[ML] Explain Log Rate Spikes: Fix applying overall params to histogram queries. (#144219)

Applying the overall params like the time range to the histogram queries was missing. This fixes it by creating getHistogramQuery that can be applied when fetching the histogram for overall data, individual field/value histograms and group histograms.

x-pack/plugins/aiops/server/routes/explain_log_rate_spikes.ts

@@ -45,6 +45,7 @@ import {
   groupDuplicates,
 } from './queries/fetch_frequent_items';
 import type { ItemsetResult } from './queries/fetch_frequent_items';
+import { getHistogramQuery } from './queries/get_histogram_query';
 import {
   getFieldValuePairCounts,
   getSimpleHierarchicalTree,
@@ -321,12 +322,15 @@ export const defineExplainLogRateSpikesRoute = (
           logDebugMessage('Fetch overall histogram.');
 
           let overallTimeSeries: NumericChartData | undefined;
+
+          const overallHistogramQuery = getHistogramQuery(request.body);
+
           try {
             overallTimeSeries = (
               (await fetchHistogramsForFields(
                 client,
                 request.body.index,
-                { match_all: {} },
+                overallHistogramQuery,
                 // fields
                 histogramFields,
                 // samplerShardSize
@@ -579,13 +583,12 @@ export const defineExplainLogRateSpikesRoute = (
 
                   await asyncForEach(changePointGroupsChunk, async (cpg) => {
                     if (overallTimeSeries !== undefined) {
-                      const histogramQuery = {
-                        bool: {
-                          filter: cpg.group.map((d) => ({
-                            term: { [d.fieldName]: d.fieldValue },
-                          })),
-                        },
-                      };
+                      const histogramQuery = getHistogramQuery(
+                        request.body,
+                        cpg.group.map((d) => ({
+                          term: { [d.fieldName]: d.fieldValue },
+                        }))
+                      );
 
                       let cpgTimeSeries: NumericChartData;
                       try {
@@ -675,15 +678,11 @@ export const defineExplainLogRateSpikesRoute = (
 
               await asyncForEach(changePointsChunk, async (cp) => {
                 if (overallTimeSeries !== undefined) {
-                  const histogramQuery = {
-                    bool: {
-                      filter: [
-                        {
-                          term: { [cp.fieldName]: cp.fieldValue },
-                        },
-                      ],
+                  const histogramQuery = getHistogramQuery(request.body, [
+                    {
+                      term: { [cp.fieldName]: cp.fieldValue },
                     },
-                  };
+                  ]);
 
                   let cpTimeSeries: NumericChartData;
 

x-pack/plugins/aiops/server/routes/queries/get_histogram_query.test.ts

@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getHistogramQuery } from './get_histogram_query';
+
+const paramsMock = {
+  index: 'the-index',
+  timeFieldName: 'the-time-field-name',
+  start: 1577836800000,
+  end: 1609459200000,
+  baselineMin: 10,
+  baselineMax: 20,
+  deviationMin: 30,
+  deviationMax: 40,
+  includeFrozen: false,
+  searchQuery: '{"bool":{"filter":[],"must":[{"match_all":{}}],"must_not":[]}}',
+};
+
+describe('getHistogramQuery', () => {
+  it('returns histogram query without additional filters', () => {
+    const query = getHistogramQuery(paramsMock);
+    expect(query).toEqual({
+      bool: {
+        filter: [
+          { bool: { filter: [], must: [{ match_all: {} }], must_not: [] } },
+          {
+            range: {
+              'the-time-field-name': {
+                format: 'epoch_millis',
+                gte: 1577836800000,
+                lte: 1609459200000,
+              },
+            },
+          },
+        ],
+      },
+    });
+  });
+
+  it('returns histogram query with additional filters', () => {
+    const query = getHistogramQuery(paramsMock, [
+      {
+        term: { ['the-filter-fieldName']: 'the-filter-fieldValue' },
+      },
+    ]);
+    expect(query).toEqual({
+      bool: {
+        filter: [
+          { bool: { filter: [], must: [{ match_all: {} }], must_not: [] } },
+          {
+            term: {
+              'the-filter-fieldName': 'the-filter-fieldValue',
+            },
+          },
+          {
+            range: {
+              'the-time-field-name': {
+                format: 'epoch_millis',
+                gte: 1577836800000,
+                lte: 1609459200000,
+              },
+            },
+          },
+        ],
+      },
+    });
+  });
+});

x-pack/plugins/aiops/server/routes/queries/get_histogram_query.ts

@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
+import type { AiopsExplainLogRateSpikesSchema } from '../../../common/api/explain_log_rate_spikes';
+
+import { getQueryWithParams } from './get_query_with_params';
+
+export function getHistogramQuery(
+  params: AiopsExplainLogRateSpikesSchema,
+  filter: estypes.QueryDslQueryContainer[] = []
+) {
+  const histogramQuery = getQueryWithParams({
+    params,
+  });
+
+  if (Array.isArray(histogramQuery.bool.filter)) {
+    const existingFilter = histogramQuery.bool.filter.filter((d) => Object.keys(d)[0] !== 'range');
+
+    histogramQuery.bool.filter = [
+      ...existingFilter,
+      ...filter,
+      {
+        range: {
+          [params.timeFieldName]: {
+            gte: params.start,
+            lte: params.end,
+            format: 'epoch_millis',
+          },
+        },
+      },
+    ];
+  }
+
+  return histogramQuery;
+}