From f0c8fde12469a9d827a4f4cb8498f3210b400ce2 Mon Sep 17 00:00:00 2001
From: Faisal Kanout <faisal.kanout@elastic.co>
Date: Tue, 26 Nov 2024 10:33:55 +0100
Subject: [PATCH] [Obx-ux-mgmt][Alerting]Mismatch between preview chart and
 rule execution regarding wildcards (#201553)

## Summary
It fixes #186624 by making the preview chat represent the wildcard
correctly. The missing use case was when passing the query without " "


|Tested cases|Note|
|---|---|
|<img width="596" alt="Screenshot 2024-11-25 at 12 04 14"
src="https://github.com/user-attachments/assets/8140d175-9ff3-4d1a-ac72-baf1e7878326">|<img
width="594" alt="Screenshot 2024-11-25 at 12 04 27"
src="https://github.com/user-attachments/assets/cf0eeb97-0fe7-4509-b4db-c8e4b54e0def">We
can't show "NoData" in this case. I tested the same formula in Lens and
got the same results. It's not ideal, but at least we don't have any
data/bars that could mislead the user|


|<img width="596" alt="Screenshot 2024-11-25 at 11 59 53"
src="https://github.com/user-attachments/assets/cc128bd7-f4aa-403a-8c0a-398b36694064">||
|<img width="596" alt="Screenshot 2024-11-25 at 11 59 41"
src="https://github.com/user-attachments/assets/7f4ae425-6c3b-4067-ab45-0e8282ddd901">||
|<img width="596" alt="Screenshot 2024-11-25 at 11 59 28"
src="https://github.com/user-attachments/assets/e2e6dfde-834a-4921-8471-a7270bbd2f9c">||
|<img width="596" alt="Screenshot 2024-11-25 at 11 59 08"
src="https://github.com/user-attachments/assets/6ffc641d-b043-4740-897f-5d4e94adda41">||
|<img width="596" alt="Screenshot 2024-11-25 at 11 58 58"
src="https://github.com/user-attachments/assets/5122e9df-b392-4785-8a2b-5219c818dfed">||
---
 .../rule_condition_chart/helpers.test.ts      | 28 ++++++++++++++++++-
 .../rule_condition_chart/helpers.ts           |  9 +++---
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.test.ts b/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.test.ts
index a4825c11f85cd..0aedbb5723219 100644
--- a/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.test.ts
+++ b/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.test.ts
@@ -75,6 +75,32 @@ const useCases = [
       sourceField: '',
     },
   ],
+  [
+    {
+      aggType: Aggregators.COUNT,
+      field: '',
+      filter: `container.name:container's name-1`,
+      name: '',
+    },
+    {
+      operation: 'count',
+      operationWithField: `count(kql='container.name:container\\'s name-1')`,
+      sourceField: '',
+    },
+  ],
+  [
+    {
+      aggType: Aggregators.COUNT,
+      field: '',
+      filter: 'host.name: host-*',
+      name: '',
+    },
+    {
+      operation: 'count',
+      operationWithField: `count(kql='host.name: host-*')`,
+      sourceField: '',
+    },
+  ],
   [
     {
       aggType: Aggregators.CARDINALITY,
@@ -136,7 +162,7 @@ const useCases = [
     },
     {
       operation: 'counter_rate',
-      operationWithField: `counter_rate(max(system.network.in.bytes), kql='host.name : foo')`,
+      operationWithField: `counter_rate(max(system.network.in.bytes), kql='host.name : "foo"')`,
       sourceField: 'system.network.in.bytes',
     },
   ],
diff --git a/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.ts b/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.ts
index 9eb52af738ea9..30663d02cda72 100644
--- a/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.ts
+++ b/x-pack/plugins/observability_solution/observability/public/components/rule_condition_chart/helpers.ts
@@ -15,15 +15,15 @@ export interface LensOperation {
 }
 
 export const getLensOperationFromRuleMetric = (metric: GenericMetric): LensOperation => {
-  const { aggType, field, filter } = metric;
+  const { aggType, field, filter = '' } = metric;
   let operation: string = aggType;
   const operationArgs: string[] = [];
-  const aggFilter = JSON.stringify(filter || '').replace(/"|\\/g, '');
+  const escapedFilter = filter.replace(/'/g, "\\'");
 
   if (aggType === Aggregators.RATE) {
     return {
       operation: 'counter_rate',
-      operationWithField: `counter_rate(max(${field}), kql='${aggFilter}')`,
+      operationWithField: `counter_rate(max(${field}), kql='${escapedFilter}')`,
       sourceField: field || '',
     };
   }
@@ -45,8 +45,7 @@ export const getLensOperationFromRuleMetric = (metric: GenericMetric): LensOpera
     operationArgs.push('percentile=99');
   }
 
-  if (aggFilter) operationArgs.push(`kql='${aggFilter}'`);
-
+  if (escapedFilter) operationArgs.push(`kql='${escapedFilter}'`);
   return {
     operation,
     operationWithField: `${operation}(${operationArgs.join(', ')})`,