[ML] Explain log rate spikes: Analysis API endpoint. #135058
Conversation
walterra
force-pushed
the
ml-aiops-api-explain-log-rate-spikes
branch
from
a5d83d0 to
dff118e
Compare
walterra
force-pushed
the
ml-aiops-api-explain-log-rate-spikes
branch
from
dff118e to
d478d0d
Compare
walterra
added
:ml
release_note:skip
|
Pinging @elastic/ml-ui (:ml) |
| @@ -19,4 +19,4 @@ export const PLUGIN_NAME = 'AIOps'; | |||
| * This is an internal hard coded feature flag so we can easily turn on/off the | |||
| * "Explain log rate spikes UI" during development until the first release. | |||
| */ | |||
| export const AIOPS_ENABLED = false; | |||
| export const AIOPS_ENABLED = true; | |||
There was a problem hiding this comment.
Probably want to switch this back to false for now.
There was a problem hiding this comment.
Discussed with Pete and we're going to leave this enabled for now.
| const minWindowGap = 5 * 60 * 1000; // 5min | ||
|
|
||
| // work out bounds | ||
| const deviationWindow = Math.max(totalWindow / 10, minDeviationWindow); |
There was a problem hiding this comment.
Would benefit from a comment to say why you are picking 10 and 3.5 here
| { | ||
| // TODO Consider time ranges. | ||
| start: 0, | ||
| end: 2147483647000, |
There was a problem hiding this comment.
Can you add a comment to show what this end time is?
| </EuiText> | ||
| </EuiFlexItem> | ||
| <EuiFlexItem> | ||
| <EuiProgress |
There was a problem hiding this comment.
A bad choice of data set, but with the event_rate data set, the analysis stops at 20%. As discussed, it should abort and return 100%
| if (shouldStop) { | ||
| end(); | ||
| return; | ||
| // Async IIFE to run the analysis while not blocking returning `responseWithHeaders`. |
There was a problem hiding this comment.
If you select a data view without a time field, you just get a blank page. The API should return an error so we can handle this better.
There was a problem hiding this comment.
As discussed, will pick this up in a follow up, it needs a bit more refactoring and error handling.
💚 Build SucceededMetrics [docs]Module Count
Public APIs missing comments
Async chunks
Public APIs missing exports
Page load bundle
Unknown metric groupsAPI count
History
To update your PR or re-run it, just comment with: cc @walterra |
Summary
Part of #136265.
Updates the API endpoint
"/internal/aiops/explain_log_rate_spikes"to work with real data instead of the dummy example.The analysis now includes identifying field candidates and statistically significant field value pairs. Because there is no UI in place yet to allow a user to select custom time ranges for baseline and deviation, for now we fetch a date histogram of the selected index pattern and identify the parameters to get passed as
WindowParametersautomatically by picking the part of the date histogram with the highest doc count.This PR is more about getting the API endpoint into shape and updates integration tests too. The UI code should be considered temporary. At the moment it just outputs the returned analysis state as raw JSON in a EUI code block.
Checklist
Delete any items that are not applicable to this PR.