Streaming Z-Score Anomaly Detector (O(1) per event)

This is a tiny baseline streaming anomaly detector that:

• maintains rolling statistics over a fixed window
• flags anomalies using z-score
• updates in O(1) time per event (constant-time rolling mean/std)

Input / Output format

The CLI reads JSON Lines from stdin and writes JSON Lines to stdout.

Input example (one event per line):

{"ts":"2026-04-14T12:00:00Z","value":1.2}
{"ts":"2026-04-14T12:00:01Z","value":1.1}
{"ts":"2026-04-14T12:00:02Z","value":99.0}

Output adds:

• zscore
• is_anomaly
• rolling_mean, rolling_std, rolling_n

Run

PowerShell example:

python .\anomaly_detector.py --field value --window 200 --warmup 30 --z 3.0 < events.jsonl

Quick inline test:

'{"ts":1,"value":1}
{"ts":2,"value":1}
{"ts":3,"value":1}
{"ts":4,"value":1}
{"ts":5,"value":50}' | python .\anomaly_detector.py --warmup 3 --window 5 --z 2.0