[APM] Services without anomalies have an "unknown" health status

[dgieselaar]

When the transaction duration for a service doesn't exceed the expected bounds from the ML job, no anomaly documents are generated. We use the presence of those anomaly docs to determine a service health status. That means that healthy services are currently reported as "unknown", and only service with actual anomalies (which perhaps should be reported as "warning"?) show a health status.

It is currently not clear if the data we can get from ML allows us to distinguish between:

• services that are reporting non-anomalous data (should be "healthy")
• services where ML cannot figure out whether the data is anomalous or not, perhaps due to lack of data or processing issues (should be "unknown")

[elasticmachine]

Pinging @elastic/apm-ui (Team:apm)

[formgeist]

Good catch @dgieselaar

[dgieselaar]

We should also consider:

• adding a minimum time range for the search that fetches the anomalies.
• improving the API tests for service anomalies for the service inventory/service maps.