Graph-based ML Anomaly Detection and Insights for Envoy Systems
summary
eBay processes about 12 billion requests per day through Envoy SLBs across 13 locations and collects >12B records with ~120 dimensions and 60 metrics into Filebeat/Logstash → Kafka with dual writes to Elasticsearch (exploring ClickHouse) and Prometheus. A homegrown PI-UNAM Python trend detector handles tailored traffic vs latency anomalies; a GRANO real-time anomaly graph stores alerts and metrics in Neo4j, uses Pearson correlation and score propagation to do RCA, pushes Slack/email alerts, and runs in production to reduce MTTR and surface actionable root causes.
AI-written summary · about
chapters (10)
- 0:00Envoy anomaly detection intro
- 3:13Envoy traffic and data
- 7:50Static alerts to PI UNAM
- 9:12Single-metric limits
- 9:34Gramo graph detection
- 14:53Graph ML for root cause
- 15:57Gramo real-time graph
- 18:49Scoring anomaly signals
- 22:01Gramo’s applications and user interface
- 23:27Key takeaways
related talks
30mBetter data quality with ML & visualization
43mBeyond Logs: Real-Time Anomaly Detection with Machine Learning
27mBeyond Logs: Real Time Anomaly Detection with Machine Learning
34mML-Bound Anomaly Detection: Experiences Beyond Commodity Observability
39mNetwork Observability with Envoy
35mAnomaly Detection for Cloud Native Storage
21mAnomaly Detection for Platform Logs using Embedded Context
35mAnomaly Detection for Cloud Native Storage