[Metrics UI] Add anomalies tab to enhanced node details

[phillipb]

Summary

Added anomalies table to enhanced node details. Slightly adapted the anomalies table that shows up in the Anomaly Detection flyout to be able to work with a hostName filter.

Also, made some changes to the actions dropdown. For now, I removed "Create alert" code because we don't have anomaly alerts enabled yet. Lastly, the behavior for "Show in Inventory" has changed so that it actually filters the waffle map to only show the anomalous nodes. Because we've run into cases where there are thousands of influencers, we added in some logic to disable filtering when there are large numbers of influencers because of a limit in Elasticsearch. Based on feedback from ML this should only happen in rare cases, but we added in some telemetry (metrics_ml_anomaly_detection_more_than_100_influencers) to keep track of how often it happens.

Fixes: #88541.

.

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

[elasticmachine]

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

[phillipb]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 80c3d65
• Storybooks Preview
• Documentation Changes

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
infra	1.7MB	1.7MB	-898.0B

History

• 💔 Build #119576 failed ed314b6
• 💚 Build #119217 succeeded 67e487b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[neptunian]

I don't think this is related but currently looking into behavior I'm seeing when trying to generate anomalies to view in the Anomaly Flyout. I see anomalies for k8s in the timeline but not in the Anomaly flyout:

[phillipb]

I'm actually not sure how you got anomalies for CPU. We don't have a ML job that track anomalies for CPU nor do we fetch them for the timeline.

[neptunian]

The same behaviour also occurs with "memory". I opened a separate issue for the anomaly appearing in the timeline when CPU is selected. Confirmed neither of these issues is related to your changes. Sorry for the noise!

[neptunian]

Were we going to remove the "Show in Inventory" from EHD? I believe we were discussing in Slack that it was redundant at this point.

[phillipb]

@sorantis I still don't believe it's redundant. I still think there's value to being able to just to that point in time for that metric. Thoughts?

[sorantis]

@phillipb what use case do you have in mind for this action on EHD?

[phillipb]

@sorantis because an anomaly can affect multiple host, a user would still want to be able to "Show in inventory" to see all the host and the metric values for them.

[sorantis]

@phillipb for this case the entry point is the ML flyout with all anomalies.
Correct me if I'm wrong, but the way I see the user journey - users see an indication that an anomaly has been detected, they open the ML flyout to check the latest (recent) anomaly, click the "Show in Inventory" action, which updates the waffle map. At this point they can start checking each host and the Anomaly tab will be there to provide information about any anomalies involving that host now or in the past.
Adding an action to change the waffle map state at this point will break the investigation flow, because it will render a different view (should they click Show in Inventory on the Anomalies tab), so users will have to restart the flow to go back to the initial investigation.
Also, apart from updating the timestamp and metric, how would the user know that more hosts are affected if we don't add any filters for this action in EHD?

[phillipb]

@sorantis yeah that flow makes sense. Only difference is we don't currently show the indicator for new anomalies yet.

I was thinking of a different flow. I was thinking the user would click a node on the waffle map to open EHD and then click the anomalies tab to investigate the history of that node. Then they might want to show a given anomaly on the inventory and see all the host that are associated with that anomaly. If you don't think that flow is high priority or that it might be confusing for the other flow, happy to remove it from EHD.

[phillipb]

Going to merge as is, because it's literally a one line code change if we want to turn it off.