[ObsUX] Telemetry : Differentiate between user- vs auto-initiatated Host queries

[roshan-elastic]

Problem

We're trying to understand whether want to interrogate all of their Hosts vs refine it down to a group/select few hosts. However, our telemetry doesn't differentiate between the default query that automatically fires vs those initiated by users. Therefore, when we want to look at how many hosts are returned, we can't differentiate between the default result set vs what users are actually searching for.

Solution

Update telemetry event Host View Total Host Count Retrieved to include properties.with_query attribute to help us differentiate:

Sample event - Returned upon query where user had added some kind of filter/KQL query

...

{
 "event_type": "Host View Total Host Count Retrieved",
  ...
  "properties": {
     "with_query":true, // whether query had KQL filter/query applied or was blank
     "total": 1000 // returned host count
     ...
     }
}

Sample event - Returned upon query WITHOUT KQL query

{
 "event_type": "Host View Total Host Count Retrieved",
  ...
  "properties": {
     "with_query":false, // whether query had KQL filter/query applied or was blank
     "total": 1000 // returned host count
     ...
     }
}

[elasticmachine]

Pinging @elastic/obs-ux-infra_services-team (Team:obs-ux-infra_services)

[roshan-elastic]

Hey @smith,

This isn't a bug so probably shouldn't be handled during bug freeze but it would be great if we can get this bit of telemetry added in (and back-ported) as soon as we can.

Context : This will help us understand how users interact with hosts...we can't figure out whether users are filtering for large counts of hosts or whether those large counts are only returned in the default query which happens when you open the page

[smith]

I think we can get this prioritized and backported without any problems.

[crespocarlos]

@roshan-elastic We're using an attribute named with_query in the Hosts View Query Submitted, but it only receives the information about the KQL bar. For this ticket, we want to know whether filters (controls included) and/or kql search were used for filtering the data.

Perhaps naming it with_query_or_filter or with_filters might better represent what this information is about?

[roshan-elastic]

Hey @crespocarlos - nice thinking!

I think you're suggesting this but could we have with_query behaving the same way but we have an additional with_filters attribute?

I'm happy to work with these in the analytics tool (will also preserve our existing structure I believe)?

[crespocarlos]

@roshan-elastic , yeah, we can have 2 attributes with_query and with_filters.