[8.16] [Custom threshold] Fix leading wildcard issue on the custom threshold alert details page (#206615) (#207037)

# Backport This will backport the following commits from `main` to `8.16`: - [[Custom threshold] Fix leading wildcard issue on the custom threshold alert details page (#206615)](https://github.com/elastic/kibana/pull/206615)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) \n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Maryam Saeidi <maryam.saeidi@elastic.co>"}},{"url":"https://github.com/elastic/kibana/pull/206966","number":206966,"branch":"8.17","state":"OPEN"}]}] BACKPORT--> --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-04-24 01:38:56 -04:00 · 2025-01-17 12:50:23 +01:00 · 2025-01-17 12:50:23 +01:00 · 0f5fe605ac
commit 0f5fe605ac
parent 84a8b8c142
6 changed files with 92 additions and 4 deletions
--- a/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/alert_details_app_section/helpers/log_rate_analysis_query.test.ts
+++ b/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/alert_details_app_section/helpers/log_rate_analysis_query.test.ts
@ -118,6 +118,12 @@ describe('buildEsQuery', () => {
  ];

  test.each(testData)('should generate correct es query for $title', ({ alert, params }) => {
-    expect(getLogRateAnalysisEQQuery(alert, params)).toMatchSnapshot();
+    expect(
+      getLogRateAnalysisEQQuery(alert, params, {
+        allowLeadingWildcards: true,
+        queryStringOptions: {},
+        ignoreFilterIfFieldNotInIndex: false,
+      })
+    ).toMatchSnapshot();
  });
 });
--- a/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/alert_details_app_section/helpers/log_rate_analysis_query.ts
+++ b/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/alert_details_app_section/helpers/log_rate_analysis_query.ts
@ -7,6 +7,7 @@

 import { get } from 'lodash';
 import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
+import { EsQueryConfig } from '@kbn/es-query';
 import { getGroupFilters } from '../../../../../../common/custom_threshold_rule/helpers/get_group';
 import { Aggregators } from '../../../../../../common/custom_threshold_rule/types';
 import { buildEsQuery } from '../../../../../utils/build_es_query';
@ -33,7 +34,8 @@ const getKuery = (metrics: CustomThresholdExpressionMetric[], filter?: string) =

 export const getLogRateAnalysisEQQuery = (
  alert: TopAlert<Record<string, any>>,
-  params: CustomThresholdRuleTypeParams
+  params: CustomThresholdRuleTypeParams,
+  config: EsQueryConfig
 ): QueryDslQueryContainer | undefined => {
  // We only show log rate analysis for one condition with one count aggregation
  if (
@ -50,6 +52,7 @@ export const getLogRateAnalysisEQQuery = (
  const boolQuery = buildEsQuery({
    kuery: getKuery(params.criteria[0].metrics, optionalFilter),
    filters: groupByFilters,
+    config,
  });

