[ML] Package @kbn/ml-anomaly-utils (#155697)

Creates Package `@kbn/ml-anomaly-utils`.

- This moves some of the utility functions, constants and types related
to Anomaly Detection we previously exposed from the `ml` plugin itself
to a package `@kbn/ml-anomaly-utils`, resulting in ~5.9KB reduction of
the plugin's page load bundle size.
- To reduce increases in async bundle size for consuming plugins the
utils have been refactored into individual files to allow deep imports
and get some optimization through that. Some previously duplicated code
in consuming plugins has been deleted and replaced with deep imports of
the corresponding original code in the package.
- Types have been prefixed with `Ml`.
- Constants have been prefixed with `ML_`.

Created package via `node scripts/generate package @kbn/ml-anomaly-utils
--web --dir ./x-pack/packages/ml/anomaly_utils`.

.github/CODEOWNERS

@@ -459,6 +459,7 @@ x-pack/examples/third_party_maps_source_example @elastic/kibana-gis
 src/plugins/maps_ems @elastic/kibana-gis
 x-pack/plugins/maps @elastic/kibana-gis
 x-pack/packages/ml/agg_utils @elastic/ml-ui
+x-pack/packages/ml/anomaly_utils @elastic/ml-ui
 x-pack/packages/ml/date_picker @elastic/ml-ui
 x-pack/packages/ml/error_utils @elastic/ml-ui
 x-pack/packages/ml/is_defined @elastic/ml-ui

package.json

@@ -474,6 +474,7 @@
  "@kbn/maps-ems-plugin": "link:src/plugins/maps_ems",
  "@kbn/maps-plugin": "link:x-pack/plugins/maps",
  "@kbn/ml-agg-utils": "link:x-pack/packages/ml/agg_utils",
+ "@kbn/ml-anomaly-utils": "link:x-pack/packages/ml/anomaly_utils",
  "@kbn/ml-date-picker": "link:x-pack/packages/ml/date_picker",
  "@kbn/ml-error-utils": "link:x-pack/packages/ml/error_utils",
  "@kbn/ml-is-defined": "link:x-pack/packages/ml/is_defined",

tsconfig.base.json

@@ -912,6 +912,8 @@
  "@kbn/maps-plugin/*": ["x-pack/plugins/maps/*"],
  "@kbn/ml-agg-utils": ["x-pack/packages/ml/agg_utils"],
  "@kbn/ml-agg-utils/*": ["x-pack/packages/ml/agg_utils/*"],
+ "@kbn/ml-anomaly-utils": ["x-pack/packages/ml/anomaly_utils"],
+ "@kbn/ml-anomaly-utils/*": ["x-pack/packages/ml/anomaly_utils/*"],
  "@kbn/ml-date-picker": ["x-pack/packages/ml/date_picker"],
  "@kbn/ml-date-picker/*": ["x-pack/packages/ml/date_picker/*"],
  "@kbn/ml-error-utils": ["x-pack/packages/ml/error_utils"],

x-pack/.i18nrc.json

@@ -2,6 +2,7 @@
  "prefix": "xpack",
  "paths": {
  "xpack.actions": "plugins/actions",
+ "xpack.aiops": ["packages/ml/aiops_components", "plugins/aiops"],
  "xpack.alerting": "plugins/alerting",
  "xpack.eventLog": "plugins/event_log",
  "xpack.stackAlerts": "plugins/stack_alerts",
@@ -45,8 +46,12 @@
  "xpack.logstash": ["plugins/logstash"],
  "xpack.main": "legacy/plugins/xpack_main",
  "xpack.maps": ["plugins/maps"],
- "xpack.aiops": ["packages/ml/aiops_components", "plugins/aiops"],
- "xpack.ml": ["packages/ml/date_picker", "packages/ml/trained_models_utils", "plugins/ml"],
+ "xpack.ml": [
+ "packages/ml/anomaly_utils",
+ "packages/ml/date_picker",
+ "packages/ml/trained_models_utils",
+ "plugins/ml"
+ ],
  "xpack.monitoring": ["plugins/monitoring"],
  "xpack.observability": "plugins/observability",
  "xpack.observabilityShared": "plugins/observability_shared",

x-pack/packages/ml/anomaly_utils/README.md

@@ -0,0 +1,3 @@
+# @kbn/ml-anomaly-utils
+
+Utility functions, constants and types for Machine Learning's Anomaly Detection.

