[Logs UI] Create API route to access log rate analysis results

[weltenwort]

Summary

This route grants access to the log rate anomaly detection results within a given time interval.

Acceptance criteria

Request

Path: POST /api/infra/log_analysis/results/log_entry_rate

interface GetLogEntryRateRequest {
  data: {
    // length of a bucket in milliseconds
    bucketDuration: number;
    // the id of the source this job belongs to
    sourceId: string;
    timeRange: {
      // start of the requested time interval as an epoch timestamp in milliseconds
      startTime: number;
      // end of the requested time interval as an epoch timestamp in milliseconds
      endTime: number;
    };
  };
}

Responses

interface GetLogEntryRateSuccessResponse {
  data: {
    // length of a bucket in milliseconds
    bucketDuration: number;
    // a sequence of non-overlapping time buckets in ascending order
    histogramBuckets: Array<{
      // a set of anomalies found within this bucket
      anomalies: Array<{
        // the number of log entries actually found
        actualLogEntryRate: number;
        // a relative measure of the anomalousness
        anomalyScore: number;
        // duration of the anomaly in milliseconds
	  		duration: number;
        // start of the anomaly as an epoch timestamp in milliseconds
        startTime: number;
        // the number of log entries typically found according to the model
        typicalLogEntryRate: number;
      }>
      // length of the bucket in milliseconds
			duration: number;
      // the statistical characteristics of the log entry rate in the bucket
      logEntryRateStats: { avg, count, max, min, sum };
      // the statistical characteristics of the model's lower bound for the log entry rate in this bucket
      modelLowerBoundStats: { avg, count, max, min, sum};
      // the statistical characteristics of the model's upper bound for the log entry rate in this bucket
      modelUpperBoundStats: { avg, count, max, min, sum};
      // start of the bucket as an epoch timestamp in milliseconds
      startTime: number;
    }>;
  };
}

Failure conditions:

• no log entry rate job configured for this source: Not Found
• insufficient permissions: Forbidden

[elasticmachine]

Pinging @elastic/infra-logs-ui