Skip to content

Flag new heavy hitters: keys that enter the top-k - #28

Open
zzylol wants to merge 1 commit into
feat/driftfrom
feat/topk-novelty
Open

zzylol wants to merge 1 commit into
feat/driftfrom
feat/topk-novelty

Conversation

@zzylol

@zzylol zzylol commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Part 6 of the RFC 0001 stack: use case 3, heavy hitters and novelty.

The detector and exact_answers remember each series' top-k keys over the last 10 windows. A key in the current top-k that none of those windows held is new: it is emitted as asap_topk_new and as an OTLP log event. The scenario has 200 Zipf routes, and at minute 10 a new route takes 15% of traffic. Sketch: Count-Min 4 × 2048 with a 10-slot heap per attribute key (per_attribute: [http.route]).

Result (56-core x86 server, 1-minute windows)

Top-k dashboard

  • The sketch and exact top-10s are identical, keys and counts.
  • /new/hot-route was flagged by both methods in the window it appeared, at rank 2.

With only 200 keys in 2,048 columns there are no collisions. The accuracy-vs-width experiment in a later PR uses 100,000 keys.

cargo fmt --check, cargo clippy --all-targets --features otap-engine,stream-benchmark -- -D warnings and cargo test --features otap-engine,stream-benchmark pass at this PR's head.

The detector and exact_answers remember each series' top-k keys over the last
N windows; a key in the current top-k that none of them held is new, emitted
as asap.topk.new and as an OTLP log event. Adds the top-k scenario (200 Zipf
routes; a new route takes 15% of traffic at minute 10) and its dashboard.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant