Daylight saving time events are causing a burst of false positives in anomaly detection jobs due to a sudden time shift. To remedy the situation, we allow users to configure an explicit time shift for detectors using customer_rule action force_time_shift implemented in https://github.com/elastic/elasticsearch/pull/110974.
However, since the DST events occur regularly and multiple jobs are usually affected, we need to allow users to control the explicit time shift using scheduled events.
To this end, we need to extend the POST calendars API to allow fine grade configuration:
Internally, the calendar events should be converted to detection rules as it happens already, but with finer configuration.
Additionally, the detection rules corresponding to the past calendar events should be removed from the job configuration, in order to keep the configuration of long-running jobs slim.
Description
Daylight saving time events are causing a burst of false positives in anomaly detection jobs due to a sudden time shift. To remedy the situation, we allow users to configure an explicit time shift for detectors using customer_rule action
force_time_shift
implemented in https://github.com/elastic/elasticsearch/pull/110974.However, since the DST events occur regularly and multiple jobs are usually affected, we need to allow users to control the explicit time shift using scheduled events.
To this end, we need to extend the POST calendars API to allow fine grade configuration:
Internally, the calendar events should be converted to detection rules as it happens already, but with finer configuration.
Additionally, the detection rules corresponding to the past calendar events should be removed from the job configuration, in order to keep the configuration of long-running jobs slim.