x-pack/packages/ml/anomaly_utils/anomaly_severity.ts

@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * Labels displayed in the ML UI to indicate the severity of the anomaly according
+ * to the normalized anomaly score.
+ */
+export enum ML_ANOMALY_SEVERITY {
+ /**
+ * Anomalies are displayed as critical severity when the score is greater than or equal to 75.
+ */
+ CRITICAL = 'critical',
+
+ /**
+ * Anomalies are displayed as major severity when the score is greater than or equal to 50 and less than 75.
+ */
+ MAJOR = 'major',
+
+ /**
+ * Anomalies are displayed as minor severity when the score is greater than or equal to 25 and less than 50.
+ */
+ MINOR = 'minor',
+
+ /**
+ * Anomalies are displayed as warning severity when the score is greater than or equal to 3 and less than 25.
+ * Note in some parts of the UI, warning severity is used when the score is greater than or equal to 0.
+ */
+ WARNING = 'warning',
+
+ /**
+ * Anomalies are displayed as low severity in some parts of the ML UI when the score is greater than or equal to 0 and less than 3.
+ */
+ LOW = 'low',
+
+ /**
+ * Anomalies are displayed as unknown severity if the anomaly score is not known.
+ */
+ UNKNOWN = 'unknown',
+}
+
+/**
+ * Interface for severity types to be used in ML_ANOMALY_SEVERITY_TYPES.
+ *
+ * @export
+ * @interface MlSeverityType
+ * @typedef {MlSeverityType}
+ */
+export interface MlSeverityType {
+ /**
+ * One of ML_ANOMALY_SEVERITY
+ * @type {ML_ANOMALY_SEVERITY}
+ */
+ id: ML_ANOMALY_SEVERITY;
+ /**
+ * Translated ML_ANOMALY_SEVERITY
+ * @type {string}
+ */
+ label: string;
+}

x-pack/packages/ml/anomaly_utils/anomaly_severity_types.ts

@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { type MlSeverityType, ML_ANOMALY_SEVERITY } from './anomaly_severity';
+
+export const ML_ANOMALY_SEVERITY_TYPES: Record<ML_ANOMALY_SEVERITY, MlSeverityType> = {
+ critical: {
+ id: ML_ANOMALY_SEVERITY.CRITICAL,
+ label: i18n.translate('xpack.ml.anomalyUtils.severity.criticalLabel', {
+ defaultMessage: 'critical',
+ }),
+ },
+ major: {
+ id: ML_ANOMALY_SEVERITY.MAJOR,
+ label: i18n.translate('xpack.ml.anomalyUtils.severity.majorLabel', {
+ defaultMessage: 'major',
+ }),
+ },
+ minor: {
+ id: ML_ANOMALY_SEVERITY.MINOR,
+ label: i18n.translate('xpack.ml.anomalyUtils.severity.minorLabel', {
+ defaultMessage: 'minor',
+ }),
+ },
+ warning: {
+ id: ML_ANOMALY_SEVERITY.WARNING,
+ label: i18n.translate('xpack.ml.anomalyUtils.severity.warningLabel', {
+ defaultMessage: 'warning',
+ }),
+ },
+ unknown: {
+ id: ML_ANOMALY_SEVERITY.UNKNOWN,
+ label: i18n.translate('xpack.ml.anomalyUtils.severity.unknownLabel', {
+ defaultMessage: 'unknown',
+ }),
+ },
+ low: {
+ id: ML_ANOMALY_SEVERITY.LOW,
+ label: i18n.translate('xpack.ml.anomalyUtils.severityWithLow.lowLabel', {
+ defaultMessage: 'low',
+ }),
+ },
+};

x-pack/packages/ml/anomaly_utils/anomaly_threshold.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * Anomaly score numeric thresholds to indicate the severity of the anomaly.
+ */
+export enum ML_ANOMALY_THRESHOLD {
+ /**
+ * Threshold at which anomalies are labelled in the UI as critical.
+ */
+ CRITICAL = 75,
+
+ /**
+ * Threshold at which anomalies are labelled in the UI as major.
+ */
+ MAJOR = 50,
+
+ /**
+ * Threshold at which anomalies are labelled in the UI as minor.
+ */
+ MINOR = 25,
+
+ /**
+ * Threshold at which anomalies are labelled in the UI as warning.
+ */
+ WARNING = 3,
+
+ /**
+ * Threshold at which anomalies are labelled in the UI as low.
+ */
+ LOW = 0,
+}

x-pack/plugins/ml/common/util/anomaly_utils.test.ts → x-pack/packages/ml/anomaly_utils/anomaly_utils.test.ts

@@ -5,24 +5,22 @@
  * 2.0.
  */
 
-import { AnomalyRecordDoc } from '../types/anomalies';
+import type { MlAnomalyRecordDoc } from './types';
 
 import {
  aggregationTypeTransform,
  getEntityFieldList,
  getEntityFieldName,
  getEntityFieldValue,
- getSeverity,
  getSeverityWithLow,
- getSeverityColor,
  isRuleSupported,
  showActualForFunction,
  showTypicalForFunction,
  isMultiBucketAnomaly,
 } from './anomaly_utils';
 
 describe('ML - anomaly utils', () => {
- const partitionEntityRecord: AnomalyRecordDoc = {
+ const partitionEntityRecord: MlAnomalyRecordDoc = {
  job_id: 'farequote',
  result_type: 'record',
  probability: 0.012818,
@@ -39,7 +37,7 @@ describe('ML - anomaly utils', () => {
  field_name: 'responsetime',
  };
 
- const byEntityRecord: AnomalyRecordDoc = {
+ const byEntityRecord: MlAnomalyRecordDoc = {
  job_id: 'farequote',
  result_type: 'record',
  probability: 0.012818,
@@ -56,7 +54,7 @@ describe('ML - anomaly utils', () => {
  field_name: 'responsetime',
  };
 
- const overEntityRecord: AnomalyRecordDoc = {
+ const overEntityRecord: MlAnomalyRecordDoc = {
  job_id: 'gallery',
  result_type: 'record',
  probability: 2.81806e-9,
@@ -74,7 +72,7 @@ describe('ML - anomaly utils', () => {
  over_field_value: '37.157.32.164',
  };
 
- const noEntityRecord: AnomalyRecordDoc = {
+ const noEntityRecord: MlAnomalyRecordDoc = {
  job_id: 'farequote_no_by',
  result_type: 'record',
  probability: 0.0191711,
@@ -89,7 +87,7 @@ describe('ML - anomaly utils', () => {
  field_name: 'responsetime',
  };
 
- const metricNoEntityRecord: AnomalyRecordDoc = {
+ const metricNoEntityRecord: MlAnomalyRecordDoc = {
  job_id: 'farequote_metric',
  result_type: 'record',
  probability: 0.030133495093182184,
@@ -113,7 +111,7 @@ describe('ML - anomaly utils', () => {
  airline: ['NKS'],
  };
 
- const rareEntityRecord: AnomalyRecordDoc = {
+ const rareEntityRecord: MlAnomalyRecordDoc = {
  job_id: 'gallery',
  result_type: 'record',
  probability: 0.02277014211908481,
@@ -166,34 +164,6 @@ describe('ML - anomaly utils', () => {
  status: ['206'],
  };
 
- describe('getSeverity', () => {
- test('returns warning for 0 <= score < 25', () => {
- expect(getSeverity(0).id).toBe('warning');
- expect(getSeverity(0.001).id).toBe('warning');
- expect(getSeverity(24.99).id).toBe('warning');
- });
-
- test('returns minor for 25 <= score < 50', () => {
- expect(getSeverity(25).id).toBe('minor');
- expect(getSeverity(49.99).id).toBe('minor');
- });
-
- test('returns minor for 50 <= score < 75', () => {
- expect(getSeverity(50).id).toBe('major');
- expect(getSeverity(74.99).id).toBe('major');
- });
-
- test('returns critical for score >= 75', () => {
- expect(getSeverity(75).id).toBe('critical');
- expect(getSeverity(100).id).toBe('critical');
- expect(getSeverity(1000).id).toBe('critical');
- });
-
- test('returns unknown for scores less than 0', () => {
- expect(getSeverity(-10).id).toBe('unknown');
- });
- });
-
  describe('getSeverityWithLow', () => {
  test('returns low for 0 <= score < 3', () => {
  expect(getSeverityWithLow(0).id).toBe('low');
@@ -227,41 +197,8 @@ describe('ML - anomaly utils', () => {
  });
  });
 
- describe('getSeverityColor', () => {
- test('returns correct hex code for low for 0 <= score < 3', () => {
- expect(getSeverityColor(0)).toBe('#d2e9f7');
- expect(getSeverityColor(0.001)).toBe('#d2e9f7');
- expect(getSeverityColor(2.99)).toBe('#d2e9f7');
- });
-
- test('returns correct hex code for warning for 3 <= score < 25', () => {
- expect(getSeverityColor(3)).toBe('#8bc8fb');
- expect(getSeverityColor(24.99)).toBe('#8bc8fb');
- });
-
- test('returns correct hex code for minor for 25 <= score < 50', () => {
- expect(getSeverityColor(25)).toBe('#fdec25');
- expect(getSeverityColor(49.99)).toBe('#fdec25');
- });
-
- test('returns correct hex code for major for 50 <= score < 75', () => {
- expect(getSeverityColor(50)).toBe('#fba740');
- expect(getSeverityColor(74.99)).toBe('#fba740');
- });
-
- test('returns correct hex code for critical for score >= 75', () => {
- expect(getSeverityColor(75)).toBe('#fe5050');
- expect(getSeverityColor(100)).toBe('#fe5050');
- expect(getSeverityColor(1000)).toBe('#fe5050');
- });
-
- test('returns correct hex code for unknown for scores less than 0', () => {
- expect(getSeverityColor(-10)).toBe('#ffffff');
- });
- });
-
  describe('isMultiBucketAnomaly', () => {
- const singleBucketAnomaly: AnomalyRecordDoc = {
+ const singleBucketAnomaly: MlAnomalyRecordDoc = {
  job_id: 'farequote_sb',
  result_type: 'record',
  probability: 0.0191711,
@@ -283,7 +220,7 @@ describe('ML - anomaly utils', () => {
  },
  };
 
- const multiBucketAnomaly: AnomalyRecordDoc = {
+ const multiBucketAnomaly: MlAnomalyRecordDoc = {
  job_id: 'farequote_mb',
  result_type: 'record',
  probability: 0.0191711,
@@ -305,7 +242,7 @@ describe('ML - anomaly utils', () => {
  },
  };
 
- const multiBucketAnomaly2: AnomalyRecordDoc = {
+ const multiBucketAnomaly2: MlAnomalyRecordDoc = {
  job_id: 'farequote_mb2',
  result_type: 'record',
  probability: 0.0191711,
@@ -326,7 +263,7 @@ describe('ML - anomaly utils', () => {
  },
  };
 
- const noASEAnomaly: AnomalyRecordDoc = {
+ const noASEAnomaly: MlAnomalyRecordDoc = {
  job_id: 'farequote_ase',
  result_type: 'record',
  probability: 0.0191711,
@@ -341,7 +278,7 @@ describe('ML - anomaly utils', () => {
  field_name: 'responsetime',
  };
 
- const noMBIAnomaly: AnomalyRecordDoc = {
+ const noMBIAnomaly: MlAnomalyRecordDoc = {
  job_id: 'farequote_sbi',
  result_type: 'record',
  probability: 0.0191711,
@@ -362,7 +299,7 @@ describe('ML - anomaly utils', () => {
  },
  };
 
- const singleBucketAnomaly2: AnomalyRecordDoc = {
+ const singleBucketAnomaly2: MlAnomalyRecordDoc = {
  job_id: 'farequote_sb2',
  result_type: 'record',
  probability: 0.0191711,