1. A computer-implemented method comprising: receiving telemetry data originating from a plurality of client devices, wherein the telemetry data was generated in response to the plurality of client devices accessing an online service provided by a service provider; selecting a class of data from the telemetry data; converting the class of data to a set of metrics; aggregating the set of metrics according to a component that is used to implement the online service; obtaining values of aggregated metrics over time for the component based at least in part on aggregating the set of metrics; determining a prediction error by comparing the values of the aggregated metrics to a prediction, the prediction being based at least in part on historical telemetry data pertaining to the class of data and the component; detecting an anomaly based at least in part on the prediction error; and transmitting an alert message of the anomaly.