Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ML] Shows alerts data in the Anomaly Explorer #167998

Merged
merged 62 commits into from
Nov 10, 2023
Merged

[ML] Shows alerts data in the Anomaly Explorer #167998

merged 62 commits into from
Nov 10, 2023

Conversation

darnautov
Copy link
Contributor

@darnautov darnautov commented Oct 4, 2023 •
edited
Loading

Summary

With alerts-as-data integration added in #166349, we're enabled to incorporate alerts historical data into views in the ML UI to see how it correlates with the anomaly results.

This PR add alerts data to the Anomaly Explorer page. If selected anomaly detection jobs have associated alerting rules, we show a new "Alerts" panel.
It contains:

image

A line chart with alerts count over time using the Lens embeddable

It support sync cursor with the Anomaly swim lane making it easier to align anomalous buckets with alerts spikes.

image

Summary of the alerting rules

Shows an aggregated information for each alerting rule associated with the current job selection:

  • An indicator if alerting rule is active
  • Total number of alerts
  • Duration of the latest alerts
  • Start time for active rules and Recovery time for recovered

Rules summary has a descending order based on the following criteria:

  • Number of active alerts in rule
  • Total number of alerts in rule
  • Duration of the most recent alert in rule
image

Alert details

It contains an alerts table provided by triggersActionsUI plugin. For each alert the user can:

  • Open alerts details page
  • Attach an alert to a new case
  • Attach n alert to an existing case
image

Alert context menu

When an anomaly swim lane cells are selected, and there are alerts within the chosen time range, a context menu displaying alert details is shown.

image

Checklist

@darnautov darnautov added Feature:Alerting/RuleTypes Issues related to specific Alerting Rules Types Team:ML Team label for ML (also use :ml) labels Oct 4, 2023
@darnautov darnautov self-assigned this Oct 4, 2023
@darnautov darnautov added Feature:Alerting/Alerts-as-Data Issues related to Alerts-as-data and RuleRegistry v8.12.0 labels Oct 4, 2023
@darnautov darnautov requested review from qn895 and XavierM October 4, 2023 13:57
@darnautov
Copy link
Contributor Author

@elasticmachine merge upstream

@darnautov darnautov marked this pull request as ready for review October 10, 2023 16:15
@darnautov darnautov requested review from a team as code owners October 10, 2023 16:15
@elasticmachine
Copy link
Contributor

Pinging @elastic/ml-ui (:ml)

@mdefazio
Copy link
Contributor

@darnautov Great to see this!
When I ran this locally, I did not have alerts, but I saw that row within the swimlane, alongside Annotations.
I also see the annotations accordion below. (But no alerts accordion)

If I delete the annotations, that block below disappears along with the row in the swimlane (and the alerts row). Assuming that if there were alerts, a block would show below similar to Annotations?

It seems there are some oddities when to show the row in the swimlane and when not to.

Question to the team:
My first reaction would be to show these rows in the swimlane and the accordions regardless if there is data within them. So it's clear that I do not have Alerts or there are no Annotations. Curious if there is a differing opinion here—can understand the potential for UI clutter. But wouldn't the reassurance of knowing it would show if there were alerts outweigh that concern?

@peteharverson
Copy link
Contributor

As discussed with @darnautov and @mdefazio some early feedback:

  • The Anomaly Explorer already presents a lot of information - swim lanes, anomaly charts and table, annotations, influencers. We should aim to minimize any extra vertical height added to the view
  • The user should be viewing alerts from anomaly detection jobs in context with alerts from other rules.
  • A Stack Alerts page is planned - see Stack Alert page #166709. We should eventually link to this page, passing filters to view alerts from the anomaly detection jobs of interest
  • Until the Stack Alerts page is available, we can link to the alerts view for the Rule in Stack Management
  • To minimize any additional height, we should explore alternative ways to indicate alerts, such as icons inside the swim lane cells, a compressed line style indicator, or sparkline.
  • Details on the alerts is too complex to display in a tooltip - we should link to the the Alerts view inside Stack Management to view further details on alerts.
  • Is it possible to use the existing alerts details flyout? Needs thought as there may be multiple alerts at a given time.

