elastic/logs

Anomaly detection setup

Closed this issue · 10 comments

Summary of the problem (If there are multiple problems or use cases, prioritize them)
With the new user flow, discussed in this issue, we need to rethink the whole ML job setup.

Pinging @elastic/observability-design (design)

WIP
logs-anomaly-setup

...I think this might work to combine log rate and categorization job setups.

Full workflow

ml-setup-logs

I updated the job list to use cards:
Screenshot 2020-04-22 at 17 42 50

Interesting concept - I wonder how well it scales for smaller screens and larger numbers of jobs 🤔 What are the upsides of cards from a UX perspective?

@weltenwort I see the cards as a purely visual enhancement compared to the list. One could argue, that it's easier to grasp which job is already set up and which one isn't...
I don't see any issue on small screens, we have only 2 jobs for now. Do you think we will be scaling the number of jobs soon to 6+?

probably not very soon. what might come sonner, though, is the combination of ml jobs with alerts. would that be integrated into the flyout too or where would those be configured?

I don't see a reason to include alerts in this flyout at the moment. I would prefer to keep those separate from each other. But I'm happy to discuss this in one of our syncs.

This video is showing the full setup:
full-setup

I'm going to split this up into several smaller implementation issues:

  1. Moving the setup to the flyout
  2. Showing category and log rate anomalies in the table (dependent on elastic/kibana#63671)
  3. Showing the list of ML jobs in the flyout

Additional info:

  • For now, we are going to keep the Categories tab
  • I'm going to open additional issue, handling license issues and upgrades
  • There will be a bit of cleanup for the anomalies tab, but I'm still working on that