Systems and methods for anomaly alerting for data feeds

A method for anomaly alerting, the method comprising:

• receiving a plurality of event logs from a data feed;
• determining compliance with a schema for each event log of the plurality of event logs;
• storing the plurality of event logs in a data store, wherein the storing comprises, for one or more event log of the plurality of event logs, indicating field error information;
• generating one or more compliance metrics for the data feed for a period of time, wherein the one or more compliance metrics are generated based on field error information for the plurality of event logs;
• comparing the one or more compliance metrics with one or more alert thresholds;
• and
• sending one or more anomaly alerts based on the comparing with the one or more alert thresholds.

A method for anomaly alerting, the method comprising:

• receiving a plurality of event logs from a data feed;
• for each event log of the plurality of event logs, enriching the event log, wherein the enriching comprises formatting the event log based on a JSON format;
• determining compliance with a schema for each event log of the plurality of event logs, wherein the determining compliance with the schema comprises comparing the event log to the schema and, based on the comparing the event log, adding field error information to the event log if one or more fields of the event log do not correspond with the schema;
• storing the plurality of event logs in a data store, wherein the storing comprises, for one or more event logs of the plurality of event logs, indicating ignored fields included in the event log;
• generating one or more compliance metrics for the data feed for a period of time, wherein the one or more compliance metrics are generated based on schema error data and ignored field data for the plurality of event logs;
• comparing the one or more compliance metrics with one or more alert thresholds, wherein the one or more alert thresholds are based on one or more historical compliance metrics for the data feed;
• based on the comparing the one or more compliance metrics with the one or more alert thresholds, determining that at least one of the one or more compliance metrics exceeds at least one alert threshold of the one or more alert thresholds;
• and
• sending one or mor anomaly alerts based on the determination that the at least one of the one or more compliance metrics exceeds the at least one alert threshold of the one or more alert thresholds.