Real-Time Analytics: EWMA Control Charts on Live Streams

Stream Controls

Ingest rate 6 events/s

EWMA smoothing α 0.20

Alert threshold 3.0σ

Live Metrics

Pipeline Stats

Events processed

Anomalies flagged

Highest |z| right now

—

How it works

Each of five synthetic telemetry streams emits a new sample at the ingest rate. A streaming analytics engine can't sort a whole history to find the mean — it has to update statistics incrementally, in O(1) per event, which is exactly what an exponentially weighted moving average (EWMA) does:

EWMA_t  = α·x_t + (1-α)·EWMA_(t-1)
Var_t   = (1-α)·(Var_(t-1) + α·(x_t - EWMA_(t-1))²)
z_t     = (x_t - EWMA_t) / sqrt(Var_t)

α controls the "memory" of the estimator: a high α reacts fast but is noisy; a low α is smooth but slow to notice a real shift. The z-score compares each new point to the smoothed baseline in units of its own recent volatility — the same idea behind Shewhart / EWMA control charts used in real production observability stacks (Datadog, Prometheus alerting rules, statistical process control on a factory line).

Ingest rate — how many raw events per second arrive across all five streams.
α — the EWMA smoothing factor from the formula above.
Alert threshold — the |z| a point must cross to be flagged anomalous (bar turns red, point turns red in the trailing history).
Inject Spike — forces one metric's next sample far from baseline, so you can watch detection latency directly.

Bar height = current EWMA level (normalized to that metric's typical range); the scrolling dot trail behind each bar is the raw sample history, colored by the z-score computed against the EWMA at the time it arrived.

Normal (|z| below threshold) Warning (|z| approaching threshold) Anomaly (|z| over threshold)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.