[Security Solution] Use search strategy error in timeline

x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx

@@ -112,6 +112,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
   const { timelines: timelinesUi } = useKibana().services;
   const {
     browserFields,
+    dataViewId,
     docValueFields,
     indexPattern,
     runtimeMappings,
@@ -189,6 +190,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
             bulkActions,
             columns,
             dataProviders,
+            dataViewId,
             defaultCellActions,
             deletedEventIds,
             disabledCellActions: FIELDS_WITHOUT_CELL_ACTIONS,

x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx

@@ -175,6 +175,7 @@ export const EqlTabContentComponent: React.FC<Props> = ({
   const { setTimelineFullScreen, timelineFullScreen } = useTimelineFullScreen();
   const {
     browserFields,
+    dataViewId,
     docValueFields,
     loading: loadingSourcerer,
     runtimeMappings,
@@ -208,18 +209,19 @@ export const EqlTabContentComponent: React.FC<Props> = ({
 
   const [isQueryLoading, { events, inspect, totalCount, pageInfo, loadPage, updatedAt, refetch }] =
     useTimelineEvents({
+      dataViewId,
       docValueFields,
       endDate: end,
       eqlOptions: restEqlOption,
+      fields: getTimelineQueryFields(),
+      filterQuery: eqlQuery ?? '',
       id: timelineId,
       indexNames: selectedPatterns,
-      fields: getTimelineQueryFields(),
       language: 'eql',
       limit: itemsPerPage,
-      filterQuery: eqlQuery ?? '',
       runtimeMappings,
-      startDate: start,
       skip: !canQueryTimeline(),
+      startDate: start,
       timerangeKind,
     });
 

x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx

@@ -119,6 +119,7 @@ export const PinnedTabContentComponent: React.FC<Props> = ({
   const {
     browserFields,
     docValueFields,
+    dataViewId,
     loading: loadingSourcerer,
     runtimeMappings,
     selectedPatterns,
@@ -187,6 +188,7 @@ export const PinnedTabContentComponent: React.FC<Props> = ({
       endDate: '',
       id: `pinned-${timelineId}`,
       indexNames: selectedPatterns,
+      dataViewId,
       fields: timelineQueryFields,
       limit: itemsPerPage,
       filterQuery,

x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx

@@ -191,6 +191,7 @@ export const QueryTabContentComponent: React.FC<Props> = ({
   const { setTimelineFullScreen, timelineFullScreen } = useTimelineFullScreen();
   const {
     browserFields,
+    dataViewId,
     docValueFields,
     loading: loadingSourcerer,
     indexPattern,
@@ -282,18 +283,19 @@ export const QueryTabContentComponent: React.FC<Props> = ({
 
   const [isQueryLoading, { events, inspect, totalCount, pageInfo, loadPage, updatedAt, refetch }] =
     useTimelineEvents({
+      dataViewId,
       docValueFields,
       endDate: end,
+      fields: getTimelineQueryFields(),
+      filterQuery: combinedQueries?.filterQuery,
       id: timelineId,
       indexNames: selectedPatterns,
-      fields: getTimelineQueryFields(),
       language: kqlQuery.language,
       limit: itemsPerPage,
-      filterQuery: combinedQueries?.filterQuery,
       runtimeMappings,
-      startDate: start,
       skip: !canQueryTimeline,
       sort: timelineQuerySortField,
+      startDate: start,
       timerangeKind,
     });
 

x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx

@@ -105,6 +105,7 @@ describe('useTimelineEvents', () => {
   const startDate: string = '2020-07-07T08:20:18.966Z';
   const endDate: string = '3000-01-01T00:00:00.000Z';
   const props: UseTimelineEventsProps = {
+    dataViewId: 'data-view-id',
     docValueFields: [],
     endDate: '',
     id: TimelineId.active,

x-pack/plugins/security_solution/public/timelines/containers/index.tsx

@@ -13,7 +13,11 @@ import { Subscription } from 'rxjs';
 
 import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { ESQuery } from '../../../common/typed_json';
-import { isCompleteResponse, isErrorResponse } from '../../../../../../src/plugins/data/common';
+import {
+  DataView,
+  isCompleteResponse,
+  isErrorResponse,
+} from '../../../../../../src/plugins/data/common';
 
 import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features';
 import { inputsModel } from '../../common/store';
@@ -75,6 +79,7 @@ type TimelineResponse<T extends KueryFilterQueryKind> = T extends 'kuery'
   : TimelineEventsAllStrategyResponse;
 
