Skip to content

Commit 9ea601f

Browse files
kibanamachinemattkime
kibanamachine
and
mattkime
authored
[8.14] es query rule - get time field from data view instead of rule (#182883) (#183001)
# Backport This will backport the following commits from `main` to `8.14`: - [es query rule - get time field from data view instead of rule (#182883)](#182883) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Matthew Kime","email":"matt@mattki.me"},"sourceCommit":{"committedDate":"2024-05-08T22:00:24Z","message":"es query rule - get time field from data view instead of rule (#182883)\n\n## Summary\r\n\r\nPreviously it was possible to create a rule with a data view and change\r\nthe data view but the previous time field would still be referenced. Now\r\nthe time field is always pulled from the current data view.\r\n\r\n\r\nCloses https://github.com/elastic/kibana/issues/182879\r\n\r\n#### Release note\r\n\r\nFixed issue where an ES query rule could be created with a data view,\r\nthen the data view is changed but there's still a reference to the\r\nprevious data view's timestamp field. Now the timestamp field is always\r\ntaken from the currently configured data view.\r\n\r\n---------\r\n\r\nCo-authored-by: Davis McPhee <davis.mcphee@elastic.co>","sha":"bc103c7016245901a04fc4921c1b213a4fbe2695","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:DataDiscovery","backport:prev-minor","v8.15.0"],"title":"es query rule - get time field from data view instead of rule","number":182883,"url":"https://github.com/elastic/kibana/pull/182883","mergeCommit":{"message":"es query rule - get time field from data view instead of rule (#182883)\n\n## Summary\r\n\r\nPreviously it was possible to create a rule with a data view and change\r\nthe data view but the previous time field would still be referenced. Now\r\nthe time field is always pulled from the current data view.\r\n\r\n\r\nCloses https://github.com/elastic/kibana/issues/182879\r\n\r\n#### Release note\r\n\r\nFixed issue where an ES query rule could be created with a data view,\r\nthen the data view is changed but there's still a reference to the\r\nprevious data view's timestamp field. Now the timestamp field is always\r\ntaken from the currently configured data view.\r\n\r\n---------\r\n\r\nCo-authored-by: Davis McPhee <davis.mcphee@elastic.co>","sha":"bc103c7016245901a04fc4921c1b213a4fbe2695"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.15.0","branchLabelMappingKey":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/182883","number":182883,"mergeCommit":{"message":"es query rule - get time field from data view instead of rule (#182883)\n\n## Summary\r\n\r\nPreviously it was possible to create a rule with a data view and change\r\nthe data view but the previous time field would still be referenced. Now\r\nthe time field is always pulled from the current data view.\r\n\r\n\r\nCloses https://github.com/elastic/kibana/issues/182879\r\n\r\n#### Release note\r\n\r\nFixed issue where an ES query rule could be created with a data view,\r\nthen the data view is changed but there's still a reference to the\r\nprevious data view's timestamp field. Now the timestamp field is always\r\ntaken from the currently configured data view.\r\n\r\n---------\r\n\r\nCo-authored-by: Davis McPhee <davis.mcphee@elastic.co>","sha":"bc103c7016245901a04fc4921c1b213a4fbe2695"}}]}] BACKPORT--> Co-authored-by: Matthew Kime <matt@mattki.me>
1 parent c7f1657 commit 9ea601f

3 files changed

Lines changed: 12 additions & 10 deletions

File tree

‎x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.test.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ const defaultParams: OnlySearchSourceRuleParams = {
5959
excludeHitsFromPreviousRun: true,
6060
aggType: 'count',
6161
groupBy: 'all',
62-
timeField: 'time',
62+
// this should be ignored when using a data view
63+
timeField: 'timeFieldNotFromDataView',
6364
};
6465

6566
describe('fetchSearchSourceQuery', () => {

‎x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -112,18 +112,17 @@ export function updateSearchSource(
112112
alertLimit?: number
113113
): { searchSource: ISearchSource; filterToExcludeHitsFromPreviousRun: Filter | null } {
114114
const isGroupAgg = isGroupAggregation(params.termField);
115-
const timeFieldName = params.timeField || index.timeFieldName;
115+
const timeField = index.getTimeField();
116116

117-
if (!timeFieldName) {
118-
throw new Error('Invalid data view without timeFieldName.');
117+
if (!timeField) {
118+
throw new Error(`Data view with ID ${index.id} no longer contains a time field.`);
119119
}
120120

121121
searchSource.setField('size', isGroupAgg ? 0 : params.size);
122122

123-
const field = index.fields.find((f) => f.name === timeFieldName);
124123
const filters = [
125124
buildRangeFilter(
126-
field!,
125+
timeField,
127126
{ lte: dateEnd, gte: dateStart, format: 'strict_date_optional_time' },
128127
index
129128
),
@@ -135,7 +134,7 @@ export function updateSearchSource(
135134
// add additional filter for documents with a timestamp greater than
136135
// the timestamp of the previous run, so that those documents are not counted twice
137136
filterToExcludeHitsFromPreviousRun = buildRangeFilter(
138-
field!,
137+
timeField,
139138
{ gt: latestTimestamp, format: 'strict_date_optional_time' },
140139
index
141140
);
@@ -150,7 +149,7 @@ export function updateSearchSource(
150149
searchSourceChild.setField('filter', filters as Filter[]);
151150
searchSourceChild.setField('sort', [
152151
{
153-
[timeFieldName]: {
152+
[timeField.name]: {
154153
order: SortDirection.desc,
155154
format: 'strict_date_optional_time||epoch_millis',
156155
},

‎x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.test.ts‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -633,6 +633,7 @@ describe('ruleType', () => {
633633
toSpec: () => {
634634
return { id: 'test-id', title: 'test-title', timeFieldName: 'timestamp', fields: [] };
635635
},
636+
getTimeField: () => dataViewMock.fields[1],
636637
};
637638
const defaultParams: OnlySearchSourceRuleParams = {
638639
size: 100,
@@ -701,12 +702,12 @@ describe('ruleType', () => {
701702

702703
(searchSourceInstanceMock.getField as jest.Mock).mockImplementationOnce((name: string) => {
703704
if (name === 'index') {
704-
return { dataViewMock, timeFieldName: undefined };
705+
return { dataViewMock, getTimeField: () => undefined, id: 1234 };
705706
}
706707
});
707708

708709
await expect(invokeExecutor({ params, ruleServices })).rejects.toThrow(
709-
'Invalid data view without timeFieldName.'
710+
'Data view with ID 1234 no longer contains a time field.'
710711
);
711712
});
712713

@@ -717,6 +718,7 @@ describe('ruleType', () => {
717718
(ruleServices.dataViews.create as jest.Mock).mockResolvedValueOnce({
718719
...dataViewMock.toSpec(),
719720
toSpec: () => dataViewMock.toSpec(),
721+
getTimeField: () => dataViewMock.fields[1],
720722
toMinimalSpec: () => dataViewMock.toSpec(),
721723
});
722724
(searchSourceInstanceMock.getField as jest.Mock).mockImplementation((name: string) => {

0 commit comments

Comments
 (0)