Skip to content

Add ML modules to Apache integration readme #2640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lcawl merged 4 commits into from
Mar 7, 2022
Merged

Add ML modules to Apache integration readme #2640

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3539c30
Add ML modules to Apache integration readme
lcawl Feb 3, 2022
21718be
Build elastic package
lcawl Feb 4, 2022
bd36ba1
Update changelog
lcawl Feb 4, 2022
873c8b1
Update version in manifest
lcawl Feb 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions packages/apache/_dev/build/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,3 +32,21 @@ generated by the `mod_status` module.
{{event "status"}}

{{fields "status"}}

## ML Modules
Copy link
Copy Markdown
Contributor

@mtojek mtojek Feb 4, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@peteharverson Do you know since which Kibana are these jobs present? We might need to bump up Kibana's constraint in this PR's manifest.

Copy link
Copy Markdown
Contributor

@peteharverson peteharverson Feb 4, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mtojek support for ML modules was added to Fleet for 7.13.0 - elastic/kibana#94950, and the package itself was updated shortly after that PR - #910. So the Kibana constraint looks ok to me.


These anomaly detection jobs are available in the Machine Learning app in Kibana
when you have data that matches the query specified in the
[manifest](https://github.com/elastic/integrations/blob/main/packages/apache/kibana/ml_module/apache-Logs-ml.json#L11).

### Apache Access Logs

Find unusual activity in HTTP access logs.

| Job | Description |
|---|---|
| visitor_rate_apache | HTTP Access Logs: Detect unusual visitor rates |
| status_code_rate_apache | HTTP Access Logs: Detect unusual status code rates |
| source_ip_url_count_apache | HTTP Access Logs: Detect unusual source IPs - high distinct count of URLs |
| source_ip_request_rate_apache | HTTP Access Logs: Detect unusual source IPs - high request rates |
| low_request_rate_apache | HTTP Access Logs: Detect low request rates |
Comment on lines +48 to +52
Copy link
Copy Markdown
Contributor

@mtojek mtojek Feb 4, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@peteharverson Is there any way/list we can grab these fields or mark them in packages? This would be the first step to automate things.

Copy link
Copy Markdown
Contributor

@peteharverson peteharverson Feb 4, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mtojek the module JSON file holding the ML anomaly detection job definitions is in kibana/ml_module. The jobs property inside attributes is an array of job objects. The format used here for each job would be

job.id | job.config.description

Currently we have published ML modules for the apache and nginx packages, and there are two more packages being worked on currently - problem child - #2115, and dga - #2352.

5 changes: 5 additions & 0 deletions packages/apache/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.3.5"
changes:
- description: Add ML modules to readme
type: enhancement
link: https://github.com/elastic/integrations/pull/2640
- version: "1.3.4"
changes:
- description: Regenerate test files using the new GeoIP database
Expand Down
18 changes: 18 additions & 0 deletions packages/apache/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,3 +384,21 @@ An example event for `status` looks as following:
| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | |
| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | |


## ML Modules

These anomaly detection jobs are available in the Machine Learning app in Kibana
when you have data that matches the query specified in the
[manifest](https://github.com/elastic/integrations/blob/main/packages/apache/kibana/ml_module/apache-Logs-ml.json#L11).

### Apache Access Logs

Find unusual activity in HTTP access logs.

| Job | Description |
|---|---|
| visitor_rate_apache | HTTP Access Logs: Detect unusual visitor rates |
| status_code_rate_apache | HTTP Access Logs: Detect unusual status code rates |
| source_ip_url_count_apache | HTTP Access Logs: Detect unusual source IPs - high distinct count of URLs |
| source_ip_request_rate_apache | HTTP Access Logs: Detect unusual source IPs - high request rates |
| low_request_rate_apache | HTTP Access Logs: Detect low request rates |
2 changes: 1 addition & 1 deletion packages/apache/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 1.0.0
name: apache
title: Apache HTTP Server
version: 1.3.4
version: 1.3.5
license: basic
description: Collect logs and metrics from Apache servers with Elastic Agent.
type: integration
Expand Down