[Logs UI] [Test scenario] Categories page

[Kerry350]

Summary

This test scenario covers the functionality of the categories page. The main changes in 7.12 include:

• Added server side sorting abilities: [Logs UI] Add sorting capabilities to categories page #88051
• Various type changes (as part of [Logs UI] Display category in anomalies table #88677)
• Switched to the ML useMlHref hook for generating ML links: [Logs UI] Use useMlHref hook for ML links #90935

You may use a BC running locally or on cloud for these tests. You'll need to enable the categorisation job, and allow it to gather some category results.

Test cases

• All interactive elements of the results screen can be reached via the keyboard.
• There is an "Analyze in ML" button that correctly navigates to the Anomaly Explorer page of the ML solution, prefiltered to the correct Job ID.
• There is a "Recreate ML job" button that opens the setup flyout.

Categories table

• The categories table spans the full page width and has sensible initial column widths without column heading truncations.
• The categories table is sorted by the maximum anomaly score in descending order.
• The trend sparkline and relative message count change are rendered correctly.
• Overly long category patterns are truncated with an ellipsis with a tooltip.
• The categories table shows correct results.
• Log message without a value in the event.dataset field are treated as belonging to the unknown dataset.
• In the row of each result, to the right of the maximum anomaly score column, there is a link to the machine learning single metric viewer. The link can be opened in the same tab or in a new tab. The single metric viewer is then filtered to the time range, category and dataset appropriate for the row and date filter.
• The table can be sorted by maximum anomaly score and message count, both ascending and descending.

Category Examples

• Each row in the categories table can be expanded via the arrow icon in the rightmost column.
• While loading after expansion, placeholders for the example log lines are shown
• When the underlying log messages still exist in Elasticsearch, a sample of up to five messages for each category is displayed.
• When the underlying log messages don't exist anymore in Elasticsearch, an informative message and a reload button are shown in the expanded row.
• When the fetching of the examples failed, an error message and a retry button are shown in the expanded row.
• The examples are shown with timestamp, message and dataset columns.
• The message column lines up with the pattern column of the parent table.
• The dataset column lines up with the dataset column of the parent table.

Filtering

• The date range picker limits the categories displayed in the table to those that occur in the date range.
• The dataset filter above the table limits the categories displayed to those that occur in the selected datasets.
• The dataset filter also limits the examples loaded for multi-dataset categories to those selected in the filter dropdown.
• Activating the auto-refresh in the date range picker causes the table to refresh with the given frequency.

Privileges

You can create a logs read only role by hitting: curl -X PUT "<KIBANA_URL>/api/security/role/logs_read_only" --user user:password -H 'Content-Type: application/json' -H 'kbn-xsrf: some-string with:

{
  "elasticsearch":{
     "cluster":[],
     "indices":[
        {
           "names": ["logs-*", "filebeat-*", "kibana_sample_data_logs*"],
           "privileges":["read", "view_index_metadata"]
        }
    ]
  },
  "kibana":[
     {
        "base": [],
        "feature": {
          "logs": ["read"],
          "ml": ["read"]
        },
        "spaces": ["*"]
     }
  ]
}

assign this role to a user for the following tests.

With a read only user:

• It should not be possible to create jobs when first landing on the page with no jobs configured.
• It should not be possible to recreate jobs from the "Recreate ML job" flyout.

[elasticmachine]

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

[neptunian]

• Same as what I mentioned on the anomalies page. Cannot access via keyboard the dropdown contents and menu

• If you make the browser window more narrow, but not as narrow as a phone, such as an ipad in portrait mode, the content in Category column doesn't wrap properly. I don't see the column name "Category"

• I don't see a tooltip when I hover over this truncated category pattern:

• Minor future improvement suggestion: The trend graphic is quite offset in the column from the title when there isn't much history. Kind of confused me, but not sure there's any solution worth implementing. Maybe right align the column name?

[Kerry350]

#93594 is filed for the log line accessibility. And #93914 is filed for the other minor improvements. There aren't any regressions or major blockers for 7.12 though, so this should be okay to close now.

I don't see a tooltip when I hover over this truncated category pattern

Would you mind double checking this one? "Tooltip" might be misleading here. It's not an EUITooltip but rather a title attribute on the very last span (the ellipsis). So you might need to hover a little longer than an EUITooltip.

[simianhacker]

Looks like the tooltip is working correctly: