fixes

internal/features/spike.go

@@ -29,13 +29,14 @@ func DefaultSpikeConfig() SpikeConfig {
 
 // PatternDelta is one error pattern's contribution to a spike.
 type PatternDelta struct {
-	Signature    string  `json:"signature"`
-	Count        int     `json:"count"`
-	BaselineMean float64 `json:"baselineMean"`
-	Excess       float64 `json:"excess"`
-	Novel        bool    `json:"novel"`             // never seen in the baseline
-	Clients      int     `json:"clients,omitempty"` // distinct resolved client IPs in the current window
-	Example      Event   `json:"example"`
+	Signature    string   `json:"signature"`
+	Count        int      `json:"count"`
+	BaselineMean float64  `json:"baselineMean"`
+	Excess       float64  `json:"excess"`
+	Novel        bool     `json:"novel"`              // never seen in the baseline
+	Clients      int      `json:"clients,omitempty"`  // distinct resolved client IPs in the current window
+	Services     []string `json:"services,omitempty"` // services with an error in the same requests, sorted
+	Example      Event    `json:"example"`
 }
 
 type Spike struct {
@@ -82,10 +83,11 @@ func DetectSpikes(events []Event, at time.Time, cfg SpikeConfig) []Spike {
 	}
 
 	type agg struct {
-		cur     int
-		base    []int // per baseline window
-		example Event
-		clients map[string]struct{}
+		cur      int
+		base     []int // per baseline window
+		example  Event
+		clients  map[string]struct{}
+		services map[string]struct{}
 	}
 	type svc struct {
 		cur      int
@@ -129,6 +131,13 @@ func DetectSpikes(events []Event, at time.Time, cfg SpikeConfig) []Spike {
 			s.cur++
 			p.cur++
 			p.example = e
+			if p.services == nil {
+				p.services = map[string]struct{}{}
+			}
+			p.services[name] = struct{}{}
+			for _, sv := range e.TraceServices {
+				p.services[sv] = struct{}{}
+			}
 			if e.ClientIP != "" {
 				if p.clients == nil {
 					p.clients = map[string]struct{}{}
@@ -166,7 +175,7 @@ func DetectSpikes(events []Event, at time.Time, cfg SpikeConfig) []Spike {
 			}
 			spike.Excess += excess
 			spike.Patterns = append(spike.Patterns, PatternDelta{
-				Signature: sig, Count: p.cur, BaselineMean: mean, Excess: excess, Novel: !seen, Example: p.example, Clients: len(p.clients),
+				Signature: sig, Count: p.cur, BaselineMean: mean, Excess: excess, Novel: !seen, Example: p.example, Clients: len(p.clients), Services: sortedKeys(p.services),
 			})
 		}
 		if spike.Excess < float64(cfg.MinExcess) {
@@ -257,3 +266,12 @@ func (s *Suppressor) Filter(spikes []Spike) []Spike {
 	}
 	return out
 }
+
+func sortedKeys(m map[string]struct{}) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}