[Security Solution] [Detections] Adds support for index patterns (DataViewBase) to be used for query bar filters #166318
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dhurley14
added
review
release_note:skip
dhurley14
commented
Sep 13, 2023
| data.dataViews.clearInstanceCache(dv?.id); | ||
| } | ||
| }; | ||
| }, [data.dataViews, indexPattern]); |
There was a problem hiding this comment.
I removed dataView?.id from the side effect's dependency list here.
💛 Build succeeded, but was flaky
Failed CI StepsTest Failures
Metrics [docs]Async chunks
Unknown metric groupsReferences to deprecated APIs
History
To update your PR or re-run it, just comment with: cc @dhurley14 |
WafaaNasr
approved these changes
Sep 18, 2023
e40pud
added a commit
that referenced
this pull request
Jan 24, 2024
…ew on the Rule Editing page (#174026) (#174922) ## Summary Addresses #174026 These changes fix the issue with filter editing on the rule's editing page when using index patterns instead of data view. **Steps to reproduce**: 1. Create a custom query rule and add a filter 2. Save the rule 3. Edit the rule 4. Edit the filter **Current behaviour**: Right now when user tries to edit the filter the data view picking UI appears even though index patterns were not modified. <img width="1261" alt="Screenshot 2024-01-16 at 15 14 23" src="https://github.com/elastic/kibana/assets/2700761/b2d28b79-a7d8-482c-a2be-fa8e20cb9e25"> **Expected behaviour**: Data view picking UI should not be present and previously set field and value options should be shown in the filter editing dialog. <img width="1252" alt="Screenshot 2024-01-16 at 15 16 07" src="https://github.com/elastic/kibana/assets/2700761/bb99dd9f-aa6a-4003-b8c4-ccda344c4c5c"> **Cause**: The behaviour for the filter editing on rule’s editing page changed in `8.11` with these changes #166318. We convert `DataViewBase` object without ID set to a `DataView` object with auto-generated ID. This happens each time we try to edit the rule and leads to a different ID which is saved in `filter.meta.index`. Unified search internally checks those IDs to verify whether the filter belongs to provided data view. **Solution**: To solve this issue, we set the data view id explicitly on creating an in-memory data view that represents index patterns and update `filter.meta.index` to use the same ID. ~~**Known issue**: This does not resolve the issue for existing filters. In this case, user will need to update their filters manually.~~ (This was fixed by updating `filter.meta.index` field on rule editing) **Flaky test runner** [ESS 50 times](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4927) [Serverless 50 times](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4935) --------- Co-authored-by: Kibana Machine <[email protected]>
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jan 24, 2024
…ew on the Rule Editing page (elastic#174026) (elastic#174922) ## Summary Addresses elastic#174026 These changes fix the issue with filter editing on the rule's editing page when using index patterns instead of data view. **Steps to reproduce**: 1. Create a custom query rule and add a filter 2. Save the rule 3. Edit the rule 4. Edit the filter **Current behaviour**: Right now when user tries to edit the filter the data view picking UI appears even though index patterns were not modified. <img width="1261" alt="Screenshot 2024-01-16 at 15 14 23" src="https://github.com/elastic/kibana/assets/2700761/b2d28b79-a7d8-482c-a2be-fa8e20cb9e25"> **Expected behaviour**: Data view picking UI should not be present and previously set field and value options should be shown in the filter editing dialog. <img width="1252" alt="Screenshot 2024-01-16 at 15 16 07" src="https://github.com/elastic/kibana/assets/2700761/bb99dd9f-aa6a-4003-b8c4-ccda344c4c5c"> **Cause**: The behaviour for the filter editing on rule’s editing page changed in `8.11` with these changes elastic#166318. We convert `DataViewBase` object without ID set to a `DataView` object with auto-generated ID. This happens each time we try to edit the rule and leads to a different ID which is saved in `filter.meta.index`. Unified search internally checks those IDs to verify whether the filter belongs to provided data view. **Solution**: To solve this issue, we set the data view id explicitly on creating an in-memory data view that represents index patterns and update `filter.meta.index` to use the same ID. ~~**Known issue**: This does not resolve the issue for existing filters. In this case, user will need to update their filters manually.~~ (This was fixed by updating `filter.meta.index` field on rule editing) **Flaky test runner** [ESS 50 times](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4927) [Serverless 50 times](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4935) --------- Co-authored-by: Kibana Machine <[email protected]> (cherry picked from commit f0f6274)
kibanamachine
referenced
this pull request
Jan 25, 2024
