elasticml

Documentation

Overview

Package elasticml polls Elastic ML anomaly-detection jobs and ingests significant records into Coremetry's anomaly_events table. Read-only against Elastic — every job stays under Elastic's management; Coremetry just surfaces records as anomaly rows so operators get one triage surface across native + Elastic detections.

Index

• type Config
• type Poller
  • func New(cfg Config, store *chstore.Store, lock cache.Lock) (*Poller, error)
  • func (p *Poller) Start(ctx context.Context)

Types

type Config

type Config struct {
	Addresses          []string
	Username, Password string
	APIKey             string
	InsecureSkipVerify bool
	Interval           time.Duration
	MinScore           float64
}

Config holds the connection bits + tunables. Addresses / Username / Password / APIKey mirror the logstore ES config — the operator points us at the same cluster they're already querying for logs.

type Poller

type Poller struct {
	// contains filtered or unexported fields
}

Poller is the long-running background worker. tick() pulls the current ML job list and, for each open job, fetches recent high-score records and upserts them into anomaly_events. Lock-elect makes HA-safe; the lock TTL is 2× interval so a slow run doesn't kill liveness.

func New

func New(cfg Config, store *chstore.Store, lock cache.Lock) (*Poller, error)

func (*Poller) Start

func (p *Poller) Start(ctx context.Context)