[Metrics UI] Add Metrics Anomaly Alert Type by Zacqary · Pull Request #89244 · elastic/kibana

Zacqary · 2021-01-25T22:39:10Z

Summary

Adds the Metrics Anomaly alert type. Also revamps the alert dropdown to allow you to add anomaly alerts (and all alert types) from either the Inventory page or Metrics Explorer.

Alert UI

Influencer Filter Autocomplete

Dropdown UI

How To Test

Alert Type

Generate anomalies with Slingshot using this guide
Open the Create Alert flyout for anomaly alerts, and use the Alert Preview dialog to make sure the alert would have fired over the past hour/day, depending on how easily you can get anomalies to generate.
Create an anomaly alert. Then, generate a new anomaly using Slingshot. Ensure it fires.
Try 2. and 3. with influencer filters, and ensure the alert only fires if you've filtered to a matching influencer. Follow the gist instructions on causing anomalies only on a few pods to create anomalies.
Make sure the influencer filter works both with an exact match and with a wildcard:

UI

Stress-test the Influencer Filter autocomplete to make sure it behaves in a way that makes sense.

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)

# Conflicts: # x-pack/plugins/infra/server/lib/infra_ml/metrics_hosts_anomalies.ts # x-pack/plugins/infra/server/lib/infra_ml/metrics_k8s_anomalies.ts

elasticmachine · 2021-01-25T22:39:12Z

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

Zacqary · 2021-01-26T18:03:02Z

@sorantis Should this be called "Metrics Anomaly" or "Infrastructure Anomaly"? Docs call inventory alerts "Infrastructure Threshold" (https://www.elastic.co/guide/en/observability/master/infrastructure-threshold-alert.html) so I'm wondering if we should shift towards that naming convention

Zacqary · 2021-01-26T21:28:29Z

@katefarrar Could use some feedback on this influencer filter component.

By default, it looks like:

Is it clear that you can enter a possible field value of kubernetes.pod.uid in this field to limit the alert scope just to a certain pod?
Is it clear that when the field is empty and the placeholder says (Any) that that means the alert scope won't be limited at all?

The user can either enter an exact search string, or use * as a wildcard. Is it okay that we don't explicitly state that wildcards can be used (i.e. Elastic users should expect they can use wildcards anywhere), or should we change/add some text to make this clear? (We can mention wildcards in the docs, for sure, but is that enough?)

sorantis · 2021-01-27T16:10:32Z

Infrastructure anomaly SGTM

katefarrar · 2021-01-27T19:50:36Z

Talked with @Zacqary and we're going to implement the following changes:

Add a checkbox with Filter by node and the filter component underneath
Change placeholder text from Any to Everything and have that search component auto-fill as you type (similar to the "Create alert per" option on a threshold alert)
Update helper text to indicate that a wildcard search can be used: For example: "kubernetes-pod-id" or "kubernetes-pod-id-a*" (Zacqary is going to figure out the final text)

Zacqary · 2021-02-02T21:07:30Z

@simianhacker Didn't realize the alert preview wasn't an accurate reflection of how the alert would perform. startTimes only get recorded on multiples of 15 minutes, even if the anomaly is detected mid-bucket, so an alert interval of 1 minute does indeed miss those.

I'm pushing a fix, but it's unable to prevent firing the alert up to 15 times per anomaly. I think this alert type will greatly benefit from not changing the default Notify only on status change setting.

With that in mind, this alert type probably really wants us to merge #89939

# Conflicts: # x-pack/plugins/infra/public/alerting/inventory/components/alert_dropdown.tsx # x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_dropdown.tsx # x-pack/plugins/infra/public/components/logging/log_analysis_setup/subscription_splash_content.tsx

Zacqary · 2021-02-05T17:33:57Z

@elasticmachine merge upstream

…74809-anomaly-alert

simianhacker

I just tested my scenario and everything works as expected.

