[Security Solution][Exceptions Table] - Fix exceptions table search by name#88701
[Security Solution][Exceptions Table] - Fix exceptions table search by name#88701yctercero merged 26 commits intoelastic:masterfrom
Conversation
| }, | ||
| name: { | ||
| type: 'keyword', | ||
| fields: { |
There was a problem hiding this comment.
FYI: Left the property type as is because exception list type is either detections or endpoint and I believe we use the standard ES tokenizer which tokenizes based on word boundaries.
…ed by name which is now both keyword and text.
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
|
Pinging @elastic/siem (Team:SIEM) |
|
@elasticmachine merge upstream |
|
|
||
| return { [defaultSearchTerm]: searchValue }; | ||
| } catch { | ||
| return { [defaultSearchTerm]: searchValue }; |
There was a problem hiding this comment.
When does this try catch blow up? Is it because it's a reduce without a default value going on here? ;-)
If so, I rarely use reduce without a default value to avoid the situation altogether. As a maintainer this looks highly suspect if I don't know when/why this try/catch is going to be hit without comments.
I'll look at the unit tests next to be like, "Is there a unit test that expresses the try/catch so I can see if it's needed and why?"
There was a problem hiding this comment.
So the catch clause I added because of the query.ast.getFieldClauses() throws an error if the user attempts to search a term that is not defined in the schema like not_a_property:something.
There was a problem hiding this comment.
But oof good catch on the reduce sans default value there. I'll update that and add a test to express when the try/catch blows.
EDIT: it does have the default value - filterOptions
|
Known test failures - those won't pass till we figure out changes needed to SO _find filter parsing. |
|
|
||
| cy.get(EXCEPTIONS_TABLE_SHOWING_LISTS).should('have.text', `Showing 1 list`); | ||
| }); | ||
| }); |
FrankHassanabad
left a comment
There was a problem hiding this comment.
Gave it a re-look, everything is great! 👍
💛 Build succeeded, but was flaky
Test FailuresKibana Pipeline / general / "before all" hook for "should contain notes".Timeline notes tab "before all" hook for "should contain notes"Stack TraceKibana Pipeline / general / "after all" hook for "should contain notes".Timeline notes tab "after all" hook for "should contain notes"Stack TraceMetrics [docs]Module Count
Async chunks
Page load bundle
Saved Objects .kibana field count
History
To update your PR or re-run it, just comment with: |
…y name (elastic#88701) Addresses elastic#88450 Issue Search was not working as expected was because the exception list property name is mapped as a keyword - this means it does not get tokenized which is why one word searches were working but if the name included multiple words and was partial, it was not filtering properly.
…y name (#88701) (#91255) Addresses #88450 Issue Search was not working as expected was because the exception list property name is mapped as a keyword - this means it does not get tokenized which is why one word searches were working but if the name included multiple words and was partial, it was not filtering properly.
Summary
Addresses #88450
Issue
It seems that the exceptions list table search was not filtering out. Turns out when using a search likelist_id:SOME_LIST_IDorcreated_by:SOMEONEorname:SOME_NAMEworks, but not when someone just typesExample list namewhich should filter by list name.So initially thought that there was an issue with the way we were parsing the search term. Thanks to help from @FrankHassanabad found that the reason search was not working as expected was because the exception list property
nameis mapped as akeyword- this means it does not get tokenized which is why one word searches were working but if the name included multiple words and was partial, it was not filtering properly.Solution
Switched to using EUI's
SearchBarcomponent which does the parsing of the text for us and updated the mappings for exception listnameto includetext.Searching by multiple fields (these are AND-ed)
Searching multiple words (these are OR-ed)
Exact match
Checklist