Introduction to Time Series

A presentation at PHPUK 2020 in February 2020 in England, UK by David McKay

Slide 1

Slide 1

@rawkode Good Afternoon David McKay @rawkode Developer Advocate @InfluxDB | #InfluxDB PHPUK 2020

Slide 2

Slide 2

@rawkode 🏴󠁧󠁒󠁳󠁣󠁴󠁿 Scottish David Mckay Developer Advocate 🐭 Has 9 Pets at InfluxData πŸ’™ Esoteric Programming Languages @rawkode ☸ Kubernetes Team πŸ€” Stoic

Slide 3

Slide 3

Slide 4

Slide 4

Introduction to Time Series

Slide 5

Slide 5

@rawkode Before we begin …

Slide 6

Slide 6

@rawkode Pop Quiz β€œInvented” When?

Slide 7

Slide 7

@rawkode Encoding First Used … 410 ? BC

Slide 8

Slide 8

@rawkode Encoding β€œDocumented” in The Lives of the Noble Grecians and Romans, by Roman historian Plutarch.

Slide 9

Slide 9

@rawkode Alcibiades suddenly raised the Athenian ensign in the admiral shop, and fell upon those galleys of the Peloponnesians …

Slide 10

Slide 10

@rawkode Encoding In the 14th century, things hadn’t actually advanced much more. The Black Book of Admiralty listed 2 signals: 1 flag or 2 flags

Slide 11

Slide 11

@rawkode Encoding By the 15th century there were 15 flags, each with a single meaning.

Slide 12

Slide 12

@rawkode Encoding Finally, in the late 17th century; a French system existed (MahΓ© de la Bourdonnais) with 10 coloured flags, representing 0-9

Slide 13

Slide 13

@rawkode Sharding First Used … 150 ? BC

Slide 14

Slide 14

@rawkode Sharding First β€œdocumented” example was in ~150 AD, invented and described by Polybius.

Slide 15

Slide 15

@rawkode We take the alphabet and divide it into five parts, each consisting of five letters.

Slide 16

Slide 16

@rawkode

Slide 17

Slide 17

@rawkode

Slide 18

Slide 18

History of Time Series

Slide 19

Slide 19

@rawkode The Romans Did It The earliest form of a company which issued public shares was the case of the publicani during the Roman Republic.

Slide 20

Slide 20

@rawkode Like modern joint-stock companies, the publicani were legal bodies independent of their members whose ownership was divided into shares, or partes. There is evidence that these shares were sold to public investors and traded in a type of over-the-counter market in the Forum, near the Temple of Castor and Pollux. The shares fluctuated in value, encouraging the activity of speculators, or quaestors.

Slide 21

Slide 21

@rawkode In 1602 … First IPO: Dutch East India Company

Slide 22

Slide 22

@rawkode In 1873 … First US IPO: Bank of North America

Slide 23

Slide 23

@rawkode In 1884 … What was the price of wheat?

Slide 24

Slide 24

@rawkode First Documented Time Series A Comparison of the Fluctuations in the Price of Wheat and in the Cotton and Silk Imports into Great Britain J. H. Poynting Journal of the Statistical Society of London Vol. 47, No. 1 (Mar., 1884), pp. 34-74

Slide 25

Slide 25

@rawkode What is all this? This is the first (or one of) paper that added the dimension of time to statistical mathematics

Slide 26

Slide 26

@rawkode Most data is best understood in the dimension of time @pauldix, CTO

Slide 27

Slide 27

Introduction to Time Series

Slide 28

Slide 28

@rawkode What Will We Cover? βž” βž” βž” βž” βž” Time Series Data Time Series Databases Getting to Know InfluxDB Value of Time Series Data Advancing Monitoring with Time Series

Slide 29

Slide 29

Time Series Data What is it?

Slide 30

Slide 30

@rawkode Time Series Data Data with a timestamp

Slide 31

Slide 31

@rawkode Mem 100% Healthcheck Failed Pod Killed By OOM V1.1.3 Deployed Git Commit Pod Restarted CPU 12% Scotland Qualify for World Cup DB Migration Run CI Passed CI Started

Slide 32

Slide 32

@rawkode Mem 100% Healthcheck Failed Pod Killed By OOM V1.1.3 Deployed Git Commit Pod Restarted CPU 12% Scotland Qualify for World Cup DB Migration Run CI Passed CI Started

Slide 33

Slide 33

@rawkode Mem 100% Healthcheck Failed Pod Killed By OOM V1.1.3 Deployed Git Commit Pod Restarted CPU 12% Scotland Qualify for World Cup DB Migration Run CI Passed CI Started

Slide 34

Slide 34

@rawkode Mem 100% Healthcheck Failed Pod Killed By OOM V1.1.3 Deployed Git Commit Pod Restarted CPU 12% Scotland Qualify for World Cup DB Migration Run CI Passed CI Started

Slide 35

Slide 35

@rawkode Mem 100% Healthcheck Failed Pod Killed By OOM V1.1.3 Deployed Git Commit Pod Restarted CPU 12% Scotland Qualify for World Cup DB Migration Run CI Passed CI Started

Slide 36

Slide 36

@rawkode Mem 100% Pod Killed By OOM V1.1.3 Deployed Time DB Migration Run Healthcheck Failed

Slide 37

Slide 37

Slide 38

Slide 38

@rawkode What is Time Series Data?