@mdefazio
Copy link
Contributor

@peteharverson Some comments on the comments. The TLDR; of this is that my concern with simply shooting them off to the Alerts table / Stack management is the switch in context. I think it would help greatly if we can provide slightly more information for the user so they can make a more informed decision whether to leave the ML app entirely.

The Anomaly Explorer already presents a lot of information - swim lanes, anomaly charts and table, annotations, influencers. We should aim to minimize any extra vertical height added to the view

While I'm not suggesting we need to through a full alert table in here, but I think we should consider at least showing enough information to be usable. And perhaps allow the user to customize what is shown here. So we can perhaps turn off blocks if our concern is page density, but let the user turn those on if they desire.

Not sure I follow this one.

The user should be viewing alerts from anomaly detection jobs in context with alerts from other rules.

If I am on an overview page for AD Jobs, I would expect to clearly see any alerts associated with those rules—and only those rules (not alerts from other rules).

For example, this O11y screen shows alerts specific to this host:
Screenshot--2023-10-11--Inventory - Infrastructure - Observability - Elastic

To minimize any additional height, we should explore alternative ways to indicate alerts, such as icons inside the swim lane cells, a compressed line style indicator, or sparkline.

While this may save some page height, I'd be concerned that it creates a more confusing UI anyway. It woudl be easier to scroll to a clearly visible section rather than find a small icon.

Details on the alerts is too complex to display in a tooltip - we should link to the the Alerts view inside Stack Management to view further details on alerts.

Agreed, but I think we should prioritize some information here. Particularly if we are sending them outside the ML app. That's a big switch in context for little awareness for what I'm going to see.

Is it possible to use the existing alerts details flyout? Needs thought as there may be multiple alerts at a given time.

Yes. this seems like a reasonable middle-ground. We could provide a selection UI before the flyout if there are multiple alerts in a single point. The flyout does currently have the option to cycle through the documents.

@mgiota mgiota self-requested a review November 8, 2023 20:14
mgiota
mgiota approved these changes Nov 8, 2023
View reviewed changes
Copy link
Contributor

@mgiota mgiota left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Observability changes LGTM! Did code review only. Will test it locally as well. Do I need some special data to get ml alerts?

@darnautov
Copy link
Contributor Author

thanks for checking @mgiota! your team were assigned as reviewers because you're mentioned as codeowners for this file packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts where I added an new consumer - ml.

@darnautov darnautov enabled auto-merge (squash) November 9, 2023 16:31
@darnautov darnautov added release_note:feature Makes this part of the condensed release notes and removed release_note:enhancement labels Nov 10, 2023
@darnautov darnautov changed the title [ML] Show alerts data on the Anomaly timeline [ML] Show alerts data in the Anomaly Explorer Nov 10, 2023
@mgiota
Copy link
Contributor

mgiota commented Nov 10, 2023 •
edited
Loading

thanks for checking @mgiota! your team were assigned as reviewers because you're mentioned as codeowners for this file packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts where I added an new consumer - ml.

@darnautov Yep this change looks good, from Obs-Ux-Management side PR is already approved! Ι know your team is actively testing alerts on the Anomaly timeline, out of curiosity I wanted to test it locally as well. I figured out I can use kibana sample data and create a job to be able to get the Anomaly timeline.

Once I find some time, I will checkout your branch locally, generate some alerts and play with the alerts table. I didn't find any Create alert rule menu in the Machine Learning Space. If you already have something like this, I would like to know.

Unless I miss something, the only way to create Machine Learning rules is only through Stack Management, right? It would be cool, if you had a UI menu option somewhere in Machine Learning for creating rules, similar to the Alerts and rules header menu option in the Infra and Metrics apps. Or even a step further a centralized Machine Learning rules page, similar to Security and Observability. If this is something your team is already planning to implement (centralized Machine Learning rules page or Alerts and rules header menu option or both), our team could work together with you. We actively worked with the Response Ops team to build a shareble rules list table, so I assume it could be easily used by your team as well. @XavierM right?

cc @grabowskit

@darnautov
Copy link
Contributor Author

@elasticmachine merge upstream

peteharverson
peteharverson approved these changes Nov 10, 2023
View reviewed changes
Copy link
Contributor

@peteharverson peteharverson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Latest changes LGTM.

