Skip to content

[Observability] Add logs anomalies and categorization to serverless #2625

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified solutions/images/observability-anomalies-chart.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified solutions/images/observability-log-opened.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
9 changes: 4 additions & 5 deletions solutions/observability/logs/categorize-log-entries.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
mapped_pages:
- https://www.elastic.co/guide/en/observability/current/categorize-logs.html
applies_to:
stack: all
stack: ga
serverless: ga
products:
- id: observability
---
Expand All @@ -17,16 +18,14 @@ The **Categories** page enables you to identify patterns in your log events quic
This feature makes use of {{ml}} {{anomaly-jobs}}. To set up jobs, you must have `all` {{kib}} feature privileges for **{{ml-app}}**. Users that have full or read-only access to {{ml-features}} within a {{kib}} space can view the results of *all* {{anomaly-jobs}} that are visible in that space, even if they do not have access to the source indices of those jobs. You must carefully consider who is given access to {{ml-features}}; {{anomaly-job}} results may propagate field values that contain sensitive information from the source indices to the results. For more details, refer to [Set up {{ml-features}}](/explore-analyze/machine-learning/setting-up-machine-learning.md).
::::



## Create log categories [create-log-categories]

Create a {{ml}} job to categorize log messages automatically. {{ml-cap}} observes the static parts of the message, clusters similar messages, classifies them into message categories, and detects unusually high message counts in the categories.

1. Open the **Categories** page by finding `Logs / Categories` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). You are prompted to use {{ml}} to create log rate categorizations.
2. Choose a time range for the {{ml}} analysis. By default, the {{ml}} job analyzes log messages no older than four weeks and continues indefinitely.
3. Add the indices that contain the logs you want to examine. By default, Machine Learning analyzes messages in all log indices that match the patterns set in the **logs sources** advanced setting. To open **Advanced settings**, find **Stack Management** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
4. Click **Create ML job**. The job is created, and it starts to run. It takes a few minutes for the {{ml}} robots to collect the necessary data. After the job processed the data, you can view the results.
4. Click **Create ML job**. The job is created, and it starts to run. It takes a few minutes for the {{ml}} robots to collect the necessary data. After the job has processed the data, you can view the results.


## Analyze log categories [analyze-log-categories]
Expand All @@ -46,7 +45,7 @@ The category row contains the following information:
* datasets: the name of the datasets where the categories are present.
* maximum anomaly score: the highest anomaly score in the category.

To view a log message under a particular category, click the arrow at the end of the row. To further examine a message, it can be viewed in the corresponding log event on the **Stream** page or displayed in its context.
To view a log message under a particular category, click the arrow at the end of the row. To further examine a message, it can be viewed in **Discover** or displayed in its context.

:::{image} /solutions/images/observability-log-opened.png
:alt: Opened log category
Expand Down
11 changes: 4 additions & 7 deletions solutions/observability/logs/inspect-log-anomalies.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
mapped_pages:
- https://www.elastic.co/guide/en/observability/current/inspect-log-anomalies.html
applies_to:
stack: all
stack: ga
serverless: ga
products:
- id: observability
---
Expand All @@ -22,18 +23,14 @@ You can also view log anomalies directly in the [{{ml-app}} app](/explore-analyz
This feature makes use of {{ml}} {{anomaly-jobs}}. To set up jobs, you must have `all` {{kib}} feature privileges for **{{ml-app}}**. Users that have full or read-only access to {{ml-features}} within a {{kib}} space can view the results of *all* {{anomaly-jobs}} that are visible in that space, even if they do not have access to the source indices of those jobs. You must carefully consider who is given access to {{ml-features}}; {{anomaly-job}} results may propagate field values that contain sensitive information from the source indices to the results. For more details, refer to [Set up {{ml-features}}](/explore-analyze/machine-learning/setting-up-machine-learning.md).
::::



## Enable log rate analysis and {{anomaly-detect}} [enable-anomaly-detection]

Create a {{ml}} job to detect anomalous log entry rates automatically.

1. Select **Anomalies**, and you’ll be prompted to create a {{ml}} job which will carry out the log rate analysis.
1. From the main menu, go to **Other tools** → **Logs Anomalies**, or find `Logs anomalies` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). From here, you’ll be prompted to create a {{ml}} job which will carry out the log rate analysis.
2. Choose a time range for the {{ml}} analysis.
3. Add the indices that contain the logs you want to examine. By default, Machine Learning analyzes messages in all log indices that match the patterns set in the **logs source** advanced setting. To open **Advanced settings**, find **Stack Management** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
4. Click **Create {{ml-init}} job**.
5. You’re now ready to explore your log partitions.

4. Click **Create ML job**. The job is created, and it starts to run. It takes a few minutes for the {{ml}} robots to collect the necessary data. After the job has processed the data, you can view the results.

## Anomalies chart [anomalies-chart]

Expand Down
Loading