[ML] Anomaly Explorer charts

[walterra]

Tracking issue for the implementation of a custom charts for detector functions rare, over, lat_long.

Investigate

• [x] sample data and job configurations
• [x] stand-alone prototype
• [x] prototypish initial anomaly explorer implementation

Implementation

Phase 1 #23423

• [x] select correct anomalies
• [x] filter by partition field
• [x] sorted by rarity
• [x] implement sampling
• [x] optimize legends/title #23494
• [x] fix flex based layout 829016e
• [x] feature flag 832e21b
• [x] add hint about context data (explain that it's a sampled preview) 0625fcd
• [x] fix/update tests
• [x] benchmarking (https://gist.github.com/walterra/5e249719c15b5a83f70e0d60557a198c)
• [x] fix error when results length is 0
• [x] fix badge overflow breaking layout 9537d87
• [x] show rare chart only if no over field is used in the detector for now 84d85a9
• [x] fix blank rare charts https://github.com/elastic/kibana/pull/23423#issuecomment-426961267 — Problem identified: When the time range shown in the chart is smaller than the time range covered by a swimlane cell, a rare anomaly could actually be outside the covered time range. This is actually also a problem on master even without PR 1 so not a problem introduced by the rare chart itself. 2f75c7f
• [x] investigate mapping anomalies to dots in population chart https://github.com/elastic/kibana/pull/23423#issuecomment-426961267 — that screenshot is from a detector using over and by, the by field can have an influencer on the outcome and a total high count could be less anomalous than a lower count one.
• [x] Say 'rarer' instead of 'more rare'. a1acf52
• [x] fix undefined in tooltip https://github.com/elastic/kibana/pull/23423#issuecomment-426972639 5f5ae7a
• [x] Show typical value in tooltips for anomalies with over but no by field or only 1 numberOfCauses. 4e2b015
• [x] Move entity value in distribution chart tooltip just below date above other info. 001f328

Phase 2

• [x] use arrow functions https://github.com/elastic/kibana/pull/23423#discussion_r222951290 — c60385f
• [x] support for more detector functions for population charts using over fields — 33cbdb3
• [x] optimize sampling and normalize skewed results from count and sum based aggregations. — #24402
• [x] add a y-axis description to chart header for rare charts https://github.com/elastic/kibana/pull/24823
• [x] for rare charts with low cardinality (e.g. status codes or http methods in contrast to URLs or IPs) category on the y axis could be displayed. https://github.com/elastic/kibana/pull/23423#issuecomment-427020019 - done in https://github.com/elastic/kibana/pull/24852
• [ ] fix an issue where screen width would expect 3 columns but only 1-2 charts are available
• [ ] fix flexbox/chartwidth overflow issue https://github.com/elastic/kibana/pull/23423#issuecomment-427018769
• [ ] fix axis label issue https://github.com/elastic/kibana/pull/23423#issuecomment-427018769
• [ ] make SAMPLER_TOP_TERMS_SHARD_SIZE a function argument https://github.com/elastic/kibana/pull/23423#discussion_r222643685
• [ ] display both entity-field-name and entity-field-value in tooltip (PR1 shows value only)

Phase 3 / future work / nice to have

• [ ] support for freq_rare https://www.elastic.co/guide/en/x-pack/current/ml-rare-functions.html#ml-freq-rare
• [ ] support for rare/freq_rare plus over fields
• [ ] consolidate explorer charts code, remove redundancies
• [ ] Use EuiDescriptionList instead of mlDescriptionList styles. https://github.com/elastic/kibana/pull/23423#discussion_r222641612
• [ ] Move individual client side request to its own summarized Kibana API endpoint https://github.com/elastic/kibana/pull/23423#discussion_r222643129
• [ ] display a distribution chart for population detectors which use a script field defined in the datafeed configuration, or when the function does not map to an ES aggregation (e.g. varp, info_content) if model plot is enabled. Currently a metric style chart is displayed in these cases.
• [ ] Migrate to TypeScript

---

---

Part of #22922.

[elasticmachine]

Pinging @elastic/ml-ui