Hope we can add the 'Add to cases' actions in for 8.13 once that functionality is supported.
Also look forward to seeing options for enhancing the info in the summary tab @mdefazio .

@kibana-ci
Copy link
Collaborator

kibana-ci commented Nov 10, 2023 •
edited
Loading

💛 Build succeeded, but was flaky

  • Buildkite Build
  • Commit: b6f20b2
  • Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-167998-b6f20b2219b5

Failed CI Steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
ml 1820 1854 +34

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
discover 588.4KB 588.4KB +8.0B
ml 3.5MB 3.6MB +34.1KB
securitySolution 13.0MB 13.0MB +32.0B
stackConnectors 556.4KB 556.4KB +8.0B
total +34.1KB

Canvas Sharable Runtime

The Canvas "shareable runtime" is an bundle produced to enable running Canvas workpads outside of Kibana. This bundle is included in third-party webpages that embed canvas and therefor should be as slim as possible.

id before after diff
module count - 5607 +5607
total size - 5.9MB +5.9MB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
apm 36.5KB 36.5KB +8.0B
cases 155.2KB 155.3KB +8.0B
infra 101.6KB 101.6KB +8.0B
ml 76.3KB 78.6KB +2.2KB
observability 104.1KB 104.1KB +8.0B
stackAlerts 23.9KB 23.9KB +8.0B
synthetics 19.6KB 19.6KB +8.0B
triggersActionsUi 97.3KB 97.3KB +8.0B
uptime 22.8KB 22.8KB +8.0B
total +2.3KB
Unknown metric groups

async chunk count

id before after diff
ml 34 35 +1

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @darnautov

@darnautov darnautov merged commit 875268d into elastic:main Nov 10, 2023
@kibanamachine kibanamachine added the backport:skip This commit does not require backporting label Nov 10, 2023
@delanni delanni mentioned this pull request Nov 10, 2023
Merged
mistic pushed a commit that referenced this pull request Nov 10, 2023
@delanni
fix: incorrect import causes storybook build to fail (#171033)
33757f6 
## Summary
[This
change](https://github.com/darnautov/kibana/blob/b6f20b2219b5ccf22316ee36e0c079b9e3d1327c/x-pack/plugins/ml/public/application/components/collapsible_panel/panel_header_items.tsx#L9)
in this PR: #167998 is causing an
error in building storybooks:
https://buildkite.com/elastic/kibana-on-merge/builds/38046#018bb9d2-7820-43ad-9144-e40d33d28c3b

In brief, the import looks like this:
```typescript
import { css } from '@emotion/react/dist/emotion-react.cjs';
```
but it should be like this:
```typescript
import { css } from '@emotion/react';
```

It looks it's a bad import, we should set up a pre-merge check for these
accidental auto-imports.

cc: @darnautov please review
@XavierM XavierM mentioned this pull request Nov 14, 2023
Closed
@logeekal logeekal mentioned this pull request Nov 16, 2023
Closed
@szabosteve szabosteve changed the title [ML] Show alerts data in the Anomaly Explorer [ML] Shows alerts data in the Anomaly Explorer Dec 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@maryam-saeidi maryam-saeidi maryam-saeidi approved these changes

@cnasikas cnasikas cnasikas left review comments

@mdefazio mdefazio mdefazio left review comments

@mgiota mgiota mgiota approved these changes

@XavierM XavierM XavierM approved these changes

@qn895 qn895 qn895 approved these changes

@umbopepato umbopepato umbopepato approved these changes

@peteharverson peteharverson peteharverson approved these changes

@e40pud e40pud e40pud approved these changes

Assignees

@darnautov darnautov

Labels
backport:skip This commit does not require backporting ci:build-serverless-image Feature:Alerting/Alerts-as-Data Issues related to Alerts-as-data and RuleRegistry Feature:Alerting/RuleTypes Issues related to specific Alerting Rules Types Feature:Anomaly Detection ML anomaly detection :ml release_note:feature Makes this part of the condensed release notes Team:ML Team label for ML (also use :ml) v8.12.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.