Cisco ThousandEyes collects ordered network-performance metrics such as latency and packet loss. Given a finite representation of this stream, identify values that are anomalous compared with the moving average of the preceding observations.
An observation is anomalous when its value is strictly greater than average * (1 + threshold) or strictly less than average * (1 - threshold). Do not classify any observation until window_size earlier observations are available. Return the zero-based indices of all anomalies in processing order. If the preceding average is zero, classify a positive value as anomalous and a zero value as normal.
Implement process_log_stream(values, window_size, threshold), where values is a list of nonnegative numbers, window_size is a positive integer, and threshold is a nonnegative fraction such as 0.2 for 20%. Return a list of integers containing anomalous indices.
def process_log_stream(values, window_size, threshold):