[ML] Updates APM Module to Work with Service Maps (elastic#70361) (el…

…astic#70616) * updates apm integration job to work with service maps * rename apm job in setup_module test * modifies detector description Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Elastic Machine <[email protected]>
nreese · Jul 2, 2020 · aa4d3f4 · aa4d3f4
1 parent 660c9e7
commit aa4d3f4
Show file tree

Hide file tree

Showing 5 changed files with 45 additions and 40 deletions.
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/manifest.json
@@ -1,29 +1,29 @@
 {
   "id": "apm_transaction",
   "title": "APM",
-  "description": "Detect anomalies in high mean of transaction duration (ECS).",
+  "description": "Detect anomalies in transactions from your APM services.",
   "type": "Transaction data",
   "logoFile": "logo.json",
-  "defaultIndexPattern": "apm-*",
+  "defaultIndexPattern": "apm-*-transaction",
   "query": {
     "bool": {
       "filter": [
         { "term": { "processor.event": "transaction" } },
-        { "term": { "transaction.type": "request" } }
+        { "exists": { "field": "transaction.duration" } }
       ]
     }
   },
   "jobs": [
     {
-      "id": "high_mean_response_time",
-      "file": "high_mean_response_time.json"
+      "id": "high_mean_transaction_duration",
+      "file": "high_mean_transaction_duration.json"
     }
   ],
   "datafeeds": [
     {
-      "id": "datafeed-high_mean_response_time",
-      "file": "datafeed_high_mean_response_time.json",
-      "job_id": "high_mean_response_time"
+      "id": "datafeed-high_mean_transaction_duration",
+      "file": "datafeed_high_mean_transaction_duration.json",
+      "job_id": "high_mean_transaction_duration"
     }
   ]
 }
diff --git a/.../ml/datafeed_high_mean_response_time.json → ...afeed_high_mean_transaction_duration.json b/.../ml/datafeed_high_mean_response_time.json → ...afeed_high_mean_transaction_duration.json
@@ -7,7 +7,7 @@
     "bool": {
       "filter": [
         { "term": { "processor.event": "transaction" } },
-        { "term": { "transaction.type": "request" } }
+        { "exists": { "field": "transaction.duration.us" } }
       ]
     }
   }

diff --git a/.../ml/server/models/data_recognizer/modules/apm_transaction/ml/high_mean_response_time.json b/.../ml/server/models/data_recognizer/modules/apm_transaction/ml/high_mean_response_time.json
diff --git a/...ver/models/data_recognizer/modules/apm_transaction/ml/high_mean_transaction_duration.json b/...ver/models/data_recognizer/modules/apm_transaction/ml/high_mean_transaction_duration.json
@@ -0,0 +1,35 @@
+{
+  "job_type": "anomaly_detector",
+  "groups": [
+    "apm"
+  ],
+  "description": "Detect transaction duration anomalies across transaction types for your APM services.",
+  "analysis_config": {
+    "bucket_span": "15m",
+    "detectors": [
+      {
+        "detector_description": "high duration by transaction type for an APM service",
+        "function": "high_mean",
+        "field_name": "transaction.duration.us",
+        "by_field_name": "transaction.type",
+        "partition_field_name": "service.name"
+      }
+    ],
+    "influencers": [
+      "transaction.type",
+      "service.name"
+    ]
+  },
+  "analysis_limits": {
+    "model_memory_limit": "32mb"
+  },
+  "data_description": {
+    "time_field": "@timestamp"
+  },
+  "model_plot_config": {
+    "enabled": true
+  },
+  "custom_settings": {
+    "created_by": "ml-module-apm-transaction"
+  }
+}
diff --git a/x-pack/test/api_integration/apis/ml/modules/setup_module.ts b/x-pack/test/api_integration/apis/ml/modules/setup_module.ts
@@ -218,7 +218,7 @@ export default ({ getService }: FtrProviderContext) => {
         responseCode: 200,
         jobs: [
           {
-            jobId: 'pf5_high_mean_response_time',
+            jobId: 'pf5_high_mean_transaction_duration',
             jobState: JOB_STATE.CLOSED,
             datafeedState: DATAFEED_STATE.STOPPED,
             modelMemoryLimit: '11mb',