github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

Ensure rule message do not span multiple lines (#62391) (#62481)

Browse source 
Because these messages are used for logging, we should ensure they do
not span multiple lines and confuse log parsers. Since the frontend does
not currently display these newlines, anyway, there is no impact to the
UI.
This commit is contained in:
Ryland Herrick 2020-04-03 14:08:53 -05:00 • committed by GitHub
parent 824050ee50
commit f467b99fa0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 11 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

20
x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.test.ts
View file

@ -28,25 +28,23 @@ describe('buildRuleMessageFactory', () => {
expect(message).toEqual(expect.stringContaining('signals index: "index"'));
});
it('joins message parts with newlines', () => {
it('joins message parts with spaces', () => {
const buildMessage = buildRuleMessageFactory(factoryParams);
const message = buildMessage('my message');
const messageParts = message.split('\n');
expect(messageParts).toContain('my message');
expect(messageParts).toContain('name: "name"');
expect(messageParts).toContain('id: "id"');
expect(messageParts).toContain('rule id: "ruleId"');
expect(messageParts).toContain('signals index: "index"');
expect(message).toEqual(expect.stringContaining('my message '));
expect(message).toEqual(expect.stringContaining(' name: "name" '));
expect(message).toEqual(expect.stringContaining(' id: "id" '));
expect(message).toEqual(expect.stringContaining(' rule id: "ruleId" '));
expect(message).toEqual(expect.stringContaining(' signals index: "index"'));
});
it('joins multiple arguments with newlines', () => {
it('joins multiple arguments with spaces', () => {
const buildMessage = buildRuleMessageFactory(factoryParams);
const message = buildMessage('my message', 'here is more');
const messageParts = message.split('\n');
expect(messageParts).toContain('my message');
expect(messageParts).toContain('here is more');
expect(message).toEqual(expect.stringContaining('my message '));
expect(message).toEqual(expect.stringContaining(' here is more'));
});
it('defaults the rule ID if not provided ', () => {

2
x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.ts
View file

@ -24,4 +24,4 @@ export const buildRuleMessageFactory = ({
`id: "${id}"`,
`rule id: "${ruleId ?? '(unknown rule id)'}"`,
`signals index: "${index}"`,
].join('\n');
].join(' ');

2
x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
View file

@ -126,7 +126,7 @@ export const signalRulesAlertType = ({
'Machine learning rule is missing job id and/or anomaly threshold:',
`job id: "${machineLearningJobId}"`,
`anomaly threshold: "${anomalyThreshold}"`,
].join('\n')
].join(' ')
);
}