[ML] Rare anomaly detection job wizard

x-pack/plugins/ml/common/constants/new_job.ts

@@ -11,13 +11,15 @@ export enum JOB_TYPE {
   POPULATION = 'population',
   ADVANCED = 'advanced',
   CATEGORIZATION = 'categorization',
+  RARE = 'rare',
 }
 
 export enum CREATED_BY_LABEL {
   SINGLE_METRIC = 'single-metric-wizard',
   MULTI_METRIC = 'multi-metric-wizard',
   POPULATION = 'population-wizard',
   CATEGORIZATION = 'categorization-wizard',
+  RARE = 'rare-wizard',
   APM_TRANSACTION = 'ml-module-apm-transaction',
 }
 

x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/index.ts

@@ -11,12 +11,14 @@ export { MultiMetricJobCreator } from './multi_metric_job_creator';
 export { PopulationJobCreator } from './population_job_creator';
 export { AdvancedJobCreator } from './advanced_job_creator';
 export { CategorizationJobCreator } from './categorization_job_creator';
+export { RareJobCreator } from './rare_job_creator';
 export {
   JobCreatorType,
   isSingleMetricJobCreator,
   isMultiMetricJobCreator,
   isPopulationJobCreator,
   isAdvancedJobCreator,
   isCategorizationJobCreator,
+  isRareJobCreator,
 } from './type_guards';
 export { jobCreatorFactory } from './job_creator_factory';

x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts

@@ -395,6 +395,9 @@ export class JobCreator {
     // change the detector to be a non-zer or non-null count or sum.
     // note, the aggregations will always be a standard count or sum and not a non-null or non-zero version
     this._detectors.forEach((d, i) => {
+      if (this._aggs[i] === undefined) {
+        return;
+      }
       switch (this._aggs[i].id) {
         case ML_JOB_AGGREGATION.COUNT:
           d.function = this._sparseData

x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator_factory.ts

@@ -12,6 +12,7 @@ import { PopulationJobCreator } from './population_job_creator';
 import { AdvancedJobCreator } from './advanced_job_creator';
 import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
 import { CategorizationJobCreator } from './categorization_job_creator';
+import { RareJobCreator } from './rare_job_creator';
 
 import { JOB_TYPE } from '../../../../../../common/constants/new_job';
 
@@ -37,6 +38,9 @@ export const jobCreatorFactory = (jobType: JOB_TYPE) => (
     case JOB_TYPE.CATEGORIZATION:
       jc = CategorizationJobCreator;
       break;
+    case JOB_TYPE.RARE:
+      jc = RareJobCreator;
+      break;
     default:
       jc = SingleMetricJobCreator;
       break;

x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/population_job_creator.ts

@@ -22,7 +22,7 @@ import { IndexPattern } from '../../../../../../../../../src/plugins/data/public
 export class PopulationJobCreator extends JobCreator {
   // a population job has one overall over (split) field, which is the same for all detectors
   // each detector has an optional by field
-  private _splitField: SplitField = null;
+  private _populatonField: SplitField = null;
   private _byFields: SplitField[] = [];
   protected _type: JOB_TYPE = JOB_TYPE.POPULATION;
 
@@ -65,27 +65,27 @@ export class PopulationJobCreator extends JobCreator {
   }
 
   // add an over field to all detectors
-  public setSplitField(field: SplitField) {
-    this._splitField = field;
+  public setPopulationField(field: SplitField) {
+    this._populatonField = field;
 
-    if (this._splitField === null) {
-      this.removeSplitField();
+    if (this._populatonField === null) {
+      this.removePopulationField();
     } else {
       for (let i = 0; i < this._detectors.length; i++) {
-        this._detectors[i].over_field_name = this._splitField.id;
+        this._detectors[i].over_field_name = this._populatonField.id;
       }
     }
   }
 
   // remove over field from all detectors
-  public removeSplitField() {
+  public removePopulationField() {
     this._detectors.forEach((d) => {
       delete d.over_field_name;
     });
   }
 
-  public get splitField(): SplitField {
-    return this._splitField;
+  public get populationField(): SplitField {
+    return this._populatonField;
   }
 
   public addDetector(agg: Aggregation, field: Field) {
@@ -112,8 +112,8 @@ export class PopulationJobCreator extends JobCreator {
   private _createDetector(agg: Aggregation, field: Field) {
     const dtr: Detector = createBasicDetector(agg, field);
 
-    if (this._splitField !== null) {
-      dtr.over_field_name = this._splitField.id;
+    if (this._populatonField !== null) {
+      dtr.over_field_name = this._populatonField.id;
     }
     return dtr;
   }
@@ -143,7 +143,7 @@ export class PopulationJobCreator extends JobCreator {
 
     if (detectors.length) {
       if (detectors[0].overField !== null) {
-        this.setSplitField(detectors[0].overField);
+        this.setPopulationField(detectors[0].overField);
       }
     }
     detectors.forEach((d, i) => {

x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/rare_job_creator.ts

@@ -0,0 +1,150 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SavedSearchSavedObject } from '../../../../../../common/types/kibana';
+import { JobCreator } from './job_creator';
+import { Field, SplitField } from '../../../../../../common/types/fields';
+import { Job, Datafeed } from '../../../../../../common/types/anomaly_detection_jobs';
+import { JOB_TYPE, CREATED_BY_LABEL } from '../../../../../../common/constants/new_job';
+import { getRichDetectors } from './util/general';
+import { IndexPattern } from '../../../../../../../../../src/plugins/data/public';
+import { isSparseDataJob } from './util/general';
+import { ML_JOB_AGGREGATION } from '../../../../../../common/constants/aggregation_types';
+
+export class RareJobCreator extends JobCreator {
+  private _rareField: Field | null = null;
+  private _populationField: SplitField = null;
+  private _splitField: SplitField = null;
+
+  protected _type: JOB_TYPE = JOB_TYPE.RARE;
+  private _rareInPopulation: boolean = false;
+  private _frequentlyRare: boolean = false;
+
+  constructor(
+    indexPattern: IndexPattern,
+    savedSearch: SavedSearchSavedObject | null,
+    query: object
+  ) {
+    super(indexPattern, savedSearch, query);
+    this.createdBy = CREATED_BY_LABEL.RARE;
+    this._wizardInitialized$.next(true);
+  }
+
+  public setRareField(field: Field | null) {
+    this._rareField = field;
+
+    if (field === null) {
+      this.removePopulationField();
+      this.removeSplitField();
+      this._detectors.length = 0;
+      return;
+    }
+
+    if (this._detectors.length === 0) {
+      this._detectors.push({ function: ML_JOB_AGGREGATION.RARE });
+    }
+
+    this._detectors[0].by_field_name = field.id;
+  }
+
+  public get rareField() {
+    return this._rareField;
+  }
+
+  public get rareInPopulation() {
+    return this._rareInPopulation;
+  }
+
+  public set rareInPopulation(bool: boolean) {
+    this._rareInPopulation = bool;
+    if (bool === false) {
+      this.removePopulationField();
+    }
+  }
+
+  public get frequentlyRare() {
+    return this._frequentlyRare;
+  }
+
+  public set frequentlyRare(bool: boolean) {
+    this._frequentlyRare = bool;
+    if (this._detectors.length) {
+      this._detectors[0].function = bool ? ML_JOB_AGGREGATION.FREQ_RARE : ML_JOB_AGGREGATION.RARE;
+    }
+  }
+
+  // set the population field, applying it to each detector
+  public setPopulationField(field: SplitField) {
+    this._populationField = field;
+
+    if (this._populationField === null) {
+      this.removePopulationField();
+    } else {
+      for (let i = 0; i < this._detectors.length; i++) {
+        this._detectors[i].over_field_name = this._populationField.id;
+      }
+    }
+  }
+
+  public removePopulationField() {
+    this._populationField = null;
+    this._detectors.forEach((d) => {
+      delete d.over_field_name;
+    });
+  }
+
+  public get populationField(): SplitField {
+    return this._populationField;
+  }
+
+  // set the split field, applying it to each detector
+  public setSplitField(field: SplitField) {
+    this._splitField = field;
+
+    if (this._splitField === null) {
+      this.removeSplitField();
+    } else {
+      for (let i = 0; i < this._detectors.length; i++) {
+        this._detectors[i].partition_field_name = this._splitField.id;
+      }
+    }
+  }
+
+  public removeSplitField() {
+    this._detectors.forEach((d) => {
+      delete d.partition_field_name;
+    });
+  }
+
+  public get splitField(): SplitField {
+    return this._splitField;
+  }
+
+  public cloneFromExistingJob(job: Job, datafeed: Datafeed) {
+    this._overrideConfigs(job, datafeed);
+    this.createdBy = CREATED_BY_LABEL.RARE;
+    this._sparseData = isSparseDataJob(job, datafeed);
+    const detectors = getRichDetectors(job, datafeed, this.additionalFields, false);
+
+    this.removeSplitField();
+    this.removePopulationField();
+    this.removeAllDetectors();
+
+    if (detectors.length) {
+      this.setRareField(detectors[0].byField);
+      this.frequentlyRare = detectors[0].agg?.id === ML_JOB_AGGREGATION.FREQ_RARE;
+
+      if (detectors[0].overField !== null) {
+        this.setPopulationField(detectors[0].overField);
+        this.rareInPopulation = true;
+      }
+      if (detectors[0].partitionField !== null) {
+        this.setSplitField(detectors[0].partitionField);
+      }
+    }
+  }
+}

x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/type_guards.ts

@@ -10,14 +10,16 @@ import { MultiMetricJobCreator } from './multi_metric_job_creator';
 import { PopulationJobCreator } from './population_job_creator';
 import { AdvancedJobCreator } from './advanced_job_creator';
 import { CategorizationJobCreator } from './categorization_job_creator';
+import { RareJobCreator } from './rare_job_creator';
 import { JOB_TYPE } from '../../../../../../common/constants/new_job';
 
 export type JobCreatorType =
   | SingleMetricJobCreator
   | MultiMetricJobCreator
   | PopulationJobCreator
   | AdvancedJobCreator
-  | CategorizationJobCreator;
+  | CategorizationJobCreator
+  | RareJobCreator;
 
 export function isSingleMetricJobCreator(
   jobCreator: JobCreatorType
@@ -46,3 +48,9 @@ export function isCategorizationJobCreator(
 ): jobCreator is CategorizationJobCreator {
   return jobCreator.type === JOB_TYPE.CATEGORIZATION;
 }
+
+export function isRareJobCreator(
+  jobCreator: JobCreatorType
+): jobCreator is CategorizationJobCreator {
+  return jobCreator.type === JOB_TYPE.RARE;
+}

x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts

@@ -311,6 +311,10 @@ export function getJobCreatorTitle(jobCreator: JobCreatorType) {
       return i18n.translate('xpack.ml.newJob.wizard.jobCreatorTitle.categorization', {
         defaultMessage: 'Categorization',
       });
+    case JOB_TYPE.RARE:
+      return i18n.translate('xpack.ml.newJob.wizard.jobCreatorTitle.rare', {
+        defaultMessage: 'Rare',
+      });
     default:
       return '';
   }

x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts

@@ -45,11 +45,10 @@ export function useEstimateBucketSpan() {
     indicesOptions: jobCreator.datafeedConfig.indices_options,
   };
 
-  if (
-    (isMultiMetricJobCreator(jobCreator) || isPopulationJobCreator(jobCreator)) &&
-    jobCreator.splitField !== null
-  ) {
+  if (isMultiMetricJobCreator(jobCreator) && jobCreator.splitField !== null) {
     data.splitField = jobCreator.splitField.id;
+  } else if (isPopulationJobCreator(jobCreator) && jobCreator.populationField !== null) {
+    data.splitField = jobCreator.populationField.id;
   } else if (isAdvancedJobCreator(jobCreator)) {
     jobCreator.richDetectors.some((d) => {
       if (d.partitionField !== null) {

x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/split_field/by_field.tsx → x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/by_field/by_field.tsx

@@ -8,14 +8,14 @@
 import React, { FC, useContext, useEffect, useState, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 
-import { SplitFieldSelect } from './split_field_select';
+import { SplitFieldSelect } from '../split_field_select';
 import { JobCreatorContext } from '../../../job_creator_context';
 import { Field } from '../../../../../../../../../common/types/fields';
 import {
   newJobCapsService,
   filterCategoryFields,
 } from '../../../../../../../services/new_job_capabilities/new_job_capabilities_service';
-import { MultiMetricJobCreator, PopulationJobCreator } from '../../../../../common/job_creator';
+import { PopulationJobCreator } from '../../../../../common/job_creator';
 
 interface Props {
   detectorIndex: number;
@@ -69,18 +69,18 @@ export const ByFieldSelector: FC<Props> = ({ detectorIndex }) => {
   );
 };
 
-// remove the split (over) field from the by field options
+// remove the population (over) field from the by field options
 function useFilteredCategoryFields(
   allCategoryFields: Field[],
-  jobCreator: MultiMetricJobCreator | PopulationJobCreator,
+  jobCreator: PopulationJobCreator,
   jobCreatorUpdated: number
 ) {
   const [fields, setFields] = useState(allCategoryFields);
 
   useEffect(() => {
-    const sf = jobCreator.splitField;
-    if (sf !== null) {
-      setFields(allCategoryFields.filter((f) => f.name !== sf.name));
+    const pf = jobCreator.populationField;
+    if (pf !== null) {
+      setFields(allCategoryFields.filter(({ name }) => name !== pf.name));
     } else {
       setFields(allCategoryFields);
     }

x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/by_field/index.ts

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { ByFieldSelector } from './by_field';