Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[O365_metrics] Add teams_device_usage data stream. #12218

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

ritalwar
Copy link
Contributor

@ritalwar ritalwar commented Jan 2, 2025

  • Enhancement

Proposed commit message

Add teams_device_usage data stream to O365_metrics package.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

Screenshots

@ritalwar ritalwar requested a review from a team as a code owner January 2, 2025 06:31
@ritalwar ritalwar requested a review from lucian-ioan January 2, 2025 06:31
@ritalwar ritalwar added Team:Obs-InfraObs Label for the Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations] Integration:o365_metrics Microsoft Office 365 Metrics labels Jan 2, 2025
@ritalwar ritalwar self-assigned this Jan 2, 2025
@elastic-vault-github-plugin-prod

🚀 Benchmarks report

Package o365_metrics 👍(5) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
mailbox_usage 6451.61 4255.32 -2196.29 (-34.04%) 💔

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

cc @ritalwar

Copy link

Quality Gate failed Quality Gate failed

Failed conditions
51.7% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

required: false
show_user: false
default:
- o365.metrics.outlook.activity
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rename tag.

value: "8.16.0"
- json:
field: teamsdeviceusage
target_field: o365.metrics.teams.device.usage
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe add ignore_failure: true here so the pipeline doesn't break.

type: group
fields:
- name: android_phone.count
type: integer
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please verify if the type: integer lead to any limitations in the value range. 2**31-1 is not a big value range. Please verify for the other integer fields.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since I couldn't find any specific details about these fields in the API documentation and we're only retrieving 7 days of data, it should not exceed the limit. However, I agree that I should verify this, not just for this field but for all fields across all data streams. Additionally, using long might indeed be a better choice here. I've added this to the issue where we're tracking all review comments for verification across all data streams. I'll address this in a separate PR covering all the data streams. Does that sound okay?


### Teams Device Usage

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: It will be good to add a line or two about what the dataset is for.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’ve added this to the issue list to update it for all datasets collectively in a single documentation PR.

@agithomas
Copy link
Contributor

I assume the TSDS enablement will be done through a separate PR. Please remember to add metric_type mapping, TSDS enablement without fail.

field: o365.metrics.teams.device.usage.windows_phone
target_field: o365.metrics.teams.device.usage.windows_phone.count
ignore_missing: true
- rename:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for this and refresh_date, are we going to use the date processor to process?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From my understanding, we use the date processor to parse dates from fields and then use the parsed date or timestamp as the document's timestamp in Elasticsearch. However, we cannot use report_date or report_refresh_date as the document timestamp because these fields are generated by Microsoft and do not represent the actual ingestion time of the document in Elasticsearch.

For example, if a report is fetched today (January 10) to retrieve the last 7 days of data, the report_refresh_date might be January 7, which would be the same for all 7 documents. Meanwhile, the report_date for these 7 documents would range from January 1 to January 7. This means neither report_date nor report_refresh_date can reliably represent the document's ingestion timestamp.

Please let me know if I’ve misunderstood something or if your question was different.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay I understand now. But suppose when you will make the visualization, what are you going to use as the timestamp? Suppose, the user wants to use the visualization (or for aggregation purpose) then we cannot use the ingestion time, right. Are you going to manually change the timestamp to these fields when plotting?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question! I assume they can use report_date if they want the visualizations to reflect the actual date the data pertains to, or report_refresh_date if the visualizations should represent the date the report was last updated or refreshed. What are your thoughts?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As part of the integration testing, do you see any latency in the availability of metrics?

For example : If you run the integration for the current date, the data is available only till yesterday.

If yes, it would be best to mention this latency in the README.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the integration testing, I’ve set the API call interval to 3 minutes, and during this period, I do see data ingestion occurring every 3 min. However, this short interval is just for testing purposes. In a production environment, a 3-minute interval is not practical. Ideally, the interval should be at least 24 hours, as the Microsoft API only fetches the latest report, and reports are usually refreshed every 3-4 days. So, even if we call the API every 24 hours, the records might remain the same.

But I agree that updating these details in the README is important, especially since we're receiving data for like 7 days here, so users can configure accordingly for both period and interval. While I assume microsoft users should already be aware of how this works, I will ensure the README is detailed for clarity.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Integration:o365_metrics Microsoft Office 365 Metrics Team:Obs-InfraObs Label for the Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations]
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants