Anomaly table/list

[katrin-freihofner]

Part of the user flow discussed in this issue is a new view. This view can be split into multiple parts (ordered by priority):

1. table with anomalies (very bottom of the view) -> engineering ticket
2. swimlane visualization (top of the view)
3. details chart (middle part)

This issue focuses on the table.

Questions to address:

• Which anomaly types do we show?
• Which kind of data do we show for these anomalies?
• What kind of details do we show in the expanded rows?
• How should the anomalies be structured/sorted?
• Can the table be searched/filtered?

This is an example of the initial wireframe

[elasticmachine]

Pinging @elastic/observability-design (design)

[katrin-freihofner]

Current design status

Expanded view of log categories

The expanded view for logs rate is still WIP

[katrin-freihofner]

The table contains

• the anomaly score
• a description
• the dataset

The expandable rows contain

• example logs of the category
• the first few log lines of a dataset (and within this timeframe) for log rate

...from these logs users can open a context menu - similar to what we have in the stream view. The actions in this menu are:

• View in stream (takes you to the stream, adds dataset and time filter, highlights log line)
• View anomaly in machine learning (navigates to single metrics explorer, adds dataset/category and timeframe filter) @mukeshelastic is that correct?