Tweak start/end/baseline/deviation

mgiota · Apr 16, 2024 · c5a2d58 · c5a2d58
1 parent 26e1877
commit c5a2d58
Showing 1 changed file with 62 additions and 22 deletions.
diff --git a/...o/burn_rate/alert_details/components/custom_panels/custom_kql/log_rate_analysis_panel.tsx b/...o/burn_rate/alert_details/components/custom_panels/custom_kql/log_rate_analysis_panel.tsx
@@ -16,18 +16,39 @@ import {
 } from '@kbn/aiops-log-rate-analysis/log_rate_analysis_type';
 import { LogRateAnalysisContent, type LogRateAnalysisResultsData } from '@kbn/aiops-plugin/public';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { ALERT_END } from '@kbn/rule-data-utils';
+import { ALERT_RULE_PARAMETERS, ALERT_TIME_RANGE } from '@kbn/rule-data-utils';
 import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
 import { useFetchDataViews } from '@kbn/observability-plugin/public';
 import { colorTransformer } from '@kbn/observability-shared-plugin/common';
 import { KQLCustomIndicator } from '@kbn/slo-schema';
 import { i18n } from '@kbn/i18n';
 import type { Message } from '@kbn/observability-ai-assistant-plugin/public';
+import { ALERT_ACTION_ID } from '../../../../../../../../common/constants';
 import type { WindowSchema } from '../../../../../../../typings';
+import { TimeRange } from '../../../../../error_rate_chart/use_lens_definition';
 import { BurnRateAlert, BurnRateRule } from '../../../alert_details_app_section';
+import { getActionGroupFromReason } from '../../../utils/alert';
 import { useKibana } from '../../../../../../../utils/kibana_react';
 import { getESQueryForLogRateAnalysis } from './helpers/log_rate_analysis_query';
 
+function getDataTimeRange(
+  timeRange: { gte: string; lte?: string },
+  window: WindowSchema
+): TimeRange {
+  const windowDurationInMs = window.longWindow.value * 60 * 60 * 1000;
+  return {
+    from: new Date(new Date(timeRange.gte).getTime() - windowDurationInMs),
+    to: timeRange.lte ? new Date(timeRange.lte) : new Date(),
+  };
+}
+
+function getAlertTimeRange(timeRange: { gte: string; lte?: string }): TimeRange {
+  return {
+    from: new Date(timeRange.gte),
+    to: timeRange.lte ? new Date(timeRange.lte) : new Date(),
+  };
+}
+
 interface Props {
   slo: GetSLOResponse;
   alert: BurnRateAlert;
@@ -84,14 +105,36 @@ export function LogRateAnalysisPanel({ slo, alert, rule }: Props) {
     getDataView();
   }, [index, dataViews, params, dataViewsService, groupBy, groupings]);
 
-  const intervalFactor = 1;
-  const alertStart = moment(alert.start);
-  const alertEnd = alert.fields[ALERT_END] ? moment(alert.fields[ALERT_END]) : undefined;
+  // Identify `intervalFactor` to adjust time ranges based on alert settings.
+  // The default time ranges for `initialAnalysisStart` are suitable for a `1m` lookback.
+  // If an alert would have a `5m` lookback, this would result in a factor of `5`.
+  // We always take the "long window" of the SLO to calculate the intervalFactor.
+  const alertActionGroup =
+    alert.fields['kibana.alert.action_group'] !== 'recovered'
+      ? alert.fields['kibana.alert.action_group']
+      : ALERT_ACTION_ID;
+  const sloWindows = alert.fields['kibana.alert.rule.parameters']!.windows as WindowSchema[];
+  const relatedWindow = sloWindows.find((window) => window.actionGroup === alertActionGroup);
+  const longWindowValue = relatedWindow?.longWindow.value;
+  const longWindowUnit = relatedWindow?.longWindow.unit;
+  const lookbackDuration =
+    longWindowValue && longWindowUnit
+      ? moment.duration(longWindowValue as number, longWindowUnit as any)
+      : moment.duration(1, 'm');
+  const intervalFactor = Math.max(1, lookbackDuration.asSeconds() / 60);
 
-  const timeRange = {
-    min: alertStart.clone().subtract(15 * intervalFactor, 'minutes'),
-    max: alertEnd ? alertEnd.clone().add(1 * intervalFactor, 'minutes') : moment(new Date()),
-  };
+  const actionGroup = getActionGroupFromReason(alert.reason);
+  const actionGroupWindow = (
+    (alert.fields[ALERT_RULE_PARAMETERS]?.windows ?? []) as WindowSchema[]
+  ).find((window: WindowSchema) => window.actionGroup === actionGroup);
+
+  // @ts-ignore
+  const dataTimeRange = getDataTimeRange(alert.fields[ALERT_TIME_RANGE], actionGroupWindow);
+  const timeRange = { min: moment(dataTimeRange.from), max: moment(dataTimeRange.to) };
+  // @ts-ignore
+  const alertTimeRange = getAlertTimeRange(alert.fields[ALERT_TIME_RANGE]);
+  const alertStart = moment(alertTimeRange.from);
+  const alertEnd = moment(alertTimeRange.to);
 
   const logRateAnalysisTitle = i18n.translate(
     'xpack.slo.burnRateRule.alertDetails.logRateAnalysisTitle',
@@ -100,14 +143,6 @@ export function LogRateAnalysisPanel({ slo, alert, rule }: Props) {
     }
   );
 
-  const alertActionGroup = alert.fields['kibana.alert.action_group'];
-  const sloWindows = alert.fields['kibana.alert.rule.parameters']!.windows as WindowSchema[];
-  const relatedWindow = sloWindows.find((window) => window.actionGroup === alertActionGroup);
-  const longWindowValue = relatedWindow?.longWindow.value;
-  const longWindowUnit = relatedWindow?.longWindow.unit;
-  const shortWindowValue = relatedWindow?.shortWindow.value;
-  const shortWindowUnit = relatedWindow?.shortWindow.unit;
-
   function getDeviationMax() {
     if (alertEnd) {
       return alertEnd
@@ -117,26 +152,31 @@ export function LogRateAnalysisPanel({ slo, alert, rule }: Props) {
     } else if (
       alertStart
         .clone()
-        .add(10 * shortWindowValue!, shortWindowUnit)
+        .add(10 * intervalFactor, 'minutes')
         .isAfter(moment(new Date()))
     ) {
       return moment(new Date()).valueOf();
     } else {
       return alertStart
         .clone()
-        .add(10 * shortWindowValue!, shortWindowUnit)
+        .add(10 * intervalFactor, 'minutes')
         .valueOf();
     }
   }
 
   const initialAnalysisStart = {
     baselineMin: alertStart
       .clone()
-      .subtract(longWindowValue, longWindowUnit)
-      .subtract(shortWindowValue, shortWindowUnit)
+      .subtract(13 * intervalFactor, 'minutes')
+      .valueOf(),
+    baselineMax: alertStart
+      .clone()
+      .subtract(2 * intervalFactor, 'minutes')
+      .valueOf(),
+    deviationMin: alertStart
+      .clone()
+      .subtract(1 * intervalFactor, 'minutes')
       .valueOf(),
-    baselineMax: alertStart.clone().subtract(shortWindowValue, shortWindowUnit).valueOf(),
-    deviationMin: alertStart.clone().subtract(shortWindowValue, shortWindowUnit).valueOf(),
     deviationMax: getDeviationMax(),
   };