 export interface UseTimelineEventsProps {
+  dataViewId: string | null;
   docValueFields?: DocValueFields[];
   endDate: string;
   eqlOptions?: EqlOptionsSelected;
@@ -127,6 +132,7 @@ const deStructureEqlOptions = (eqlOptions?: EqlOptionsSelected) => ({
 });
 
 export const useTimelineEvents = ({
+  dataViewId,
   docValueFields,
   endDate,
   eqlOptions = undefined,
@@ -207,7 +213,7 @@ export const useTimelineEvents = ({
     loadPage: wrappedLoadPage,
     updatedAt: 0,
   });
-  const { addError, addWarning } = useAppToasts();
+  const { addWarning } = useAppToasts();
 
   // TODO: Once we are past experimental phase this code should be removed
   const ruleRegistryEnabled = useIsExperimentalFeatureEnabled('ruleRegistryEnabled');
@@ -227,6 +233,8 @@ export const useTimelineEvents = ({
             strategy:
               request.language === 'eql' ? 'timelineEqlSearchStrategy' : 'timelineSearchStrategy',
             abortSignal: abortCtrl.current.signal,
+            // we only need the id to throw better errors
+            indexPattern: { id: dataViewId } as unknown as DataView,
           })
           .subscribe({
             next: (response) => {
@@ -265,9 +273,7 @@ export const useTimelineEvents = ({
             },
             error: (msg) => {
               setLoading(false);
-              addError(msg, {
-                title: i18n.FAIL_TIMELINE_EVENTS,
-              });
+              data.search.showError(msg);
               searchSubscription$.current.unsubscribe();
             },
           });
@@ -321,9 +327,9 @@ export const useTimelineEvents = ({
       skip,
       id,
       data.search,
+      dataViewId,
       setUpdated,
       addWarning,
-      addError,
       refetchGrid,
       wrappedLoadPage,
     ]

x-pack/plugins/security_solution/public/timelines/containers/translations.ts

@@ -13,10 +13,3 @@ export const ERROR_TIMELINE_EVENTS = i18n.translate(
     defaultMessage: `An error has occurred on timeline events search`,
   }
 );
-
-export const FAIL_TIMELINE_EVENTS = i18n.translate(
-  'xpack.securitySolution.timelineEvents.failSearchDescription',
-  {
-    defaultMessage: `Failed to run search on timeline events`,
-  }
-);

x-pack/plugins/security_solution/server/lib/sourcerer/routes/index.ts

@@ -72,12 +72,15 @@ export const createSourcererDataViewRoute = (
         const siemDataViewTitle = siemDataView ? siemDataView.title.split(',').sort().join() : '';
         if (siemDataView == null) {
           try {
-            siemDataView = await dataViewService.createAndSave({
-              allowNoIndex: true,
-              id: dataViewId,
-              title: patternListAsTitle,
-              timeFieldName: DEFAULT_TIME_FIELD,
-            });
+            siemDataView = await dataViewService.createAndSave(
+              {
+                allowNoIndex: true,
+                id: dataViewId,
+                title: patternListAsTitle,
+                timeFieldName: DEFAULT_TIME_FIELD,
+              },
+              true
+            );
           } catch (err) {
             const error = transformError(err);
             if (err.name === 'DuplicateDataViewError' || error.statusCode === 409) {

x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx

@@ -101,6 +101,7 @@ export interface TGridIntegratedProps {
   createFieldComponent?: CreateFieldComponentType;
   data?: DataPublicPluginStart;
   dataProviders: DataProvider[];
+  dataViewId?: string | null;
   defaultCellActions?: TGridCellAction[];
   deletedEventIds: Readonly<string[]>;
   disabledCellActions: string[];
@@ -145,6 +146,7 @@ const TGridIntegratedComponent: React.FC<TGridIntegratedProps> = ({
   columns,
   data,
   dataProviders,
+  dataViewId = null,
   defaultCellActions,
   deletedEventIds,
   disabledCellActions,
@@ -236,6 +238,7 @@ const TGridIntegratedComponent: React.FC<TGridIntegratedProps> = ({
       // We rely on entityType to determine Events vs Alerts
       alertConsumers: SECURITY_ALERTS_CONSUMERS,
       data,
+      dataViewId,
       docValueFields,
       endDate: end,
       entityType,

x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx

@@ -86,6 +86,7 @@ export interface TGridStandaloneProps {
   } | null;
   afterCaseSelection?: Function;
   columns: ColumnHeaderOptions[];
+  dataViewId?: string | null;
   defaultCellActions?: TGridCellAction[];
   deletedEventIds: Readonly<string[]>;
   disabledCellActions: string[];
@@ -130,6 +131,7 @@ const TGridStandaloneComponent: React.FC<TGridStandaloneProps> = ({
   casesOwner,
   casePermissions,
   columns,
+  dataViewId = null,
   defaultCellActions,
   deletedEventIds,
   disabledCellActions,
@@ -224,6 +226,7 @@ const TGridStandaloneComponent: React.FC<TGridStandaloneProps> = ({
     loading,
     { consumers, events, updatedAt, loadPage, pageInfo, refetch, totalCount = 0, inspect },
   ] = useTimelineEvents({
+    dataViewId,
     docValueFields: [],
     entityType,
     excludeEcsData: true,

x-pack/plugins/timelines/public/container/index.tsx

@@ -12,6 +12,7 @@ import { useCallback, useEffect, useRef, useState } from 'react';
 import { useDispatch } from 'react-redux';
 import { Subscription } from 'rxjs';
 import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import type { DataView } from '../../../../../src/plugins/data_views/public';
 import {
   clearEventsLoading,
   clearEventsDeleted,
@@ -73,6 +74,7 @@ type TimelineResponse<T extends KueryFilterQueryKind> = TimelineEventsAllStrateg
 export interface UseTimelineEventsProps {
   alertConsumers?: AlertConsumers[];
   data?: DataPublicPluginStart;
+  dataViewId: string | null;
   docValueFields?: DocValueFields[];
   endDate: string;
   entityType: EntityType;
@@ -117,6 +119,7 @@ export const initSortDefault = [
 const NO_CONSUMERS: AlertConsumers[] = [];
 export const useTimelineEvents = ({
   alertConsumers = NO_CONSUMERS,
+  dataViewId,
   docValueFields,
   endDate,
   entityType,
@@ -191,7 +194,7 @@ export const useTimelineEvents = ({
     loadPage: wrappedLoadPage,
     updatedAt: 0,
   });
-  const { addError, addWarning } = useAppToasts();
+  const { addWarning } = useAppToasts();
 
   const timelineSearch = useCallback(
     (request: TimelineRequest<typeof language> | null) => {
@@ -213,6 +216,8 @@ export const useTimelineEvents = ({
                     ? 'timelineEqlSearchStrategy'
                     : 'timelineSearchStrategy',
                 abortSignal: abortCtrl.current.signal,
+                // we only need the id to throw better errors
+                indexPattern: { id: dataViewId } as unknown as DataView,
               }
             )
             .subscribe({
@@ -242,9 +247,7 @@ export const useTimelineEvents = ({
               },
               error: (msg) => {
                 setLoading(false);
-                addError(msg, {
-                  title: i18n.FAIL_TIMELINE_EVENTS,
-                });
+                data.search.showError(msg);
                 searchSubscription$.current.unsubscribe();
               },
             });
@@ -256,7 +259,7 @@ export const useTimelineEvents = ({
       asyncSearch();
       refetch.current = asyncSearch;
     },
-    [skip, data, entityType, setUpdated, addWarning, addError]
+    [skip, data, entityType, dataViewId, setUpdated, addWarning]
   );
 
   useEffect(() => {

x-pack/plugins/timelines/public/container/translations.ts

@@ -13,10 +13,3 @@ export const ERROR_TIMELINE_EVENTS = i18n.translate(
     defaultMessage: `An error has occurred on timeline events search`,
   }
 );
-
-export const FAIL_TIMELINE_EVENTS = i18n.translate(
-  'xpack.timelines.timelineEvents.failSearchDescription',
-  {
-    defaultMessage: `Failed to run search on timeline events`,
-  }
-);

x-pack/plugins/timelines/public/mock/t_grid.tsx

@@ -92,6 +92,7 @@ export const tGridIntegratedProps: TGridIntegratedProps = {
   browserFields: mockBrowserFields,
   columns: columnHeaders,
   dataProviders: mockDataProviders,
+  dataViewId: 'data-view-id',
   deletedEventIds: [],
   disabledCellActions: [],
   docValueFields: mockDocValueFields,