Skip to content

[ML] Custom rule w/ time condition specified is accepted for forbidden functions #32545

@dolaru

Description

@dolaru

Description

Found in 6.4.0-BC1

According to documentation:

If your detector uses lat_long, metric, rare, or freq_rare functions, you cannot specify conditions for your rule.

If the user tries to create a job that:

  • uses one of the forbidden functions (lat_long, metric, rare or freq_rare)
  • has a custom rule specifying a condition with applies_to set to time

... the job gets created, even though it shouldn't have according to documentation.

Steps to reproduce

  1. Create a job that uses one of the forbidden functions (lat_long, metric, rare or freq_rare) and has a custom rule with a time condition:
PUT _xpack/ml/anomaly_detectors/custom_rule_forbidden_function
{
  "analysis_config": {
    "detectors": [
      {
        "function": "metric",
        "field_name": "someFieldName",
        "custom_rules": [
          {
            "actions": [
              "skip_result"
            ],
            "conditions": [
              {
                "applies_to": "time",
                "operator": "gte",
                "value": 0
              }
            ]
          }
        ]
      }
    ]
  },
  "data_description": {}
}
  1. Notice the job was created, even though it shouldn't have according to documentation.

Metadata

Metadata

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions