[DOCS] Add information in the 7.11 and 7.12 troubleshooting section about ML job upgrade

[dontcallmesherryli]

Description

Updated ML Job's were delivered in 7.11 (elastic/kibana#85065) that take advantage of newly populated fields in the latest beats/agent. Since new ML Rules were not shipped alongside these job updates, if users update their beats/agent without first enabling the latest jobs and creating rules for them (or cloning existing and changing the selected ML Job), underlying detected anomalies may not have a Detection Alert generated and users would need to rely on the ML App visualization.

Acceptance Test Criteria

Add troubleshooting information about upgrading ML jobs: if you upgraded to Elastic 7.11 or 7.12, your ML jobs might not work. At earliest convenience upgrade your ML rules to the newest version.

Notes

• Add the "Team:Docs" label to new issues.
• Be sure to add the version number label.
• Be sure to add any necessary screenshots for clarity.
• Include any conditions or caveats that may affect customers.

[spong]

@jmikell821 -- both @randomuserid and I can help here with the details, so please reach out when this is ready to be worked 🙂

[randomuserid]

So the revised language would look like this;

The conditions for the workaround are any of these;

1. Running a mixed version fleet of Elastic beats, including newer versions such as 7.10 - 7.12, intermixed with older versions
2. Running a population of Elastic endpoints
3. Ingesting data from other sources using recent ECS versions

Workaround:

1. Clone the existing ML alert rules
2. Reconfigure each clone to query the v2 version of the target ML job

Note: there may be some edge cases of duplicate alerts, at the cost of eliminating dropped alerts, this needs analysis.

[rylnd]

@jmikell821 @lcawl I've specified ml-job-compatibility.html as the prospective doc link for this issue. Is it possible to reverse-engineer the documentation page from this link? If not, what is the recommendation here?

[lcawl]

If not, what is the recommendation here?

The URL alerts-ui-monitor.html#ml-job-compatibility in https://github.com/elastic/kibana/pull/94393/files#diff-9f3c81018ca4fe3e87d9791151923ec0f4ae0e85b440ecbe4f88b98739fea9cbR37 aligns with the (currently empty) section I've drafted in #553

[lcawl]

Addressed in https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#ml-job-compatibility via #553