From ac896fb886cc378e0093e7bc916c4dc4ed07cb65 Mon Sep 17 00:00:00 2001
From: Melissa Alvarez <melissa.alvarez@elastic.co>
Date: Tue, 2 Apr 2019 11:21:56 +0200
Subject: [PATCH] [ML] Anomaly Explorer - ensure valid syntax after removing
 2nd of 3 filters via icon (#34187) (#34340)

* Remove middle filter value correctly using icons

* remove middle filter value in OR query correctly with icons

* combine operator pattern check
---
 .../kql_filter_bar/__tests__/utils.js          | 18 ++++++++++++++++++
 .../public/components/kql_filter_bar/utils.js  |  3 +++
 2 files changed, 21 insertions(+)

diff --git a/x-pack/plugins/ml/public/components/kql_filter_bar/__tests__/utils.js b/x-pack/plugins/ml/public/components/kql_filter_bar/__tests__/utils.js
index 9d7880eaf4e72..160e1ee26c9a5 100644
--- a/x-pack/plugins/ml/public/components/kql_filter_bar/__tests__/utils.js
+++ b/x-pack/plugins/ml/public/components/kql_filter_bar/__tests__/utils.js
@@ -71,6 +71,24 @@ describe('ML - KqlFilterBar utils', () => {
       expect(result).to.be(expectedOutput);
     });
 
+    it('removes selected fieldName/fieldValue correctly from  AND query string when it is the middle value', () => {
+      const currentQueryString = `http.response.status_code : "400" and http.response.status_code : "200"
+        and http.response.status_code : "300"`;
+      const expectedOutput = 'http.response.status_code : "400" and http.response.status_code : "300"';
+      const result = removeFilterFromQueryString(currentQueryString, fieldName, fieldValue);
+      expect(result).to.be(expectedOutput);
+    });
+
+    it('removes selected fieldName/fieldValue correctly from OR query string when it is the middle value', () => {
+      const currentQueryString = `http.response.status_code : "400" or http.response.status_code : "200"
+        or http.response.status_code : "300"`;
+      const expectedOutput = 'http.response.status_code : "400" or http.response.status_code : "300"';
+      const result = removeFilterFromQueryString(currentQueryString, fieldName, fieldValue);
+      expect(result).to.be(expectedOutput);
+    });
+
+
+
   });
 
   describe('getQueryPattern', () => {
diff --git a/x-pack/plugins/ml/public/components/kql_filter_bar/utils.js b/x-pack/plugins/ml/public/components/kql_filter_bar/utils.js
index 4619d0b557e07..8fe4361889084 100644
--- a/x-pack/plugins/ml/public/components/kql_filter_bar/utils.js
+++ b/x-pack/plugins/ml/public/components/kql_filter_bar/utils.js
@@ -88,6 +88,9 @@ export function removeFilterFromQueryString(currentQueryString, fieldName, field
   // match 'and' or 'or' at the start/end of the string
   const endPattern = /\s(and|or)\s*$/ig;
   const startPattern = /^\s*(and|or)\s/ig;
+  // If string has a double operator (e.g. tag:thing or or tag:other) remove and replace with the first occurring operator
+  const invalidOperatorPattern = /\s+(and|or)\s+(and|or)\s+/ig;
+  newQueryString = newQueryString.replace(invalidOperatorPattern, ' $1 ');
   // If string starts/ends with 'and' or 'or' remove that as that is illegal kuery syntax
   newQueryString = newQueryString.replace(endPattern, '');
   newQueryString = newQueryString.replace(startPattern, '');