Skip to content

[ML] AIOps: Log Rate Analysis: Limits msearch usage#235611

Merged
jgowdyelastic merged 5 commits intoelastic:mainfrom
walterra:ml-235562-limit-msearch
Sep 24, 2025
Merged

[ML] AIOps: Log Rate Analysis: Limits msearch usage#235611
jgowdyelastic merged 5 commits intoelastic:mainfrom
walterra:ml-235562-limit-msearch

Conversation

@walterra
Copy link
Contributor

@walterra walterra commented Sep 18, 2025

Summary

Part of #235562

  • limit log rate analysis to keyword fields for alert analysis f8c3bbb
  • limit log rate analysis category requests to reduce msearch from 1000 to 100 b4b5cea

Checklist

@walterra walterra marked this pull request as ready for review September 18, 2025 21:08
@walterra walterra requested a review from a team as a code owner September 18, 2025 21:08
@elasticmachine
Copy link
Contributor

Pinging @elastic/ml-ui (:ml)

Copy link
Contributor

@alvarezmelissa87 alvarezmelissa87 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM ⚡

Copy link
Member

@jgowdyelastic jgowdyelastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@peteharverson
Copy link
Contributor

@elasticmachine merge upstream

@elasticmachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #89 / Reporting Generate CSV from SearchSource unquoted values Exports CSV with almost all fields when using fieldsFromSource

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
aiops 517.9KB 517.9KB +4.0B

History

cc @walterra

@jgowdyelastic jgowdyelastic merged commit 8ca8cbf into elastic:main Sep 24, 2025
12 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.18, 8.19, 9.0, 9.1

https://github.com/elastic/kibana/actions/runs/17975675796

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Sep 24, 2025
## Summary

Part of elastic#235562

- limit log rate analysis to keyword fields for alert analysis
f8c3bbb
- limit log rate analysis category requests to reduce `msearch` from
1000 to 100 b4b5cea

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 8ca8cbf)
@kibanamachine
Copy link
Contributor

💔 Some backports could not be created

Status Branch Result
8.18 Backport failed because of merge conflicts
8.19 Backport failed because of merge conflicts
9.0 Backport failed because of merge conflicts
9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 235611

Questions ?

Please refer to the Backport tool documentation

@jgowdyelastic
Copy link
Member

💚 All backports created successfully

Status Branch Result
9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@jgowdyelastic
Copy link
Member

💚 All backports created successfully

Status Branch Result
8.19
8.18

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

jgowdyelastic pushed a commit to jgowdyelastic/kibana that referenced this pull request Sep 24, 2025
Part of elastic#235562

- limit log rate analysis to keyword fields for alert analysis
f8c3bbb
- limit log rate analysis category requests to reduce `msearch` from
1000 to 100 b4b5cea

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 8ca8cbf)
jgowdyelastic pushed a commit to jgowdyelastic/kibana that referenced this pull request Sep 24, 2025
Part of elastic#235562

- limit log rate analysis to keyword fields for alert analysis
f8c3bbb
- limit log rate analysis category requests to reduce `msearch` from
1000 to 100 b4b5cea

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 8ca8cbf)
kibanamachine added a commit that referenced this pull request Sep 24, 2025
…236287)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[ML] AIOps: Log Rate Analysis: Limit msearch usage
(#235611)](#235611)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Walter M.
Rafelsberger","email":"walter.rafelsberger@elastic.co"},"sourceCommit":{"committedDate":"2025-09-24T11:47:27Z","message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix",":ml","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[ML]
AIOps: Log Rate Analysis: Limit msearch
usage","number":235611,"url":"https://github.com/elastic/kibana/pull/235611","mergeCommit":{"message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/235611","number":235611,"mergeCommit":{"message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Walter M. Rafelsberger <walter.rafelsberger@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
@peteharverson peteharverson changed the title [ML] AIOps: Log Rate Analysis: Limit msearch usage Sep 24, 2025
jgowdyelastic added a commit that referenced this pull request Sep 24, 2025
…236296)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[ML] AIOps: Log Rate Analysis: Limit msearch usage
(#235611)](#235611)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Walter M.
Rafelsberger","email":"walter.rafelsberger@elastic.co"},"sourceCommit":{"committedDate":"2025-09-24T11:47:27Z","message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix",":ml","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[ML]
AIOps: Log Rate Analysis: Limit msearch
usage","number":235611,"url":"https://github.com/elastic/kibana/pull/235611","mergeCommit":{"message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/235611","number":235611,"mergeCommit":{"message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/236295","number":236295,"state":"OPEN"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/236287","number":236287,"state":"OPEN"}]}]
BACKPORT-->

---------

Co-authored-by: Walter M. Rafelsberger <walter.rafelsberger@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
jgowdyelastic added a commit that referenced this pull request Sep 24, 2025
…236295)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[ML] AIOps: Log Rate Analysis: Limit msearch usage
(#235611)](#235611)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Walter M.
Rafelsberger","email":"walter.rafelsberger@elastic.co"},"sourceCommit":{"committedDate":"2025-09-24T11:47:27Z","message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix",":ml","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[ML]
AIOps: Log Rate Analysis: Limit msearch
usage","number":235611,"url":"https://github.com/elastic/kibana/pull/235611","mergeCommit":{"message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/235611","number":235611,"mergeCommit":{"message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/236287","number":236287,"state":"OPEN"}]}]
BACKPORT-->

---------

Co-authored-by: Walter M. Rafelsberger <walter.rafelsberger@elastic.co>
rbrtj pushed a commit to rbrtj/kibana that referenced this pull request Sep 25, 2025
## Summary

Part of elastic#235562

- limit log rate analysis to keyword fields for alert analysis
f8c3bbb
- limit log rate analysis category requests to reduce `msearch` from
1000 to 100 b4b5cea

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
CoenWarmer pushed a commit to CoenWarmer/kibana that referenced this pull request Sep 25, 2025
## Summary

Part of elastic#235562

- limit log rate analysis to keyword fields for alert analysis
f8c3bbb
- limit log rate analysis category requests to reduce `msearch` from
1000 to 100 b4b5cea

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
jgowdyelastic added a commit that referenced this pull request Sep 25, 2025
…236297)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[ML] AIOps: Log Rate Analysis: Limit msearch usage
(#235611)](#235611)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Walter M.
Rafelsberger","email":"walter.rafelsberger@elastic.co"},"sourceCommit":{"committedDate":"2025-09-24T11:47:27Z","message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix",":ml","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[ML]
AIOps: Log Rate Analysis: Limit msearch
usage","number":235611,"url":"https://github.com/elastic/kibana/pull/235611","mergeCommit":{"message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/235611","number":235611,"mergeCommit":{"message":"[ML]
AIOps: Log Rate Analysis: Limit msearch usage (#235611)\n\n##
Summary\n\nPart of #235562\n\n- limit log rate analysis to keyword
fields for alert analysis\nf8c3bbb12cd3a12e7653fb72c85b0e3f7abe81e3\n-
limit log rate analysis category requests to reduce `msearch` from\n1000
to 100 b4b5cea\n\n### Checklist\n\n-
[x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n---------\n\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"8ca8cbfe7add6c05de9168d4a38b4e458c9fbbe7"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/236295","number":236295,"state":"OPEN"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/236287","number":236287,"state":"OPEN"}]}]
BACKPORT-->

---------

Co-authored-by: Walter M. Rafelsberger <walter.rafelsberger@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
niros1 pushed a commit that referenced this pull request Sep 30, 2025
## Summary

Part of #235562

- limit log rate analysis to keyword fields for alert analysis
f8c3bbb
- limit log rate analysis category requests to reduce `msearch` from
1000 to 100 b4b5cea

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
rylnd pushed a commit to rylnd/kibana that referenced this pull request Oct 17, 2025
## Summary

Part of elastic#235562

- limit log rate analysis to keyword fields for alert analysis
f8c3bbb
- limit log rate analysis category requests to reduce `msearch` from
1000 to 100 b4b5cea

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment