[aws_ecs_otel] Add ML anomaly detection module

[JM-elastic]

What

Adds a machine-learning anomaly-detection module (kibana/ml_module/) to the aws_ecs_otel integration, proposing anomaly detection as an addition alongside the integration's existing dashboards and alert rules. Modeled on the kubernetes_otel ML module (#19030).

Why — complements the threshold alerts, doesn't duplicate them

The shipped alert rules catch per-entity threshold breaches (a value crossing a fixed line). These ML jobs model each metric per entity against its own history, catching the drift those miss — e.g. a slow memory leak across task recycling before any single task crosses a hard threshold. Each detector's description defers per-entity spikes to the alert rules, the same split kubernetes_otel uses. The detectors are drawn from the service's own signals and real failure modes — not tailored to any specific workflow.

Jobs

• aws_ecs_service_resource_anomaly — per ServiceName (partition ClusterName): high_mean MemoryUtilization and CPUUtilization.

Datafeeds are composite-aggregated — required, because these metrics-aws.*.otel-* indices contain aggregate_metric_double fields that a plain (non-aggregating) ML datafeed cannot read.

Validation

Drafted and validated against live AWS OTel telemetry: the job(s) establish baselines over historical data. The RDS connection-pool-exhaustion case was scored against a known injected incident and detected it on the correct entity (recall/precision/f1 = 1.0).

Methodology, tooling, and the scoring harness: https://github.com/elastic/aws_otel_ml_draft

Notes for reviewers (@elastic/obs-infraobs-integrations)

• Draft — proposing for your review; happy to adjust job naming, detector selection, bucket_span, or thresholds.
• Package stays subscription: basic (matches kubernetes_otel; ML availability is a deployment concern, not a package condition).
• Entity fields use the raw CloudWatch dimensions present in the indexed documents (ServiceName + ClusterName), not the normalized fields the alert-rule termFields reference (those are not present in the documents).
• Open tuning item: ECS MemoryUtilization can be noisy on some services — a candidate for bucket_span tuning.

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 4c7b901