[APM] ML integration will not work on Basic license

[formgeist]

Kibana version:
Master - 7.0.0.

Any additional context:
Basic license

---

Update: permission checking for ML capabilities is outlined here: #20728

Updated description: We found that the KibanaLinkComponent was breaking our integration links, which is why the integration wasn't working. This issue is now related to checking whether the Kibana license is platinum so we can expect that ML will create a job for us. Otherwise we might have to resort to an error message telling the user that the license does no support ML anomaly detection jobs and they should upgrade.

We'd prefer that the ML integration not show if license is only basic, because the user cannot use the integration properly without a platinum license.

cc @makwarth @blaklaybul

AC:

• Disable button and add a callout in the anomaly detection flyout if user doesn't have access to the correct ML capabilities

Note:

• How to downgrade: go to Kibana > Management > License Management > Update License and drag a new license in

[elasticmachine]

Pinging @elastic/apm-ui

[makwarth]

@blaklaybul what do you recommend?

[peteharverson]

@makwarth @formgeist it's worth you checking out the changes we made to the way the license is checked when the ML plugin loads up as part of #24423, specifically in /x-pack/plugins/ml/server/lib/check_license/check_license.js (see https://github.com/elastic/kibana/pull/24423/files#diff-4a4b53b180b2209824e25957a8b332f6).

You'll need to check if the license is platinum or trial, and that the license is active (i.e. not expired) and that the ML feature of x-pack license info is enabled.

For a basic or gold license, the ML plugin is now enabled, but only the Data Visualizer is available.

[formgeist]

@peteharverson Thanks for the reply, and the reference – @elastic/apm-ui anyone want to grab this and see about changing the check in the Integrations context menu?

[sorenlouv]

@formgeist How did you figure out it was due to license issues?
The error message mentions KibanaLinkComponent, so I suspect it to be related to our link builder.

[formgeist]

@sqren Because ML is available but limited with a basic license, and I thought we checked just whether or not ML is available in Kibana, and not whether or not it's running the appropriate license we need to create APM jobs.

[formgeist]

I've create a separate ticket for the KibanaLinkComponent which breaks our integration links #24636

This ticket is now more related to updating the Integration to consider which license is enabled, so we can expect ML to be able to create jobs or we have to throw an error that the license is not platinum and therefore the integration does not work.

[alvarolobato]

There are other checks we should be doing, related to permission - #20728

We will keep the ML button and add a message letting the user know that they need a higher license to run it.

[jasonrhodes]

cc @alvarolobato @makwarth @roncohen

see: #20728 (comment)

tl;dr we aren't able to use the ML method for getting privilege info outside of the ML plugin. Without that, I don't see a way to get privilege info about who can/can't create ML jobs when the license says ML is available.

We suggest, for now, just updating the error message to say that the job already exists or you may not have permission to create a job, until there is a better way to know this info in advance.

[formgeist]

Couldn't we check if the license is basic and let the user know that the ML feature is only supported by platinum in the flyout copy with a callout or similar? And disable the create job button.

[jasonrhodes]

Couldn't we check if the license is basic and let the user know that the ML feature is only supported by platinum

possibly, but I think we were trying to avoid this kind of check because it's fragile (what if certain basic licenses are given ML job creation privileges, would we know that and update our code or would we block those users from the button forever because of our check?) -- it would be great if those granular privileges were exposed via API somehow.

Since we can't check privileges right now, I'm happy to check on license type if that's what we want to do. Also happy to just update the error message like so:

[jasonrhodes]

Part 1 of this was closed by #28085

Continuing work moved to #28447