  return boolQuery;
--- a/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/alert_details_app_section/log_rate_analysis.test.tsx
+++ b/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/alert_details_app_section/log_rate_analysis.test.tsx
@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render } from '@testing-library/react';
+import { COMPARATORS } from '@kbn/alerting-comparators';
+import { uiSettingsServiceMock } from '@kbn/core-ui-settings-browser-mocks';
+import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
+import { Aggregators } from '../../../../../common/custom_threshold_rule/types';
+import {
+  buildCustomThresholdAlert,
+  buildCustomThresholdRule,
+} from '../../mocks/custom_threshold_rule';
+import { kibanaStartMock } from '../../../../utils/kibana_react.mock';
+import { CustomThresholdAlert } from '../types';
+import { LogRateAnalysis } from './log_rate_analysis';
+
+describe('AlertDetailsAppSection', () => {
+  const renderComponent = (alert: Partial<CustomThresholdAlert> = {}) => {
+    return render(
+      <IntlProvider locale="en">
+        <LogRateAnalysis
+          alert={buildCustomThresholdAlert(alert)}
+          rule={{
+            ...buildCustomThresholdRule(),
+            params: {
+              ...buildCustomThresholdRule().params,
+              criteria: [
+                {
+                  comparator: COMPARATORS.GREATER_THAN,
+                  metrics: [
+                    {
+                      name: 'A',
+                      aggType: Aggregators.COUNT,
+                      filter: 'host.name: *host',
+                    },
+                  ],
+                  threshold: [2000],
+                  timeSize: 15,
+                  timeUnit: 'm',
+                },
+              ],
+            },
+          }}
+          dataView={{}}
+          services={{
+            ...kibanaStartMock.startContract().services,
+            uiSettings: {
+              ...uiSettingsServiceMock.createStartContract(),
+              get: jest.fn().mockReturnValue(true),
+            },
+          }}
+        />
+      </IntlProvider>
+    );
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  // To avoid https://github.com/elastic/kibana/issues/206588
+  it('should render LogRateAnalysis without throwing error', async () => {
+    expect(renderComponent).not.toThrowError();
+  });
+});
--- a/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/alert_details_app_section/log_rate_analysis.tsx
+++ b/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/alert_details_app_section/log_rate_analysis.tsx
@ -15,6 +15,7 @@ import {
 } from '@kbn/aiops-log-rate-analysis/log_rate_analysis_type';
 import { getLogRateAnalysisParametersFromAlert } from '@kbn/aiops-log-rate-analysis/get_log_rate_analysis_parameters_from_alert';
 import { LogRateAnalysisContent, type LogRateAnalysisResultsData } from '@kbn/aiops-plugin/public';
+import { getEsQueryConfig } from '@kbn/data-service';
 import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
@ -51,6 +52,7 @@ export function LogRateAnalysis({
      ObservabilityAIAssistantContextualInsight,
      getContextualInsightMessages,
    },
+    uiSettings,
  } = services;
  const [esSearchQuery, setEsSearchQuery] = useState<QueryDslQueryContainer | undefined>();
  const [logRateAnalysisParams, setLogRateAnalysisParams] = useState<
@ -59,12 +61,16 @@ export function LogRateAnalysis({
  >();

  useEffect(() => {
-    const esSearchRequest = getLogRateAnalysisEQQuery(alert, rule.params);
+    const esSearchRequest = getLogRateAnalysisEQQuery(
+      alert,
+      rule.params,
+      getEsQueryConfig(uiSettings)
+    );

    if (esSearchRequest) {
      setEsSearchQuery(esSearchRequest);
    }
-  }, [alert, rule.params]);
+  }, [alert, rule.params, uiSettings]);

  const { timeRange, windowParameters } = useMemo(() => {
    const alertStartedAt = moment(alert.start).toISOString();
--- a/x-pack/plugins/observability_solution/observability/public/plugin.mock.tsx
+++ b/x-pack/plugins/observability_solution/observability/public/plugin.mock.tsx
@ -10,6 +10,7 @@ import { mockCasesContract } from '@kbn/cases-plugin/public/mocks';
 import { chartPluginMock } from '@kbn/charts-plugin/public/mocks';
 import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { contentManagementMock } from '@kbn/content-management-plugin/public/mocks';
+import { observabilityAIAssistantPluginMock } from '@kbn/observability-ai-assistant-plugin/public/mock';
 import { sharePluginMock } from '@kbn/share-plugin/public/mocks';
 import { unifiedSearchPluginMock } from '@kbn/unified-search-plugin/public/mocks';
 import type { AlertActionsProps } from '@kbn/triggers-actions-ui-plugin/public/types';
@ -128,6 +129,7 @@ export const observabilityPublicPluginsStartMock = {
      dataViews: dataViews.createStart(),
      discover: null,
      lens: lensPluginMock.createStartContract(),
+      observabilityAIAssistant: observabilityAIAssistantPluginMock.createStartContract(),
      share: sharePluginMock.createStartContract(),
      triggersActionsUi: triggersActionsUiStartMock.createStart(),
      unifiedSearch: unifiedSearchPluginMock.createStartContract(),
--- a/x-pack/plugins/observability_solution/observability/tsconfig.json
+++ b/x-pack/plugins/observability_solution/observability/tsconfig.json
@ -114,6 +114,7 @@
    "@kbn/core-ui-settings-server-mocks",
    "@kbn/es-types",
    "@kbn/logging-mocks",
+    "@kbn/data-service"
  ],
  "exclude": ["target/**/*"]
 }