Fix rate aggregation and offset

elastic · May 13, 2021 · 390bf91 · 390bf91
1 parent a16b364
commit 390bf91
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 14 deletions.
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
@@ -26,6 +26,7 @@ interface Aggregation {
       aggregatedValue: { value: number; values?: Array<{ key: number; value: number }> };
       doc_count: number;
       to_as_string: string;
+      key_as_string: string;
     }>;
   };
 }
@@ -60,6 +61,7 @@ export const evaluateAlert = <Params extends EvaluatedAlertParams = EvaluatedAle
         filterQuery,
         timeframe
       );
+
       const { threshold, warningThreshold, comparator, warningComparator } = criterion;
       const pointsEvaluator = (points: any[] | typeof NaN | null, t?: number[], c?: Comparator) => {
         if (!t || !c) return [false];
@@ -179,7 +181,10 @@ const getValuesFromAggregations = (
     const { buckets } = aggregations.aggregatedIntervals;
     if (!buckets.length) return null; // No Data state
     if (aggType === Aggregators.COUNT) {
-      return buckets.map((bucket) => ({ key: bucket.to_as_string, value: bucket.doc_count }));
+      return buckets.map((bucket) => ({
+        key: bucket.to_as_string,
+        value: bucket.doc_count,
+      }));
     }
     if (aggType === Aggregators.P95 || aggType === Aggregators.P99) {
       return buckets.map((bucket) => {
@@ -190,7 +195,7 @@ const getValuesFromAggregations = (
       });
     }
     return buckets.map((bucket) => ({
-      key: bucket.to_as_string,
+      key: bucket.key_as_string ?? bucket.to_as_string,
       value: bucket.aggregatedValue?.value ?? null,
     }));
   } catch (e) {

diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
@@ -10,6 +10,7 @@ import { MetricExpressionParams, Aggregators } from '../types';
 import { getIntervalInSeconds } from '../../../../utils/get_interval_in_seconds';
 import { roundTimestamp } from '../../../../utils/round_timestamp';
 import { createPercentileAggregation } from './create_percentile_aggregation';
+import { calculateDateHistogramOffset } from '../../../metrics/lib/calculate_date_histogram_offset';
 
 const MINIMUM_BUCKETS = 5;
 const COMPOSITE_RESULTS_PER_PAGE = 100;
@@ -48,6 +49,9 @@ export const getElasticsearchMetricQuery = (
     timeUnit
   );
 
+  const offset = calculateDateHistogramOffset({ from, to, interval, field: timefield });
+  const offsetInMS = parseInt(offset, 10) * 1000;
+
   const aggregations =
     aggType === Aggregators.COUNT
       ? {}
@@ -63,18 +67,34 @@ export const getElasticsearchMetricQuery = (
           },
         };
 
-  const baseAggs = {
-    aggregatedIntervals: {
-      date_range: {
-        field: timefield,
-        ranges: Array.from(Array(Math.floor((to - from) / intervalAsMS)), (_, i) => ({
-          from: from + intervalAsMS * i,
-          to: from + intervalAsMS * (i + 1),
-        })),
-      },
-      aggregations,
-    },
-  };
+  const baseAggs =
+    aggType === Aggregators.RATE
+      ? {
+          aggregatedIntervals: {
+            date_histogram: {
+              field: timefield,
+              fixed_interval: interval,
+              offset,
+              extended_bounds: {
+                min: from,
+                max: to,
+              },
+            },
+            aggregations,
+          },
+        }
+      : {
+          aggregatedIntervals: {
+            date_range: {
+              field: timefield,
+              ranges: Array.from(Array(Math.floor((to - from) / intervalAsMS)), (_, i) => ({
+                from: from + intervalAsMS * i + offsetInMS,
+                to: from + intervalAsMS * (i + 1) + offsetInMS,
+              })),
+            },
+            aggregations,
+          },
+        };
 
   const aggs = groupBy
     ? {