Open walterra opened 8 months ago
Pinging @elastic/ml-ui (:ml)
Thoughts on a future alerts integration: It is likely too expensive to run fields caps on every alert run. What we could do instead would be something similar to how the anomaly alert caches field formats.
Identifying fields for analysis is not necessary on every alert run as long as the underlying index structure doesn't change. So caching those fields would greatly improve runtime of the analysis. This could even be part of the setup process of the alert: We'd run field identification once and the user decides which fields they'd like to use for the alert. This would mean for an alert check we'd just have to run significant terms and that's it (without grouping).
So caching those fields would greatly improve runtime of the analysis.
This sounds like a great idea. There's no need to do this for every alert execution.
I'll remove the version label from this one. Things we plan to implement for a specific version should be mentioned in this version specific meta issue: #187684.
This issue will still serve its purpose to track the overall progress on how to enable log rate analysis in other solution features.
The Kibana API for Log Rate Analysis is internal and was treated as an implementation detail for the UI so far. There are several use cases where it would be useful to have a more generic API for usage by other parts of the platform and solutions:
The existing internal API is also a bit complex as it streams custom NDJSON and includes data like detailed histogram data to populate the results that might not be necessary for the above use cases.
The public API could look like this:
The API would then internally run:
p-value score
.The API would not support streaming but would return results as a single JSON object.
The existing UI and internal API is GA so it's not a good candidate for PoCs and experimentation. This additional public API could be tagged experimental until the first use cases are picking it up and are more fleshed out.