[8.17] [OBX-UX-MGMT][BUG] Fix chart in Custom Threshold rule when the field name has slashes (#209263) (#209712)

# Backport This will backport the following commits from `main` to `8.17`: - [[OBX-UX-MGMT][BUG] Fix chart in Custom Threshold rule when the field name has slashes (#209263)](https://github.com/elastic/kibana/pull/209263)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) \n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Faisal Kanout <faisal.kanout@elastic.co>"}},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/209523","number":209523,"state":"MERGED","mergeCommit":{"sha":"f6e739b19ec45b8f6eba3e9d4935039f5038f797","message":"[8.18] [OBX-UX-MGMT][BUG] Fix chart in Custom Threshold rule when the field name has slashes (#209263) (#209523)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.18`:\n- [[OBX-UX-MGMT][BUG] Fix chart in Custom Threshold rule when the field\nname has slashes\n(#209263)](https://github.com/elastic/kibana/pull/209263)\n\n\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Faisal Kanout <faisal.kanout@elastic.co>"}},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/209263","number":209263,"mergeCommit":{"message":"[OBX-UX-MGMT][BUG] Fix chart in Custom Threshold rule when the field name has slashes (#209263)\n\n## Summary\r\n\r\nIt fixes #201511\r\n\r\n<img width=\"680\" alt=\"Screenshot 2025-02-03 at 12 51 56\"\r\nsrc=\"https://github.com/user-attachments/assets/fe3fa780-c50d-4906-8c5b-6758fea5fe9c\"\r\n/>\r\n\r\n### Release notes:\r\nFix the preview chart in the Custom Threshold rule creation form when\r\nthe field name has slashes","sha":"ed333de757b67bfeb1e68ec33b64bb238ecc21eb"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/209524","number":209524,"state":"MERGED","mergeCommit":{"sha":"f228a0643970bb9923f7d5f4361ddf123cc2c94e","message":"[8.x] [OBX-UX-MGMT][BUG] Fix chart in Custom Threshold rule when the field name has slashes (#209263) (#209524)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.x`:\n- [[OBX-UX-MGMT][BUG] Fix chart in Custom Threshold rule when the field\nname has slashes\n(#209263)](https://github.com/elastic/kibana/pull/209263)\n\n\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Faisal Kanout <faisal.kanout@elastic.co>"}}]}] BACKPORT-->
2025-04-24 01:38:56 -04:00 · 2025-02-06 14:20:57 +03:00 · 2025-02-06 14:20:57 +03:00 · 39457b433d
commit 39457b433d
parent 484eeeed67
2 changed files with 65 additions and 27 deletions
--- a/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.test.ts
+++ b/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.test.ts
@ -19,8 +19,8 @@ const useCases = [
    },
    {
      operation: 'sum',
-      operationWithField: 'sum(system.cpu.user.pct)',
-      sourceField: 'system.cpu.user.pct',
+      operationWithField: 'sum("system.cpu.user.pct")',
+      sourceField: '"system.cpu.user.pct"',
    },
  ],
  [
@ -32,8 +32,8 @@ const useCases = [
    },
    {
      operation: 'max',
-      operationWithField: 'max(system.cpu.user.pct)',
-      sourceField: 'system.cpu.user.pct',
+      operationWithField: 'max("system.cpu.user.pct")',
+      sourceField: '"system.cpu.user.pct"',
    },
  ],
  [
@ -45,8 +45,8 @@ const useCases = [
    },
    {
      operation: 'min',
-      operationWithField: 'min(system.cpu.user.pct)',
-      sourceField: 'system.cpu.user.pct',
+      operationWithField: 'min("system.cpu.user.pct")',
+      sourceField: '"system.cpu.user.pct"',
    },
  ],
  [
@ -58,8 +58,8 @@ const useCases = [
    },
    {
      operation: 'average',
-      operationWithField: 'average(system.cpu.user.pct)',
-      sourceField: 'system.cpu.user.pct',
+      operationWithField: 'average("system.cpu.user.pct")',
+      sourceField: '"system.cpu.user.pct"',
    },
  ],
  [
@ -72,7 +72,33 @@ const useCases = [
    {
      operation: 'count',
      operationWithField: `count(kql='system.cpu.user.pct: *')`,
-      sourceField: '',
+      sourceField: '""',
+    },
+  ],
+  [
+    {
+      aggType: Aggregators.COUNT,
+      field: '',
+      filter: `container.name:container's name-1`,
+      name: '',
+    },
+    {
+      operation: 'count',
+      operationWithField: `count(kql='container.name:container\\'s name-1')`,
+      sourceField: '""',
+    },
+  ],
+  [
+    {
+      aggType: Aggregators.COUNT,
+      field: '',
+      filter: 'host.name: host-*',
+      name: '',
+    },
+    {
+      operation: 'count',
+      operationWithField: `count(kql='host.name: host-*')`,
+      sourceField: '""',
    },
  ],
  [
@ -84,8 +110,21 @@ const useCases = [
    },
    {
      operation: 'unique_count',
-      operationWithField: 'unique_count(system.cpu.user.pct)',
-      sourceField: 'system.cpu.user.pct',
+      operationWithField: 'unique_count("system.cpu.user.pct")',
+      sourceField: '"system.cpu.user.pct"',
+    },
+  ],
+  [
+    {
+      aggType: Aggregators.CARDINALITY,
+      field: 'field.name/with/slashes',
+      filter: '',
+      name: '',
+    },
+    {
+      operation: 'unique_count',
+      operationWithField: 'unique_count("field.name/with/slashes")',
+      sourceField: '"field.name/with/slashes"',
    },
  ],
  [
@ -97,8 +136,8 @@ const useCases = [
    },
    {
      operation: 'percentile',
-      operationWithField: 'percentile(system.cpu.user.pct, percentile=95)',
-      sourceField: 'system.cpu.user.pct',
+      operationWithField: 'percentile("system.cpu.user.pct", percentile=95)',
+      sourceField: '"system.cpu.user.pct"',
    },
  ],
  [
@ -110,8 +149,8 @@ const useCases = [
    },
    {
      operation: 'percentile',
-      operationWithField: 'percentile(system.cpu.user.pct, percentile=99)',
-      sourceField: 'system.cpu.user.pct',
+      operationWithField: 'percentile("system.cpu.user.pct", percentile=99)',
+      sourceField: '"system.cpu.user.pct"',
    },
  ],
  [
@ -123,8 +162,8 @@ const useCases = [
    },
    {
      operation: 'counter_rate',
-      operationWithField: `counter_rate(max(system.network.in.bytes), kql='')`,
-      sourceField: 'system.network.in.bytes',
+      operationWithField: `counter_rate(max("system.network.in.bytes"), kql='')`,
+      sourceField: '"system.network.in.bytes"',
    },
  ],
  [
@ -136,8 +175,8 @@ const useCases = [
    },
    {
      operation: 'counter_rate',
-      operationWithField: `counter_rate(max(system.network.in.bytes), kql='host.name : foo')`,
-      sourceField: 'system.network.in.bytes',
+      operationWithField: `counter_rate(max("system.network.in.bytes"), kql='host.name : "foo"')`,
+      sourceField: '"system.network.in.bytes"',
    },
  ],
 ];
--- a/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.ts
+++ b/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.ts
@ -15,16 +15,16 @@ export interface LensOperation {
 }

 export const getLensOperationFromRuleMetric = (metric: GenericMetric): LensOperation => {
-  const { aggType, field, filter } = metric;
+  const { aggType, field, filter = '' } = metric;
  let operation: string = aggType;
  const operationArgs: string[] = [];
-  const aggFilter = JSON.stringify(filter || '').replace(/"|\\/g, '');
+  const escapedFilter = filter.replace(/\\/g, '\\\\').replace(/'/g, "\\'");

  if (aggType === Aggregators.RATE) {
    return {
      operation: 'counter_rate',
-      operationWithField: `counter_rate(max(${field}), kql='${aggFilter}')`,
-      sourceField: field || '',
+      operationWithField: `counter_rate(max("${field}"), kql='${escapedFilter}')`,
+      sourceField: `"${field}"` || '',
    };
  }

@ -34,7 +34,7 @@ export const getLensOperationFromRuleMetric = (metric: GenericMetric): LensOpera
  if (aggType === Aggregators.COUNT) operation = 'count';

  if (field) {
-    operationArgs.push(field);
+    operationArgs.push(`"${field}"`);
  }

  if (aggType === Aggregators.P95) {
@ -45,12 +45,11 @@ export const getLensOperationFromRuleMetric = (metric: GenericMetric): LensOpera
    operationArgs.push('percentile=99');
  }

-  if (aggFilter) operationArgs.push(`kql='${aggFilter}'`);
-
+  if (escapedFilter) operationArgs.push(`kql='${escapedFilter}'`);
  return {
    operation,
    operationWithField: `${operation}(${operationArgs.join(', ')})`,
-    sourceField: field || '',
+    sourceField: `"${field}"` || '',
  };
 };