… "Edit filter" view on the Rule Editing page (#174026) (#174922) (#175433) # Backport This will backport the following commits from `main` to `8.12`: - [[Security Solution] "Data view" selector is shown in "Edit filter" view on the Rule Editing page (#174026) (#174922)](#174922) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Ievgen Sorokopud","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-01-24T13:34:54Z","message":"[Security Solution] \"Data view\" selector is shown in \"Edit filter\" view on the Rule Editing page (#174026) (#174922)\n\n## Summary\r\n\r\nAddresses https://github.com/elastic/kibana/issues/174026\r\n\r\nThese changes fix the issue with filter editing on the rule's editing\r\npage when using index patterns instead of data view.\r\n\r\n**Steps to reproduce**:\r\n1. Create a custom query rule and add a filter\r\n2. Save the rule\r\n3. Edit the rule\r\n4. Edit the filter\r\n\r\n**Current behaviour**:\r\nRight now when user tries to edit the filter the data view picking UI\r\nappears even though index patterns were not modified.\r\n\r\n<img width=\"1261\" alt=\"Screenshot 2024-01-16 at 15 14 23\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/b2d28b79-a7d8-482c-a2be-fa8e20cb9e25\">\r\n\r\n**Expected behaviour**:\r\nData view picking UI should not be present and previously set field and\r\nvalue options should be shown in the filter editing dialog.\r\n\r\n<img width=\"1252\" alt=\"Screenshot 2024-01-16 at 15 16 07\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/bb99dd9f-aa6a-4003-b8c4-ccda344c4c5c\">\r\n\r\n**Cause**:\r\nThe behaviour for the filter editing on rule’s editing page changed in\r\n`8.11` with these changes https://github.com/elastic/kibana/pull/166318.\r\nWe convert `DataViewBase` object without ID set to a `DataView` object\r\nwith auto-generated ID. This happens each time we try to edit the rule\r\nand leads to a different ID which is saved in `filter.meta.index`.\r\nUnified search internally checks those IDs to verify whether the filter\r\nbelongs to provided data view.\r\n\r\n**Solution**:\r\nTo solve this issue, we set the data view id explicitly on creating an\r\nin-memory data view that represents index patterns and update\r\n`filter.meta.index` to use the same ID.\r\n\r\n~~**Known issue**:\r\nThis does not resolve the issue for existing filters. In this case, user\r\nwill need to update their filters manually.~~ (This was fixed by\r\nupdating `filter.meta.index` field on rule editing)\r\n\r\n**Flaky test runner**\r\n[ESS 50\r\ntimes](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4927)\r\n[Serverless 50\r\ntimes](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4935)\r\n\r\n---------\r\n\r\nCo-authored-by: Kibana Machine <[email protected]>","sha":"f0f6274b9563cc453a11a937fe66f3bfbe8311bf","branchLabelMapping":{"^v8.13.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team: SecuritySolution","backport:prev-minor","Team:Detection Engine","v8.13.0"],"title":"[Security Solution] \"Data view\" selector is shown in \"Edit filter\" view on the Rule Editing page (#174026)","number":174922,"url":"https://github.com/elastic/kibana/pull/174922","mergeCommit":{"message":"[Security Solution] \"Data view\" selector is shown in \"Edit filter\" view on the Rule Editing page (#174026) (#174922)\n\n## Summary\r\n\r\nAddresses https://github.com/elastic/kibana/issues/174026\r\n\r\nThese changes fix the issue with filter editing on the rule's editing\r\npage when using index patterns instead of data view.\r\n\r\n**Steps to reproduce**:\r\n1. Create a custom query rule and add a filter\r\n2. Save the rule\r\n3. Edit the rule\r\n4. Edit the filter\r\n\r\n**Current behaviour**:\r\nRight now when user tries to edit the filter the data view picking UI\r\nappears even though index patterns were not modified.\r\n\r\n<img width=\"1261\" alt=\"Screenshot 2024-01-16 at 15 14 23\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/b2d28b79-a7d8-482c-a2be-fa8e20cb9e25\">\r\n\r\n**Expected behaviour**:\r\nData view picking UI should not be present and previously set field and\r\nvalue options should be shown in the filter editing dialog.\r\n\r\n<img width=\"1252\" alt=\"Screenshot 2024-01-16 at 15 16 07\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/bb99dd9f-aa6a-4003-b8c4-ccda344c4c5c\">\r\n\r\n**Cause**:\r\nThe behaviour for the filter editing on rule’s editing page changed in\r\n`8.11` with these changes https://github.com/elastic/kibana/pull/166318.\r\nWe convert `DataViewBase` object without ID set to a `DataView` object\r\nwith auto-generated ID. This happens each time we try to edit the rule\r\nand leads to a different ID which is saved in `filter.meta.index`.\r\nUnified search internally checks those IDs to verify whether the filter\r\nbelongs to provided data view.\r\n\r\n**Solution**:\r\nTo solve this issue, we set the data view id explicitly on creating an\r\nin-memory data view that represents index patterns and update\r\n`filter.meta.index` to use the same ID.\r\n\r\n~~**Known issue**:\r\nThis does not resolve the issue for existing filters. In this case, user\r\nwill need to update their filters manually.