LGTM

x-pack/plugins/infra/server/lib/infra_ml/metrics_hosts_anomalies.ts

x-pack/plugins/infra/server/lib/infra_ml/metrics_k8s_anomalies.ts

# Conflicts: # x-pack/plugins/infra/public/types.ts # x-pack/plugins/infra/server/lib/infra_ml/metrics_hosts_anomalies.ts # x-pack/plugins/infra/server/lib/infra_ml/metrics_k8s_anomalies.ts # x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_hosts_anomalies.ts # x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.ts

kibanamachine · 2021-02-09T23:40:16Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`infra`	1046	1050	+4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`infra`	1.9MB	1.9MB	+15.6KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`infra`	172.6KB	188.2KB	+15.6KB

Unknown metric groups

async chunk count

id	before	after	diff
`infra`	13	14	+1

History

💔 Build #105377 failed 4f0526f
💔 Build #105360 failed 7f5d12a
💛 Build #104789 was flaky 27eddae
💚 Build #104367 succeeded 7fdc60e
💔 Build #104336 failed cf785c1

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

This reverts commit 0d94968.

spalger · 2021-02-10T00:17:04Z

Sorry @Zacqary but once this was merged it started failing master builds in a critical way so I needed to revert it https://kibana-ci.elastic.co/job/elastic+kibana+baseline-capture/13507/execution/node/155/log/

Please resubmit in a new PR with master merged. Thanks!

…89244)"" This reverts commit 8166bec.

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> # Conflicts: # x-pack/plugins/infra/public/types.ts

#90889) * Revert "Revert "[Metrics UI] Add Metrics Anomaly Alert Type (#89244)"" This reverts commit 8166bec. * Fix type error

* master: (99 commits) [Fleet] Use Fleet Server indices in the search bar (elastic#90835) [Search Sessions] added an info flyout to session management (elastic#90559) [ILM] Revisit searchable snapshot field after new redesign (elastic#90793) [Alerting] License Errors on Alert List View (elastic#89920) RFC Improve saved object migrations algorithm (elastic#84333) [Lens] (Accessibility) Fix focus on drag and drop actions (elastic#90561) Use new shortcut links to Fleet discuss forums. (elastic#90786) Do not generate an ephemeral encryption key in production. (elastic#81511) [Fleet] Use staging registry for snapshot builds (elastic#90327) Actually deleting x-pack/tsconfig.refs.json (elastic#90898) Add deprecation warning to all Beats CM pages. (elastic#90741) skip flaky suite (elastic#90136) Revert "Revert "[Metrics UI] Add Metrics Anomaly Alert Type (elastic#89244)"" (elastic#90889) remove ref to removed tsconfig file [core.logging] Uses host timezone as default (elastic#90368) [Maps] remove maps_file_upload plugin and fold public folder into file_upload plugin (elastic#90292) Revert "[Metrics UI] Add Metrics Anomaly Alert Type (elastic#89244)" [dev-utils/ci-stats] support disabling ship errors (elastic#90851) Prefix with / (elastic#90836) [Metrics UI] Add Metrics Anomaly Alert Type (elastic#89244) ...

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Zacqary added 7 commits January 20, 2021 13:22

[Metrics UI] Initial implementation of anomaly alert

2f0ea51

Implement anomaly alert preview

e393ec6

Add missing file

bd78bcd

Add context variables and default message

a59056a

Add influencer filter

2ce14fd

Clarify filter text

c92c8c2

Merge remote-tracking branch 'upstream/master' into 74809-anomaly-alert

5696629

# Conflicts: # x-pack/plugins/infra/server/lib/infra_ml/metrics_hosts_anomalies.ts # x-pack/plugins/infra/server/lib/infra_ml/metrics_k8s_anomalies.ts

Zacqary added release_note:enhancement Feature:Metrics UI Metrics UI feature v8.0.0 Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services v7.12.0 labels Jan 25, 2021

Zacqary requested a review from a team as a code owner January 25, 2021 22:39

Zacqary added 3 commits January 25, 2021 16:42

Remove commented code

50026d4

Merge remote-tracking branch 'upstream/master' into 74809-anomaly-alert

c9002e5

Typecheck fixes

fc0eddd

Zacqary added 3 commits January 26, 2021 14:03

APM-ize Alerts dropdown and add anomaly alert option

5bf2a14

i18n fix

9ff30c6

Add expression jest test

dc6efa3

Fix i18n

edfb403

Zacqary added 5 commits January 27, 2021 10:27

Rename alert type from Metric Anomaly to Infrastructure Anomaly

da09878

Revert mistaken expression_row commit

c768375

Consolidate SubscriptionSplashContent component

c63968d

Show trial prompt on Anomaly alert when ML is disabled

eb0bccf

Type fix

ffbf9fa

Zacqary added 4 commits February 2, 2021 15:42

Fix 15 minute bucket lookback in executor and preview

c4fcfa9

Add some clarifying comments

8edfcb5

Fix license headers

2f3d704

kibanamachine and others added 4 commits February 5, 2021 12:34

Merge branch 'master' into 74809-anomaly-alert

cf785c1

Fix license header

c3e715f

Merge branch '74809-anomaly-alert' of github.com:Zacqary/kibana into …

7fdc60e

…74809-anomaly-alert

Merge remote-tracking branch 'upstream/master' into 74809-anomaly-alert

27eddae

simianhacker approved these changes Feb 8, 2021

View reviewed changes

neptunian reviewed Feb 9, 2021

View reviewed changes

x-pack/plugins/infra/server/lib/infra_ml/metrics_hosts_anomalies.ts Outdated Show resolved Hide resolved

