fixes

internal/features/features.go

@@ -31,17 +31,19 @@ type Event struct {
 	Message          string
 	SpanName         string
 	Route            string
+	Host             string // request host (Host / :authority), used to find the ingress rule behind an edge error
 	StatusCode       int
 	ExceptionType    string
 
 	// Trace-resolved context (see internal/tracectx). All optional: zero
 	// values mean "not resolved", which behaves like the pre-resolution data.
-	ClientIP    string // real client behind proxy hops, when known
-	UAClass     string // internal/uaclass class of the User-Agent
-	IsDuplicate bool   // repeats an ancestor span's failure; not a new request
-	IsRootCause bool   // error span with no erroring child
-	HasUpstream bool   // an ingress span that had a child in another service
-	BadActor    string // reason this event is attributed to a bad actor (see MarkBadActors); empty if not
+	ClientIP      string   // real client behind proxy hops, when known
+	UAClass       string   // internal/uaclass class of the User-Agent
+	IsDuplicate   bool     // repeats an ancestor span's failure; not a new request
+	IsRootCause   bool     // error span with no erroring child
+	HasUpstream   bool     // an ingress span that had a child in another service
+	TraceServices []string // every service with an error span in this event's trace (includes its own)
+	BadActor      string   // reason this event is attributed to a bad actor (see MarkBadActors); empty if not
 }
 
 // Config controls feature and label windows. A zero Config receives the

internal/features/spike.go

@@ -29,13 +29,14 @@ func DefaultSpikeConfig() SpikeConfig {
 
 // PatternDelta is one error pattern's contribution to a spike.
 type PatternDelta struct {
-	Signature    string  `json:"signature"`
-	Count        int     `json:"count"`
-	BaselineMean float64 `json:"baselineMean"`
-	Excess       float64 `json:"excess"`
-	Novel        bool    `json:"novel"`             // never seen in the baseline
-	Clients      int     `json:"clients,omitempty"` // distinct resolved client IPs in the current window
-	Example      Event   `json:"example"`
+	Signature    string   `json:"signature"`
+	Count        int      `json:"count"`
+	BaselineMean float64  `json:"baselineMean"`
+	Excess       float64  `json:"excess"`
+	Novel        bool     `json:"novel"`              // never seen in the baseline
+	Clients      int      `json:"clients,omitempty"`  // distinct resolved client IPs in the current window
+	Services     []string `json:"services,omitempty"` // services with an error in the same requests, sorted
+	Example      Event    `json:"example"`
 }
 
 type Spike struct {
@@ -82,10 +83,11 @@ func DetectSpikes(events []Event, at time.Time, cfg SpikeConfig) []Spike {
 	}
 
 	type agg struct {
-		cur     int
-		base    []int // per baseline window
-		example Event
-		clients map[string]struct{}
+		cur      int
+		base     []int // per baseline window
+		example  Event
+		clients  map[string]struct{}
+		services map[string]struct{}
 	}
 	type svc struct {
 		cur      int
@@ -129,6 +131,13 @@ func DetectSpikes(events []Event, at time.Time, cfg SpikeConfig) []Spike {
 			s.cur++
 			p.cur++
 			p.example = e
+			if p.services == nil {
+				p.services = map[string]struct{}{}
+			}
+			p.services[name] = struct{}{}
+			for _, sv := range e.TraceServices {
+				p.services[sv] = struct{}{}
+			}
 			if e.ClientIP != "" {
 				if p.clients == nil {
 					p.clients = map[string]struct{}{}
@@ -166,7 +175,7 @@ func DetectSpikes(events []Event, at time.Time, cfg SpikeConfig) []Spike {
 			}
 			spike.Excess += excess
 			spike.Patterns = append(spike.Patterns, PatternDelta{
-				Signature: sig, Count: p.cur, BaselineMean: mean, Excess: excess, Novel: !seen, Example: p.example, Clients: len(p.clients),
+				Signature: sig, Count: p.cur, BaselineMean: mean, Excess: excess, Novel: !seen, Example: p.example, Clients: len(p.clients), Services: sortedKeys(p.services),
 			})
 		}
 		if spike.Excess < float64(cfg.MinExcess) {
@@ -257,3 +266,12 @@ func (s *Suppressor) Filter(spikes []Spike) []Spike {
 	}
 	return out
 }
+
+func sortedKeys(m map[string]struct{}) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}