[ML] Use anomaly score explanation for chart tooltip multi-bucket impact

x-pack/plugins/ml/common/types/results.ts

@@ -99,6 +99,7 @@ export interface ChartPoint {
   anomalyScore?: number;
   actual?: number[];
   multiBucketImpact?: number;
+  isMultiBucketAnomaly?: boolean;
   typical?: number[];
   value?: number | null;
   entity?: string;

x-pack/plugins/ml/common/util/anomaly_utils.test.ts

@@ -12,13 +12,13 @@ import {
   getEntityFieldList,
   getEntityFieldName,
   getEntityFieldValue,
-  getMultiBucketImpactLabel,
   getSeverity,
   getSeverityWithLow,
   getSeverityColor,
   isRuleSupported,
   showActualForFunction,
   showTypicalForFunction,
+  isMultiBucketAnomaly,
 } from './anomaly_utils';
 
 describe('ML - anomaly utils', () => {
@@ -260,30 +260,152 @@ describe('ML - anomaly utils', () => {
     });
   });
 
-  describe('getMultiBucketImpactLabel', () => {
-    test('returns high for 3 <= score <= 5', () => {
-      expect(getMultiBucketImpactLabel(3)).toBe('high');
-      expect(getMultiBucketImpactLabel(5)).toBe('high');
+  describe('isMultiBucketAnomaly', () => {
+    const singleBucketAnomaly: AnomalyRecordDoc = {
+      job_id: 'farequote_sb',
+      result_type: 'record',
+      probability: 0.0191711,
+      record_score: 4.38431,
+      initial_record_score: 19.654,
+      bucket_span: 300,
+      detector_index: 0,
+      is_interim: false,
+      timestamp: 1454890500000,
+      function: 'mean',
+      function_description: 'mean',
+      field_name: 'responsetime',
+      anomaly_score_explanation: {
+        single_bucket_impact: 65,
+        multi_bucket_impact: 14,
+        lower_confidence_bound: 94.79879269994528,
+        typical_value: 100.26620234643129,
+        upper_confidence_bound: 106.04564690901603,
+      },
+    };
+
+    const multiBucketAnomaly: AnomalyRecordDoc = {
+      job_id: 'farequote_mb',
+      result_type: 'record',
+      probability: 0.0191711,
+      record_score: 4.38431,
+      initial_record_score: 19.654,
+      bucket_span: 300,
+      detector_index: 0,
+      is_interim: false,
+      timestamp: 1454890500000,
+      function: 'mean',
+      function_description: 'mean',
+      field_name: 'responsetime',
+      anomaly_score_explanation: {
+        single_bucket_impact: 14,
+        multi_bucket_impact: 65,
+        lower_confidence_bound: 94.79879269994528,
+        typical_value: 100.26620234643129,
+        upper_confidence_bound: 106.04564690901603,
+      },
+    };
+
+    const multiBucketAnomaly2: AnomalyRecordDoc = {
+      job_id: 'farequote_mb2',
+      result_type: 'record',
+      probability: 0.0191711,
+      record_score: 4.38431,
+      initial_record_score: 19.654,
+      bucket_span: 300,
+      detector_index: 0,
+      is_interim: false,
+      timestamp: 1454890500000,
+      function: 'mean',
+      function_description: 'mean',
+      field_name: 'responsetime',
+      anomaly_score_explanation: {
+        multi_bucket_impact: 65,
+        lower_confidence_bound: 94.79879269994528,
+        typical_value: 100.26620234643129,
+        upper_confidence_bound: 106.04564690901603,
+      },
+    };
+
+    const noASEAnomaly: AnomalyRecordDoc = {
+      job_id: 'farequote_ase',
+      result_type: 'record',
+      probability: 0.0191711,
+      record_score: 4.38431,
+      initial_record_score: 19.654,
+      bucket_span: 300,
+      detector_index: 0,
+      is_interim: false,
+      timestamp: 1454890500000,
+      function: 'mean',
+      function_description: 'mean',
+      field_name: 'responsetime',
+    };
+
+    const noMBIAnomaly: AnomalyRecordDoc = {
+      job_id: 'farequote_sbi',
+      result_type: 'record',
+      probability: 0.0191711,
+      record_score: 4.38431,
+      initial_record_score: 19.654,
+      bucket_span: 300,
+      detector_index: 0,
+      is_interim: false,
+      timestamp: 1454890500000,
+      function: 'mean',
+      function_description: 'mean',
+      field_name: 'responsetime',
+      anomaly_score_explanation: {
+        single_bucket_impact: 65,
+        lower_confidence_bound: 94.79879269994528,
+        typical_value: 100.26620234643129,
+        upper_confidence_bound: 106.04564690901603,
+      },
+    };
+
+    const singleBucketAnomaly2: AnomalyRecordDoc = {
+      job_id: 'farequote_sb2',
+      result_type: 'record',
+      probability: 0.0191711,
+      record_score: 4.38431,
+      initial_record_score: 19.654,
+      bucket_span: 300,
+      detector_index: 0,
+      is_interim: false,
+      timestamp: 1454890500000,
+      function: 'mean',
+      function_description: 'mean',
+      field_name: 'responsetime',
+      anomaly_score_explanation: {
+        single_bucket_impact: 65,
+        multi_bucket_impact: 65,
+        lower_confidence_bound: 94.79879269994528,
+        typical_value: 100.26620234643129,
+        upper_confidence_bound: 106.04564690901603,
+      },
+    };
+
+    test('returns false when single_bucket_impact much larger than multi_bucket_impact', () => {
+      expect(isMultiBucketAnomaly(singleBucketAnomaly)).toBe(false);
+    });
+
+    test('returns true when multi_bucket_impact much larger than single_bucket_impact', () => {
+      expect(isMultiBucketAnomaly(multiBucketAnomaly)).toBe(true);
     });
 