Slide 39

Slide 39

@rawkode What is Time Series Data? Regular (Metrics) βž” Predictable βž” Evenly Distributed Irregular (Events) βž” Unpredictable βž” Inconsistent Intervals

Slide 40

Slide 40

@rawkode Regular / Metrics β˜… β˜… β˜… β˜… CPU Usage Memory Usage Ping Time for Google.com Number of Processes

Slide 41

Slide 41

@rawkode Irregular / Events β˜… β˜… β˜… β˜… User Clicked Login Authentication Failed CI Published v1.3.1 Network Cable Unplugged

Slide 42

Slide 42

Slide 43

Slide 43

@rawkode Metrics vs. Events All Metrics are an aggregation of events

Slide 44

Slide 44

@rawkode Collecting Metrics & Events With Prometheus Exporters or Telegraf

Slide 45

Slide 45

@rawkode Collecting Metrics & Events Inputs: βž” βž” βž” βž” βž” βž” βž” βž” βž” CloudWatch Elasticsearch Kafka Jenkins Kubernetes Linux Puppet Windows x509 Outputs: βž” βž” βž” βž” βž” βž” CloudWatch Kafka DataDog Elasticsearch Graphite Prometheus Exporters: βž” βž” βž” βž” βž” βž” Atlassian Ceph Consul Kubernetes Memcached MySQL

Slide 46

Slide 46

Slide 47

Slide 47

@rawkode Push AND Pull Metrics are pulled at a regular interval Events NEED to be pushed as they happen Consistent and reliable intervals Inconsistent intervals

Slide 48

Slide 48

@rawkode Time Series Data Use Cases

Slide 49

Slide 49

@rawkode Use Cases for Time Series Monitoring βž” βž” βž” Infrastructure Applications Third Party Services IoT / Sensor βž” βž” βž” βž” βž” Thermostats Electric Engines Smart Things GPS Fitbits Real Time Analytics βž” βž” βž” Website Tracking Stock Prices Currency Exchange Rates

Slide 50

Slide 50

Time Series Databases TSDB’s

Slide 51

Slide 51

@rawkode Time Series Databases Time Series databases are optimized for collecting, storing, retrieving, and processing of Time Series data.

Slide 52

Slide 52

@rawkode Time Series Databases βž” High Write Frequency βž” Reads are range scans βž” TTL / Lifecycle Management βž” Time Sensitive

Slide 53

Slide 53

Slide 54

Slide 54

@rawkode 12% Are you in the 88%?

Slide 55

Slide 55

Slide 56

Slide 56

Slide 57

Slide 57

Slide 58

Slide 58

Slide 59

Slide 59

Slide 60

Slide 60

Slide 61

Slide 61

@rawkode 13% It’s Not Too Late!

Slide 62

Slide 62

@rawkode

Slide 63

Slide 63

@rawkode Disclaimer Most of this isn’t unique to InfluxDB

Slide 64

Slide 64

InfluxDB Introductions

Slide 65

Slide 65

@rawkode InfluxDB βž” TSDB βž” Open-Source βž” FullStack (Telegraf, InfluxDB, Chronograf, and Kapacitor) βž” v2 …

Slide 66

Slide 66

@rawkode Points At any point in time, this value was N

Slide 67

Slide 67

@rawkode Point ● Series ● Fields ● Timestamp load,host=vm1 1m=6.32,5m=8.20,15m=9.55 123456789

Slide 68

Slide 68

@rawkode Series ● Name ● Tag Keys ● Tag Values ● load,host=vm1 ● stock_price,market=NASDAQ,ticker=GOOG ● users,service=comments

Slide 69

Slide 69

@rawkode Series ● Name ● Tag Keys ● Tag Values stock_price,market=NASDAQ,ticker=GOOG stock_price,market=NASDAQ,ticker=APPL

Slide 70

Slide 70

@rawkode Tags & Fields Tags βž” Indexed βž” String Types Fields βž” Not Indexed βž” Multiple Data Types

Slide 71

Slide 71

Value of Time Series Data Isn’t It Valuable Forever?

Slide 72

Slide 72

@rawkode Resolution The predictable interval at which we will collect our time series data

Slide 73

Slide 73

@rawkode Value of Time Series Data The value of all time series data is directly correlated with the resolution that the data is available

Slide 74

Slide 74

Cost of Time Series Data Wait, Isn’t It Free?!

Slide 75

Slide 75

@rawkode Example cpu,machine=abc1 usage=1.66 timestamp

Slide 76

Slide 76

@rawkode Resolution βž” 1 Measurement βž” 1 Series βž” 1s Resolution 86400 Points Per Day

Slide 77

Slide 77

@rawkode Resolution βž” 1 Measurement βž” 2 Series βž” 1s Resolution 172800 Points Per Day

Slide 78

Slide 78

@rawkode Resolution βž” 5 Measurement βž” 10 Series βž” 1s Resolution 4320000 Points Per Day

Slide 79

Slide 79

@rawkode Nasdaq βž” 1 Measurement βž” 3300 Series βž” 1ms Resolution 28512000 0000 Points Per Day

Slide 80

Slide 80

@rawkode Nasdaq βž” 1 Measurement βž” 3300 Series βž” 1m Resolution 4752000 Points Per Day

Slide 81

Slide 81

@rawkode Nasdaq βž” 1 Measurement βž” 3300 Series βž” 1h Resolution 79200 Points Per Day

Slide 82

Slide 82

@rawkode Nasdaq βž” 1 Measurement βž” 3300 Series βž” 6h Resolution 13200 Points Per Day

Slide 83

Slide 83

Slide 84

Slide 84

@rawkode Downsampling Lowering the Resolution

Slide 85

Slide 85

@rawkode Rollups with Continuous Queries CREATE CONTINUOUS QUERY β€œrollup_1h” ON β€œnasdaq” BEGIN SELECT mean(price) INTO yearly FROM weekly GROUP BY time(1h) END

Slide 86

Slide 86

@rawkode Events? Outlier / Anomaly Detection InfluxDB Anomaly Detection

Slide 87

Slide 87

Advancing Monitoring with Time Series Taking Small Steps for Giant Leaps

Slide 88

Slide 88

CPU > 80% MEM > 80% Application Database Response Time > 300ms Black Friday

Slide 89

Slide 89

Application When the application fails the health-check How do we know when to send a page to SRE / Ops? Database

Slide 90

Slide 90

Application How do we know when to send a page to SRE / Ops? Application Database Application When we get more than 100 [ 5xx | Exceptions ] within a 5 minute period

Slide 91

Slide 91

Service A Service B Service B Service C Canary Virtual Network Service Mesh Ummm? Database A Database B Database C

Slide 92

Slide 92

@rawkode Cloud Native Architectures Convenience Vs. Cost You can treat the symptoms for a while … Upgrade Your Monitoring

Slide 93

Slide 93

@rawkode Causality Treating the Disease

Slide 94

Slide 94

@rawkode Causality βž” Look at last weeks, months, and years of data βž” Use tags to build correlation βž” Get Statistical β—† β—† β—† β—† β—† β—† INTEGRAL() LINEAR_PREDICTION() DERIVATIVE() MAD() MOVING_AVERAGE() HOLT_WINTERS()

Slide 95

Slide 95

@rawkode Causality Have you ever been paged at 4am because the disk usage of a machine went above 85%? Could this have been determined during office hours? (Linear Growth) Can we use correlations to determine the cause during anomalies?

Slide 96

Slide 96

@rawkode Causality In our distributed application, our p99 reports that our users are being served healthy responses in under 2ms. Our pager is going off because we’ve getting too many exceptions in the code histogram(bins: […])

Slide 97

Slide 97

@rawkode Beware http_request_duration_seconds_bucket{le=”0.3”} http_request_duration_seconds_bucket{le=”0.5”} http_request_duration_seconds_bucket{le=”1.0”} http_request_duration_seconds_bucket{le=”+Inf”}

Slide 98

Slide 98

@rawkode Causality In our distributed application, our p99 reports that our users are being served healthy responses in under 2ms. Our pager is going off because we’ve getting too many exceptions in the code histogram() |> mode(*)

Slide 99

Slide 99

@rawkode Proactive Ops We run Big News Corp and we need to reduce our cloud costs. Instead of running at 30% utilisation, can we run at 80% utilisation? HOLT_WINTERS

Slide 100

Slide 100

@rawkode Build Automation Through Causality, Historical Data, Prediction, and ML

Slide 101

Slide 101

@rawkode Summary βž” Use a TSDB βž” Rollup metrics βž” Understand Cost / Select Tags Wisely βž” Perform outlier detection on events βž” Understand the resolution you need for 1m, 6m, > 12m βž” Build automation, dashboarding, and reporting around your data (past, present, and future)

Slide 102

Slide 102

@rawkode Cheers! David McKay @rawkode Developer Advocate @InfluxDB | #InfluxDB That’s All Folks!