entities form filter

elastic · Aug 30, 2023 · 2f7625f · 2f7625f
1 parent b9213df
commit 2f7625f
Show file tree

Hide file tree

Showing 3 changed files with 100 additions and 0 deletions.
diff --git a/x-pack/plugins/stack_alerts/public/rule_types/geo_containment/expression/entity_form.tsx b/x-pack/plugins/stack_alerts/public/rule_types/geo_containment/expression/entity_form.tsx
@@ -13,6 +13,7 @@ import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
 import type { UnifiedSearchPublicPluginStart } from '@kbn/unified-search-plugin/public';
 import { DataViewSelect } from './data_view_select';
 import { SingleFieldSelect } from './single_field_select';
+import { QueryInput } from './query_input';
 
 export const ENTITY_GEO_FIELD_TYPES = ['geo_point', 'geo_shape'];
 
@@ -42,6 +43,7 @@ interface Props {
   setDateField: (fieldName: string) => void;
   setEntityField: (fieldName: string) => void;
   setGeoField: (fieldName: string) => void;
+  setQuery: (query: Query) => void;
   unifiedSearch: UnifiedSearchPublicPluginStart;
 }
 
@@ -244,6 +246,25 @@ export const EntityForm = (props: Props) => {
                 fields={entityFields}
               />
             </EuiFormRow>
+
+            <EuiFormRow
+              error={entityFieldError}
+              isInvalid={Boolean(entityFieldError)}
+              helpText={i18n.translate('xpack.stackAlerts.geoContainment.filterHelpText', {
+                defaultMessage: 'Add a filter to narrow entities.',
+              })}
+              label={i18n.translate('xpack.stackAlerts.geoContainment.filterLabel', {
+                defaultMessage: 'Filter',
+              })}
+            >
+              <QueryInput
+                dataView={dataView}
+                onChange={(query: Query) => {
+                  props.setQuery(query);
+                }}
+                query={props.ruleParams.indexQuery}
+              />
+            </EuiFormRow>
           </>
         )}
       </EuiSkeletonText>

diff --git a/x-pack/plugins/stack_alerts/public/rule_types/geo_containment/expression/expression.tsx b/x-pack/plugins/stack_alerts/public/rule_types/geo_containment/expression/expression.tsx
@@ -28,6 +28,7 @@ export const GeoContainmentRuleTypeExpression: React.FunctionComponent<
         setDateField={(fieldName: string) => props.setRuleParams('dateField', fieldName)}
         setEntityField={(fieldName: string) => props.setRuleParams('entity', fieldName)}
         setGeoField={(fieldName: string) => props.setRuleParams('geoField', fieldName)}
+        setQuery={(query: Query) => props.setRuleParams('indexQuery', query)}
         unifiedSearch={props.unifiedSearch}
       />
 

diff --git a/x-pack/plugins/stack_alerts/public/rule_types/geo_containment/expression/query_input.tsx b/x-pack/plugins/stack_alerts/public/rule_types/geo_containment/expression/query_input.tsx
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useEffect, useState } from 'react';
+import { QueryStringInput } from '@kbn/unified-search-plugin/public';
+import { useKibana } from '@kbn/kibana-react-plugin/public';
+import { fromKueryExpression, luceneStringToDsl } from '@kbn/es-query';
+import { STACK_ALERTS_FEATURE_ID } from '../../../../common/constants';
+
+function validateQuery(query: Query) {
+  try {
+    query.language === 'kuery' ? fromKueryExpression(query.query) : luceneStringToDsl(query.query);
+  } catch (err) {
+    return false;
+  }
+  return true;
+}
+
+interface Props {
+  dataView?: DataView;
+  onChange: (query: Query) => void;
+  query?: Query;
+}
+
+export const QueryInput = (props: Props) => {
+  const { data, dataViews, docLinks, http, notifications, storage, uiSettings, unifiedSearch, usageCollection } =
+    useKibana<{
+      data: DataPublicPluginStart;
+      dataViews: DataViewsPublicPluginStart;
+      docLinks: DocLinksStart;
+      http: HttpSetup;
+      notifications: CoreStart['notifications'];
+      uiSettings: IUiSettingsClient;
+      storage: IStorageWrapper;
+      unifiedSearch: UnifiedSearchPublicPluginStart;
+      usageCollection: UsageCollectionStart;
+    }>().services;
+
+  const [localQuery, setLocalQuery] = useState<Query>(
+    props.query || {
+      query: '',
+      language: 'kuery',
+    }
+  );
+
+  return (
+    <QueryStringInput
+      disableAutoFocus
+      bubbleSubmitEvent
+      indexPatterns={props.dataView ? [props.dataView] : []}
+      query={localQuery}
+      onChange={(query) => {
+        if (query.language) {
+          setLocalQuery(query);
+          if (validateQuery(query)) {
+            props.onChange(query);
+          }
+        }
+      }}
+      appName={STACK_ALERTS_FEATURE_ID}
+      deps={{
+        unifiedSearch,
+        notifications,
+        http,
+        docLinks,
+        uiSettings,
+        data,
+        dataViews,
+        storage,
+        usageCollection,
+      }}
+    />
+  );
+}