-    test('returns medium for 2 <= score < 3', () => {
-      expect(getMultiBucketImpactLabel(2)).toBe('medium');
-      expect(getMultiBucketImpactLabel(2.99)).toBe('medium');
+    test('returns true when multi_bucket_impact > 0 and single_bucket_impact undefined', () => {
+      expect(isMultiBucketAnomaly(multiBucketAnomaly2)).toBe(true);
     });
 
-    test('returns low for 1 <= score < 2', () => {
-      expect(getMultiBucketImpactLabel(1)).toBe('low');
-      expect(getMultiBucketImpactLabel(1.99)).toBe('low');
+    test('returns false when anomaly_score_explanation undefined', () => {
+      expect(isMultiBucketAnomaly(noASEAnomaly)).toBe(false);
     });
 
-    test('returns none for -5 <= score < 1', () => {
-      expect(getMultiBucketImpactLabel(-5)).toBe('none');
-      expect(getMultiBucketImpactLabel(0.99)).toBe('none');
+    test('returns false when multi_bucket_impact undefined', () => {
+      expect(isMultiBucketAnomaly(noMBIAnomaly)).toBe(false);
     });
 
-    test('returns expected label when impact outside normal bounds', () => {
-      expect(getMultiBucketImpactLabel(10)).toBe('high');
-      expect(getMultiBucketImpactLabel(-10)).toBe('none');
+    test('returns false when multi_bucket_impact === single_bucket_impact', () => {
+      expect(isMultiBucketAnomaly(singleBucketAnomaly2)).toBe(false);
     });
   });
 

x-pack/plugins/ml/common/util/anomaly_utils.ts

@@ -12,7 +12,6 @@
 
 import { i18n } from '@kbn/i18n';
 import { CONDITIONS_NOT_SUPPORTED_FUNCTIONS } from '../constants/detector_rule';
-import { MULTI_BUCKET_IMPACT } from '../constants/multi_bucket_impact';
 import { ANOMALY_SEVERITY, ANOMALY_THRESHOLD, SEVERITY_COLORS } from '../constants/anomalies';
 import type { AnomaliesTableRecord, AnomalyRecordDoc } from '../types/anomalies';
 
@@ -119,6 +118,10 @@ function getSeverityTypes() {
   });
 }
 
+/**
+ * Returns whether the anomaly is in a categorization analysis.
+ * @param anomaly Anomaly table record
+ */
 export function isCategorizationAnomaly(anomaly: AnomaliesTableRecord): boolean {
   return anomaly.entityName === 'mlcategory';
 }
@@ -219,29 +222,50 @@ export function getSeverityColor(normalizedScore: number): string {
 }
 
 /**
- * Returns a label to use for the multi-bucket impact of an anomaly
- * according to the value of the multi_bucket_impact field of a record,
- * which ranges from -5 to +5.
- * @param multiBucketImpact - Value of the multi_bucket_impact field of a record, from -5 to +5
+ * Returns whether the anomaly record should be indicated in the UI as a multi-bucket anomaly,
+ * for example in anomaly charts with a cross-shaped marker.
+ * @param anomaly Anomaly table record
  */
-export function getMultiBucketImpactLabel(multiBucketImpact: number): string {
-  if (multiBucketImpact >= MULTI_BUCKET_IMPACT.HIGH) {
-    return i18n.translate('xpack.ml.anomalyUtils.multiBucketImpact.highLabel', {
-      defaultMessage: 'high',
-    });
-  } else if (multiBucketImpact >= MULTI_BUCKET_IMPACT.MEDIUM) {
-    return i18n.translate('xpack.ml.anomalyUtils.multiBucketImpact.mediumLabel', {
-      defaultMessage: 'medium',
-    });
-  } else if (multiBucketImpact >= MULTI_BUCKET_IMPACT.LOW) {
-    return i18n.translate('xpack.ml.anomalyUtils.multiBucketImpact.lowLabel', {
-      defaultMessage: 'low',
-    });
-  } else {
-    return i18n.translate('xpack.ml.anomalyUtils.multiBucketImpact.noneLabel', {
-      defaultMessage: 'none',
-    });
+export function isMultiBucketAnomaly(anomaly: AnomalyRecordDoc): boolean {
+  if (anomaly.anomaly_score_explanation === undefined) {
+    return false;
   }
+
+  const sb = anomaly.anomaly_score_explanation.single_bucket_impact;
+  const mb = anomaly.anomaly_score_explanation.multi_bucket_impact;
+
+  if (mb === undefined || mb === 0) {
+    return false;
+  }
+
+  if (sb !== undefined && sb > mb) {
+    return false;
+  }
+
+  if ((sb === undefined || sb === 0) && mb > 0) {
+    return true;
+  }
+
+  if (sb !== undefined && mb > sb) {
+    return (((mb - sb) * mb) / sb) * 1.7 >= 2;
+  }
+
+  return false;
+}
+
+/**
+ * Returns the value on a scale of 1 to 5, from a log based scaled value for an
+ * anomaly score explanation impact field, such as anomaly_characteristics_impact,
+ * single_bucket_impact or multi_bucket_impact.
+ * @param score value from an impact field from the anomaly_score_explanation.
+ * @returns numeric value on an integer scale of 1 (low) to 5 (high).
+ */
+export function getAnomalyScoreExplanationImpactValue(score: number): number {
+  if (score < 2) return 1;
+  if (score < 4) return 2;
+  if (score < 7) return 3;
+  if (score < 12) return 4;
+  return 5;
 }
 
 /**

x-pack/plugins/ml/public/application/components/anomalies_table/anomalies_table_columns.js

@@ -27,7 +27,7 @@ import { InfluencersCell } from './influencers_cell';
 import { LinksMenu } from './links_menu';
 import { checkPermission } from '../../capabilities/check_capabilities';
 import { mlFieldFormatService } from '../../services/field_format_service';
-import { isRuleSupported } from '../../../../common/util/anomaly_utils';
+import { isRuleSupported, isMultiBucketAnomaly } from '../../../../common/util/anomaly_utils';
 import { formatValue } from '../../formatters/format_value';
 import { INFLUENCERS_LIMIT, ANOMALIES_TABLE_TABS } from './anomalies_table_constants';
 import { SeverityCell } from './severity_cell';
@@ -133,7 +133,7 @@ export function getColumns(
         </EuiToolTip>
       ),
       render: (score, item) => (
-        <SeverityCell score={score} multiBucketImpact={item.source.multi_bucket_impact} />
+        <SeverityCell score={score} isMultiBucketAnomaly={isMultiBucketAnomaly(item.source)} />
       ),
       sortable: true,
     },

x-pack/plugins/ml/public/application/components/anomalies_table/anomaly_details_utils.tsx

@@ -26,7 +26,10 @@ import {
 import { AnomaliesTableRecord, MLAnomalyDoc } from '../../../../common/types/anomalies';
 import { formatValue } from '../../formatters/format_value';
 import { ML_JOB_AGGREGATION } from '../../../../common/constants/aggregation_types';
-import { getSeverityColor } from '../../../../common/util/anomaly_utils';
+import {
+  getAnomalyScoreExplanationImpactValue,
+  getSeverityColor,
+} from '../../../../common/util/anomaly_utils';
 
 const TIME_FIELD_NAME = 'timestamp';
 
@@ -597,14 +600,6 @@ function getAnomalyType(explanation: MLAnomalyDoc['anomaly_score_explanation'])
   return explanation.anomaly_type === 'dip' ? dip : spike;
 }
 
-function getImpactValue(score: number) {
-  if (score < 2) return 1;
-  if (score < 4) return 2;
-  if (score < 7) return 3;
-  if (score < 12) return 4;
-  return 5;
-}
-
 const impactTooltips = {
   anomaly_characteristics: {
     low: i18n.translate(
@@ -681,7 +676,7 @@ function getImpactTooltip(
   score: number,
   type: 'anomaly_characteristics' | 'single_bucket' | 'multi_bucket'
 ) {
-  const value = getImpactValue(score);
+  const value = getAnomalyScoreExplanationImpactValue(score);
 
   if (value < 3) {
     return impactTooltips[type].low;
@@ -698,7 +693,7 @@ const ImpactVisual: FC<{ score: number }> = ({ score }) => {
     euiTheme: { colors },
   } = useEuiTheme();
 
-  const impact = getImpactValue(score);
+  const impact = getAnomalyScoreExplanationImpactValue(score);
   const boxPx = '10px';
   const emptyBox = colors.lightShade;
   const fullBox = colors.primary;

x-pack/plugins/ml/public/application/components/anomalies_table/severity_cell/severity_cell.test.tsx

@@ -13,7 +13,7 @@ describe('SeverityCell', () => {
   test('should render a single-bucket marker with rounded severity score', () => {
     const props = {
       score: 75.2,
-      multiBucketImpact: -2,
+      isMultiBucketAnomaly: false,
     };
     const { container } = render(<SeverityCell {...props} />);
     expect(container.textContent).toBe('75');
@@ -24,7 +24,7 @@ describe('SeverityCell', () => {
   test('should render a multi-bucket marker with low severity score', () => {
     const props = {
       score: 0.8,
-      multiBucketImpact: 4,
+      isMultiBucketAnomaly: true,
     };
     const { container } = render(<SeverityCell {...props} />);
     expect(container.textContent).toBe('< 1');