Skip to content

[ML] Fixes counter metric fields missing in Anomaly detection dropdown#248187

Merged
qn895 merged 3 commits intoelastic:mainfrom
qn895:fix-ml-counter-field
Jan 13, 2026
Merged

[ML] Fixes counter metric fields missing in Anomaly detection dropdown#248187
qn895 merged 3 commits intoelastic:mainfrom
qn895:fix-ml-counter-field

Conversation

@qn895
Copy link
Copy Markdown
Member

@qn895 qn895 commented Jan 7, 2026 •
edited by kibanamachine
Loading

Summary

Previously, we removed counter metric fields from the Anomaly detection dropdown because it wasn't supported. Now, it is supported. This PR re-adds support for this field type.

Screenshot 2026-01-07 at 14 24 49 Screenshot 2026-01-07 at 14 23 44

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

  • Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
  • Documentation was added for features that require explanation or tutorials
  • Unit or functional tests were updated or added to match the most common scenarios
  • If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
  • This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • Flaky Test Runner was used on any tests changed
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.
@qn895 qn895 self-assigned this Jan 7, 2026
@qn895 qn895 requested a review from a team as a code owner January 7, 2026 20:25
@qn895 qn895 added bug Fixes for quality problems that affect the customer experience release_note:fix :ml Feature:Anomaly Detection ML anomaly detection v9.3.0 v9.2.4 labels Jan 7, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 7, 2026

Pinging @elastic/ml-ui (:ml)
@qn895 qn895 added the backport:version Backport to applied version labels label Jan 7, 2026
@qn895 qn895 requested a review from jgowdyelastic January 7, 2026 20:36
jgowdyelastic
jgowdyelastic reviewed Jan 8, 2026
View reviewed changes
Comment thread x-pack/platform/plugins/shared/ml/server/models/job_service/new_job_caps/field_service.ts
// support any aggregations and so it cannot be used as a field_name in a detector.
private isFieldAggregatable(field: estypes.FieldCapsFieldCapability) {
return field.aggregatable && this.isCounterField(field) === false;
return field.aggregatable;
Copy link
Copy Markdown
Member

@jgowdyelastic jgowdyelastic Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might as well just remove this function.
It was originally added in #153021 to replace the field.aggregatable check, but we can just revert that change and go back to checking field.aggregatable directly.
Copy link
Copy Markdown
Member Author

@qn895 qn895 Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think leaving as is for now is ok, as there might be a need in the future to update this logic when there's another unsupported field type anyway.
jgowdyelastic
jgowdyelastic approved these changes Jan 9, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@jgowdyelastic jgowdyelastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested, LGTM
@qn895
Copy link
Copy Markdown
Member Author

qn895 commented Jan 12, 2026

@elasticmachine merge upstream
@qn895 qn895 enabled auto-merge (squash) January 12, 2026 18:55
@qn895
Copy link
Copy Markdown
Member Author

qn895 commented Jan 13, 2026

@elasticmachine merge upstream
@qn895 qn895 merged commit cb89bf6 into elastic:main Jan 13, 2026
14 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 13, 2026

Starting backport for target branches: 9.2, 9.3

https://github.com/elastic/kibana/actions/runs/20970638157
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 13, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] Scout: [ security / security_solution ] plugin / enables risk score followed by the store
  • [job] [logs] Scout: [ security / security_solution ] plugin / serverless-security - Entity analytics dashboard page - enables risk score followed by the store

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
ml 5.6MB 5.6MB -54.0B

History

cc @qn895
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jan 13, 2026
@qn895 @elasticmachine
[ML] Fix counter fields missing in Anomaly detection dropdown (elasti…
1f6c1ce 
…c#248187)

## Summary

Previously, we [removed](elastic#153021)
`counter` metric fields from the Anomaly detection dropdown because it
wasn't supported. Now, it is supported. This PR re-adds support for this
field type.

<img width="1717" height="917" alt="Screenshot 2026-01-07 at 14 24 49"
src="https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1"
/>
<img width="1717" height="917" alt="Screenshot 2026-01-07 at 14 23 44"
src="https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63"
/>

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit cb89bf6)
@kibanamachine kibanamachine mentioned this pull request Jan 13, 2026
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jan 13, 2026
@qn895 @elasticmachine
[ML] Fix counter fields missing in Anomaly detection dropdown (elasti…
e91b208 
…c#248187)

## Summary

Previously, we [removed](elastic#153021)
`counter` metric fields from the Anomaly detection dropdown because it
wasn't supported. Now, it is supported. This PR re-adds support for this
field type.

<img width="1717" height="917" alt="Screenshot 2026-01-07 at 14 24 49"
src="https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1"
/>
<img width="1717" height="917" alt="Screenshot 2026-01-07 at 14 23 44"
src="https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63"
/>

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit cb89bf6)
@kibanamachine kibanamachine mentioned this pull request Jan 13, 2026
Merged
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 13, 2026

💚 All backports created successfully

Status Branch Result
✅ 9.2
✅ 9.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation
kibanamachine added a commit that referenced this pull request Jan 13, 2026
@kibanamachine @qn895 @elasticmachine
[9.2] [ML] Fix counter fields missing in Anomaly detection dropdown (#…
9d6d2ce 
…248187) (#248914)

# Backport

This will backport the following commits from `main` to `9.2`:
- [[ML] Fix counter fields missing in Anomaly detection dropdown
(#248187)](#248187)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Quynh Nguyen
(Quinn)","email":"43350163+qn895@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-01-13T19:58:22Z","message":"[ML]
Fix counter fields missing in Anomaly detection dropdown (#248187)\n\n##
Summary\n\nPreviously, we
[removed](https://github.com/elastic/kibana/pull/153021)\n`counter`
metric fields from the Anomaly detection dropdown because it\nwasn't
supported. Now, it is supported. This PR re-adds support for this\nfield
type.\n\n<img width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07
at 14 24
49\"\nsrc=\"https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1\"\n/>\n<img
width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07 at 14 23
44\"\nsrc=\"https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63\"\n/>\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nDoes this
PR introduce any risks? For example, consider risks like hard\nto test
bugs, performance regression, potential of data loss.\n\nDescribe the
risk, its severity, and mitigation for each identified\nrisk. Invite
stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See
some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"cb89bf6f9d72da9f9bab22be11c066a1e1cc66aa","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix",":ml","Feature:Anomaly
Detection","backport:version","v9.3.0","v9.4.0","v9.2.4"],"title":"[ML]
Fix counter fields missing in Anomaly detection
dropdown","number":248187,"url":"https://github.com/elastic/kibana/pull/248187","mergeCommit":{"message":"[ML]
Fix counter fields missing in Anomaly detection dropdown (#248187)\n\n##
Summary\n\nPreviously, we
[removed](https://github.com/elastic/kibana/pull/153021)\n`counter`
metric fields from the Anomaly detection dropdown because it\nwasn't
supported. Now, it is supported. This PR re-adds support for this\nfield
type.\n\n<img width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07
at 14 24
49\"\nsrc=\"https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1\"\n/>\n<img
width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07 at 14 23
44\"\nsrc=\"https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63\"\n/>\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nDoes this
PR introduce any risks? For example, consider risks like hard\nto test
bugs, performance regression, potential of data loss.\n\nDescribe the
risk, its severity, and mitigation for each identified\nrisk. Invite
stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See
some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"cb89bf6f9d72da9f9bab22be11c066a1e1cc66aa"}},"sourceBranch":"main","suggestedTargetBranches":["9.3","9.2"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/248187","number":248187,"mergeCommit":{"message":"[ML]
Fix counter fields missing in Anomaly detection dropdown (#248187)\n\n##
Summary\n\nPreviously, we
[removed](https://github.com/elastic/kibana/pull/153021)\n`counter`
metric fields from the Anomaly detection dropdown because it\nwasn't
supported. Now, it is supported. This PR re-adds support for this\nfield
type.\n\n<img width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07
at 14 24
49\"\nsrc=\"https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1\"\n/>\n<img
width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07 at 14 23
44\"\nsrc=\"https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63\"\n/>\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nDoes this
PR introduce any risks? For example, consider risks like hard\nto test
bugs, performance regression, potential of data loss.\n\nDescribe the
risk, its severity, and mitigation for each identified\nrisk. Invite
stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See
some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"cb89bf6f9d72da9f9bab22be11c066a1e1cc66aa"}},{"branch":"9.2","label":"v9.2.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Quynh Nguyen (Quinn) <43350163+qn895@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
@kibanamachine kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Jan 14, 2026
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 14, 2026

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @qn895
kibanamachine added a commit that referenced this pull request Jan 14, 2026
@kibanamachine @qn895 @elasticmachine
[9.3] [ML] Fix counter fields missing in Anomaly detection dropdown (#…
023a942 
…248187) (#248915)

# Backport

This will backport the following commits from `main` to `9.3`:
- [[ML] Fix counter fields missing in Anomaly detection dropdown
(#248187)](#248187)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Quynh Nguyen
(Quinn)","email":"43350163+qn895@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-01-13T19:58:22Z","message":"[ML]
Fix counter fields missing in Anomaly detection dropdown (#248187)\n\n##
Summary\n\nPreviously, we
[removed](https://github.com/elastic/kibana/pull/153021)\n`counter`
metric fields from the Anomaly detection dropdown because it\nwasn't
supported. Now, it is supported. This PR re-adds support for this\nfield
type.\n\n<img width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07
at 14 24
49\"\nsrc=\"https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1\"\n/>\n<img
width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07 at 14 23
44\"\nsrc=\"https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63\"\n/>\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nDoes this
PR introduce any risks? For example, consider risks like hard\nto test
bugs, performance regression, potential of data loss.\n\nDescribe the
risk, its severity, and mitigation for each identified\nrisk. Invite
stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See
some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"cb89bf6f9d72da9f9bab22be11c066a1e1cc66aa","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix",":ml","Feature:Anomaly
Detection","backport:version","v9.3.0","v9.4.0","v9.2.4"],"title":"[ML]
Fix counter fields missing in Anomaly detection
dropdown","number":248187,"url":"https://github.com/elastic/kibana/pull/248187","mergeCommit":{"message":"[ML]
Fix counter fields missing in Anomaly detection dropdown (#248187)\n\n##
Summary\n\nPreviously, we
[removed](https://github.com/elastic/kibana/pull/153021)\n`counter`
metric fields from the Anomaly detection dropdown because it\nwasn't
supported. Now, it is supported. This PR re-adds support for this\nfield
type.\n\n<img width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07
at 14 24
49\"\nsrc=\"https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1\"\n/>\n<img
width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07 at 14 23
44\"\nsrc=\"https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63\"\n/>\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nDoes this
PR introduce any risks? For example, consider risks like hard\nto test
bugs, performance regression, potential of data loss.\n\nDescribe the
risk, its severity, and mitigation for each identified\nrisk. Invite
stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See
some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"cb89bf6f9d72da9f9bab22be11c066a1e1cc66aa"}},"sourceBranch":"main","suggestedTargetBranches":["9.3","9.2"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/248187","number":248187,"mergeCommit":{"message":"[ML]
Fix counter fields missing in Anomaly detection dropdown (#248187)\n\n##
Summary\n\nPreviously, we
[removed](https://github.com/elastic/kibana/pull/153021)\n`counter`
metric fields from the Anomaly detection dropdown because it\nwasn't
supported. Now, it is supported. This PR re-adds support for this\nfield
type.\n\n<img width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07
at 14 24
49\"\nsrc=\"https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1\"\n/>\n<img
width=\"1717\" height=\"917\" alt=\"Screenshot 2026-01-07 at 14 23
44\"\nsrc=\"https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63\"\n/>\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [ ] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[ ] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nDoes this
PR introduce any risks? For example, consider risks like hard\nto test
bugs, performance regression, potential of data loss.\n\nDescribe the
risk, its severity, and mitigation for each identified\nrisk. Invite
stakeholders and evaluate how to proceed before merging.\n\n- [ ] [See
some
risk\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)\n-
[ ] ...\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"cb89bf6f9d72da9f9bab22be11c066a1e1cc66aa"}},{"branch":"9.2","label":"v9.2.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Quynh Nguyen (Quinn) <43350163+qn895@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
@kibanamachine kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Jan 14, 2026
smith pushed a commit to smith/kibana that referenced this pull request Jan 16, 2026
@qn895 @elasticmachine @smith
[ML] Fix counter fields missing in Anomaly detection dropdown (elasti…
4c031de 
…c#248187)

## Summary

Previously, we [removed](elastic#153021)
`counter` metric fields from the Anomaly detection dropdown because it
wasn't supported. Now, it is supported. This PR re-adds support for this
field type.

<img width="1717" height="917" alt="Screenshot 2026-01-07 at 14 24 49"
src="https://github.com/user-attachments/assets/771fed3b-2c1b-4dc5-adf2-ce4fa43a0ab1"
/>
<img width="1717" height="917" alt="Screenshot 2026-01-07 at 14 23 44"
src="https://github.com/user-attachments/assets/ff82f2ca-fb65-4e78-9e01-a85dc03b6d63"
/>


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
@peteharverson peteharverson changed the title [ML] Fix counter fields missing in Anomaly detection dropdown Jan 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels bug Fixes for quality problems that affect the customer experience Feature:Anomaly Detection ML anomaly detection :ml release_note:fix v9.2.4 v9.3.0 v9.4.0

4 participants

@qn895 @elasticmachine @kibanamachine @jgowdyelastic