Add max bucket anomaly score

elastic · Oct 8, 2019 · 8d887a8 · 8d887a8
1 parent 4119a05
commit 8d887a8
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 1 deletion.
diff --git a/x-pack/legacy/plugins/infra/common/http_api/log_analysis/results/log_entry_rate.ts b/x-pack/legacy/plugins/infra/common/http_api/log_analysis/results/log_entry_rate.ts
@@ -41,6 +41,7 @@ export const logEntryRatePartitionRT = rt.type({
   analysisBucketCount: rt.number,
   anomalies: rt.array(logEntryRateAnomaly),
   averageActualLogEntryRate: rt.number,
+  maximumAnomalyScore: rt.number,
   partitionId: rt.string,
 });
 

diff --git a/x-pack/legacy/plugins/infra/server/lib/log_analysis/log_analysis.ts b/x-pack/legacy/plugins/infra/server/lib/log_analysis/log_analysis.ts
@@ -91,6 +91,7 @@ export class InfraLogAnalysis {
             typicalLogEntryRate: number;
           }>;
           averageActualLogEntryRate: number;
+          maximumAnomalyScore: number;
           partitionId: string;
         }>;
         startTime: number;
@@ -108,7 +109,10 @@ export class InfraLogAnalysis {
             typicalLogEntryRate: record.typical[0],
           })
         ),
-        averageActualLogEntryRate: timestampPartitionBucket.filter_model_plot.average_actual.value || 0,
+        averageActualLogEntryRate:
+          timestampPartitionBucket.filter_model_plot.average_actual.value || 0,
+        maximumAnomalyScore:
+          timestampPartitionBucket.filter_records.maximum_record_score.value || 0,
         partitionId: timestampPartitionBucket.key.partition,
       };
       if (

diff --git a/x-pack/legacy/plugins/infra/server/lib/log_analysis/queries/log_entry_rate.ts b/x-pack/legacy/plugins/infra/server/lib/log_analysis/queries/log_entry_rate.ts
@@ -91,6 +91,11 @@ export const createLogEntryRateQuery = (
               },
             },
             aggs: {
+              maximum_record_score: {
+                max: {
+                  field: 'record_score',
+                },
+              },
               top_hits_record: {
                 top_hits: {
                   _source: Object.keys(logRateMlRecordRT.props),
@@ -138,6 +143,7 @@ export const logRateModelPlotBucketRT = rt.type({
   key: compositeTimestampPartitionKeyRT,
   filter_records: rt.type({
     doc_count: rt.number,
+    maximum_record_score: metricAggregationRT,
     top_hits_record: rt.type({
       hits: rt.type({
         hits: rt.array(