~~ (This was fixed by\r\nupdating `filter.meta.index` field on rule editing)\r\n\r\n**Flaky test runner**\r\n[ESS 50\r\ntimes](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4927)\r\n[Serverless 50\r\ntimes](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4935)\r\n\r\n---------\r\n\r\nCo-authored-by: Kibana Machine <[email protected]>","sha":"f0f6274b9563cc453a11a937fe66f3bfbe8311bf"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.13.0","branchLabelMappingKey":"^v8.13.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/174922","number":174922,"mergeCommit":{"message":"[Security Solution] \"Data view\" selector is shown in \"Edit filter\" view on the Rule Editing page (#174026) (#174922)\n\n## Summary\r\n\r\nAddresses https://github.com/elastic/kibana/issues/174026\r\n\r\nThese changes fix the issue with filter editing on the rule's editing\r\npage when using index patterns instead of data view.\r\n\r\n**Steps to reproduce**:\r\n1. Create a custom query rule and add a filter\r\n2. Save the rule\r\n3. Edit the rule\r\n4. Edit the filter\r\n\r\n**Current behaviour**:\r\nRight now when user tries to edit the filter the data view picking UI\r\nappears even though index patterns were not modified.\r\n\r\n<img width=\"1261\" alt=\"Screenshot 2024-01-16 at 15 14 23\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/b2d28b79-a7d8-482c-a2be-fa8e20cb9e25\">\r\n\r\n**Expected behaviour**:\r\nData view picking UI should not be present and previously set field and\r\nvalue options should be shown in the filter editing dialog.\r\n\r\n<img width=\"1252\" alt=\"Screenshot 2024-01-16 at 15 16 07\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/bb99dd9f-aa6a-4003-b8c4-ccda344c4c5c\">\r\n\r\n**Cause**:\r\nThe behaviour for the filter editing on rule’s editing page changed in\r\n`8.11` with these changes https://github.com/elastic/kibana/pull/166318.\r\nWe convert `DataViewBase` object without ID set to a `DataView` object\r\nwith auto-generated ID. This happens each time we try to edit the rule\r\nand leads to a different ID which is saved in `filter.meta.index`.\r\nUnified search internally checks those IDs to verify whether the filter\r\nbelongs to provided data view.\r\n\r\n**Solution**:\r\nTo solve this issue, we set the data view id explicitly on creating an\r\nin-memory data view that represents index patterns and update\r\n`filter.meta.index` to use the same ID.\r\n\r\n~~**Known issue**:\r\nThis does not resolve the issue for existing filters. In this case, user\r\nwill need to update their filters manually.~~ (This was fixed by\r\nupdating `filter.meta.index` field on rule editing)\r\n\r\n**Flaky test runner**\r\n[ESS 50\r\ntimes](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4927)\r\n[Serverless 50\r\ntimes](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4935)\r\n\r\n---------\r\n\r\nCo-authored-by: Kibana Machine <[email protected]>","sha":"f0f6274b9563cc453a11a937fe66f3bfbe8311bf"}}]}] BACKPORT--> --------- Co-authored-by: Ievgen Sorokopud <[email protected]>
CoenWarmer
pushed a commit
to CoenWarmer/kibana
that referenced
this pull request
Feb 15, 2024
…ew on the Rule Editing page (elastic#174026) (elastic#174922) ## Summary Addresses elastic#174026 These changes fix the issue with filter editing on the rule's editing page when using index patterns instead of data view. **Steps to reproduce**: 1. Create a custom query rule and add a filter 2. Save the rule 3. Edit the rule 4. Edit the filter **Current behaviour**: Right now when user tries to edit the filter the data view picking UI appears even though index patterns were not modified. <img width="1261" alt="Screenshot 2024-01-16 at 15 14 23" src="https://github.com/elastic/kibana/assets/2700761/b2d28b79-a7d8-482c-a2be-fa8e20cb9e25"> **Expected behaviour**: Data view picking UI should not be present and previously set field and value options should be shown in the filter editing dialog. <img width="1252" alt="Screenshot 2024-01-16 at 15 16 07" src="https://github.com/elastic/kibana/assets/2700761/bb99dd9f-aa6a-4003-b8c4-ccda344c4c5c"> **Cause**: The behaviour for the filter editing on rule’s editing page changed in `8.11` with these changes elastic#166318. We convert `DataViewBase` object without ID set to a `DataView` object with auto-generated ID. This happens each time we try to edit the rule and leads to a different ID which is saved in `filter.meta.index`. Unified search internally checks those IDs to verify whether the filter belongs to provided data view. **Solution**: To solve this issue, we set the data view id explicitly on creating an in-memory data view that represents index patterns and update `filter.meta.index` to use the same ID. ~~**Known issue**: This does not resolve the issue for existing filters. In this case, user will need to update their filters manually.~~ (This was fixed by updating `filter.meta.index` field on rule editing) **Flaky test runner** [ESS 50 times](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4927) [Serverless 50 times](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4935) --------- Co-authored-by: Kibana Machine <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Ref: #164265