomaly_detector.criticalThreshold | number | Critical threshold Threshold multiplier for critical-level anomalies | 3 |
anomaly_detector.method | string | Detection method Statistical method used for anomaly detection | "z_score" |
anomaly_detector.metric | string | Metric field The metadata field name containing the numeric value to monitor | "value" |
anomaly_detector.profile | string | Detection Method Anomaly detection configuration | "z_score" |
anomaly_detector.sensitivity | number | Sensitivity Detection sensitivity threshold (lower = more sensitive) | 2 |
anomaly_detector.warningThreshold | number | Warning threshold Threshold multiplier for warning-level anomalies | 2 |
anomaly_detector.windowSize | integer | Window size Number of recent values to consider for statistical calculations | 100 |