neptunian reviewed Feb 9, 2021

View reviewed changes

x-pack/plugins/infra/server/lib/infra_ml/metrics_k8s_anomalies.ts Outdated Show resolved Hide resolved

Zacqary enabled auto-merge (squash) February 9, 2021 21:16

Zacqary added 2 commits February 9, 2021 15:20

Fix merge

4f0526f

Fix typos

c0edf3f

Zacqary merged commit 0d94968 into elastic:master Feb 9, 2021

spalger added a commit that referenced this pull request Feb 10, 2021

Revert "[Metrics UI] Add Metrics Anomaly Alert Type (#89244)"

8166bec

This reverts commit 0d94968.

spalger added the reverted label Feb 10, 2021

Zacqary added a commit to Zacqary/kibana that referenced this pull request Feb 10, 2021

Revert "Revert "[Metrics UI] Add Metrics Anomaly Alert Type (elastic#…

84f6890

…89244)"" This reverts commit 8166bec.

This was referenced Feb 10, 2021

Revert "Revert "[Metrics UI] Add Metrics Anomaly Alert Type (#89244)"" #90889

Merged

[7.x] [Metrics UI] Add Metrics Anomaly Alert Type (#89244) #90893

Merged

Zacqary added a commit to Zacqary/kibana that referenced this pull request Feb 10, 2021

[Metrics UI] Add Metrics Anomaly Alert Type (elastic#89244)

8a92780

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> # Conflicts: # x-pack/plugins/infra/public/types.ts

Zacqary added a commit that referenced this pull request Feb 10, 2021

Revert "Revert "[Metrics UI] Add Metrics Anomaly Alert Type (#89244)"" (

38a6475

#90889) * Revert "Revert "[Metrics UI] Add Metrics Anomaly Alert Type (#89244)"" This reverts commit 8166bec. * Fix type error

Zacqary added a commit that referenced this pull request Feb 10, 2021

[7.x] [Metrics UI] Add Metrics Anomaly Alert Type (#89244) (#90893)

fdd759d

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Zacqary mentioned this pull request Feb 24, 2021

[Test Plan] [Metrics UI] Infrastructure Anomaly alert type #92661

Closed

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Metrics UI] Add Metrics Anomaly Alert Type#89244

[Metrics UI] Add Metrics Anomaly Alert Type#89244
Zacqary merged 39 commits intoelastic:masterfrom
Zacqary:74809-anomaly-alert

Zacqary commented Jan 25, 2021 •

edited

Loading

Uh oh!

elasticmachine commented Jan 25, 2021

Uh oh!

Zacqary commented Jan 26, 2021

Uh oh!

Zacqary commented Jan 26, 2021

Uh oh!

sorantis commented Jan 27, 2021

Uh oh!

katefarrar commented Jan 27, 2021 •

edited

Loading

Uh oh!

Zacqary commented Feb 2, 2021

Uh oh!

Zacqary commented Feb 5, 2021

Uh oh!

simianhacker left a comment

Uh oh!

Uh oh!

Uh oh!

kibanamachine commented Feb 9, 2021

async chunk count

Uh oh!

spalger commented Feb 10, 2021 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

Zacqary commented Jan 25, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Alert UI

Influencer Filter Autocomplete

Dropdown UI

How To Test

Alert Type

UI

Checklist

Uh oh!

elasticmachine commented Jan 25, 2021

Uh oh!

Zacqary commented Jan 26, 2021

Uh oh!

Zacqary commented Jan 26, 2021

Uh oh!

sorantis commented Jan 27, 2021

Uh oh!

katefarrar commented Jan 27, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Zacqary commented Feb 2, 2021

Uh oh!

Zacqary commented Feb 5, 2021

Uh oh!

simianhacker left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kibanamachine commented Feb 9, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

async chunk count

History

Uh oh!

spalger commented Feb 10, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Zacqary commented Jan 25, 2021 •

edited

Loading

katefarrar commented Jan 27, 2021 •

edited

Loading

spalger commented Feb 10, 2021 •

edited

Loading