Skip to content

[ResponseOps][ML] Anomaly detection rules are created with the wrong consumer and cause alerts to not be shown #235504

@umbopepato

Description

@umbopepato

📄 Description

When creating alerting rules from anomaly detection jobs, the resulting rules have a stackAlerts consumer, which is filtered out when checking if there are any alerts related to ML jobs in the anomaly explorer page, causing alerts to never show up.

🧪 Reproduction

  1. Create an anomaly detection job, using a dataset that triggers some anomalies (i.e. Kibana Sample Data Logs)
  2. Navigate to Stack Management > Anomaly Detection Jobs
  3. From the ••• menu of the job, click Create alert rule
  4. Fill-in the details in the flyout and test the query to match at least one anomaly (increase the time frame and buckets count accordingly), then save the rule
  5. Open the rule page, if necessary manually run it, and wait for some alerts to show up
  6. Open the Analytics > Machine Learning > Anomaly Explorer page, select the relevant job(s) and a timeframe that covers the anomaly/anomalies
  7. Verify that even though some alerts are active for those jobs, no Alerts section is visible in the page

✅ Proposed solution

Pre-fill the consumer field of the rule with one of the ML ones

Important

This would not fix the rules created previously, which would not show up because of the consumer filter. To make sure all rules are visible, we should either migrate them to a different consumer or add stackAlerts as a valid ML consumer in the explorer alerts query (I don't know the implications though).

Metadata

Metadata

Assignees

Labels

Team:MLTeam label for ML (also use :ml) t//Team:ResponseOpsPlatform ResponseOps team (formerly the Cases and Alerting teams) t//

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions