[Custom threshold] Respect query:allowLeadingWildcards in optional query filter

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/custom_threshold_executor.test.ts

@@ -969,7 +969,7 @@ describe('The custom threshold alert type', () => {
           stateResult2
         );
         expect(stateResult3.missingGroups).toEqual([{ key: 'b', bucketKey: { groupBy0: 'b' } }]);
-        expect(mockedEvaluateRule.mock.calls[2][9]).toEqual([
+        expect(mockedEvaluateRule.mock.calls[2][10]).toEqual([
           { bucketKey: { groupBy0: 'b' }, key: 'b' },
         ]);
       });
@@ -2958,7 +2958,7 @@ describe('The custom threshold alert type', () => {
           stateResult2
         );
         expect(stateResult3.missingGroups).toEqual([{ key: 'b', bucketKey: { groupBy0: 'b' } }]);
-        expect(mockedEvaluateRule.mock.calls[2][9]).toEqual([
+        expect(mockedEvaluateRule.mock.calls[2][10]).toEqual([
           { bucketKey: { groupBy0: 'b' }, key: 'b' },
         ]);
       });

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/custom_threshold_executor.ts

@@ -94,7 +94,7 @@ export const createCustomThresholdExecutor = ({
       executionId,
     });
 
-    const { searchSourceClient, alertsClient } = services;
+    const { searchSourceClient, alertsClient, uiSettingsClient } = services;
 
     if (!alertsClient) {
       throw new AlertsClientError();
@@ -143,6 +143,7 @@ export const createCustomThresholdExecutor = ({
       alertOnGroupDisappear,
       logger,
       { end: dateEnd, start: dateStart },
+      uiSettingsClient,
       state.lastRunTimestamp,
       previousMissingGroups
     );

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/check_missing_group.ts

@@ -5,8 +5,9 @@
  * 2.0.
  */
 
-import { ElasticsearchClient } from '@kbn/core/server';
-import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
+import type { ElasticsearchClient } from '@kbn/core/server';
+import type { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
+import type { EsQueryConfig } from '@kbn/es-query';
 import type { Logger } from '@kbn/logging';
 import { isString, get, identity } from 'lodash';
 import {
@@ -30,6 +31,7 @@ export const checkMissingGroups = async (
   searchConfiguration: SearchConfigurationType,
   logger: Logger,
   timeframe: { start: number; end: number },
+  esQueryConfig: EsQueryConfig,
   missingGroups: MissingGroupsRecord[] = []
 ): Promise<MissingGroupsRecord[]> => {
   if (missingGroups.length === 0) {
@@ -52,8 +54,10 @@ export const checkMissingGroups = async (
       currentTimeFrame,
       timeFieldName,
       searchConfiguration,
+      esQueryConfig,
       groupByQueries
     );
+
     return [
       { index: indexPattern },
       {

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/evaluate_rule.ts

@@ -6,8 +6,9 @@
  */
 
 import moment from 'moment';
-import { ElasticsearchClient } from '@kbn/core/server';
+import type { ElasticsearchClient, IUiSettingsClient } from '@kbn/core/server';
 import type { Logger } from '@kbn/logging';
+import { getEsQueryConfig } from '../../../../utils/get_es_query_config';
 import { getIntervalInSeconds } from '../../../../../common/utils/get_interval_in_seconds';
 import {
   Aggregators,
@@ -43,10 +44,12 @@ export const evaluateRule = async <Params extends EvaluatedRuleParams = Evaluate
   alertOnGroupDisappear: boolean,
   logger: Logger,
   timeframe: { start: string; end: string },
+  uiSettings: IUiSettingsClient,
   lastPeriodEnd?: number,
   missingGroups: MissingGroupsRecord[] = []
 ): Promise<Array<Record<string, Evaluation>>> => {
   const { criteria, groupBy, searchConfiguration } = params;
+  const esQueryConfig = await getEsQueryConfig(uiSettings);
 
   return Promise.all(
     criteria.map(async (criterion) => {
@@ -70,6 +73,7 @@ export const evaluateRule = async <Params extends EvaluatedRuleParams = Evaluate
         timeFieldName,
         groupBy,
         searchConfiguration,
+        esQueryConfig,
         compositeSize,
         alertOnGroupDisappear,
         calculatedTimerange,
@@ -86,6 +90,7 @@ export const evaluateRule = async <Params extends EvaluatedRuleParams = Evaluate
         searchConfiguration,
         logger,
         calculatedTimerange,
+        esQueryConfig,
         missingGroups
       );
 

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/get_data.ts

@@ -7,6 +7,7 @@
 
 import type { SearchResponse, AggregationsAggregate } from '@elastic/elasticsearch/lib/api/types';
 import type { ElasticsearchClient } from '@kbn/core/server';
+import type { EsQueryConfig } from '@kbn/es-query';
 import type { Logger } from '@kbn/logging';
 import type { EcsFieldsResponse } from '@kbn/rule-registry-plugin/common';
 import type {
@@ -104,6 +105,7 @@ export const getData = async (
   timeFieldName: string,
   groupBy: string | undefined | string[],
   searchConfiguration: SearchConfigurationType,
+  esQueryConfig: EsQueryConfig,
   compositeSize: number,
   alertOnGroupDisappear: boolean,
   timeframe: { start: number; end: number },
@@ -163,6 +165,7 @@ export const getData = async (
           timeFieldName,
           groupBy,
           searchConfiguration,
+          esQueryConfig,
           compositeSize,
           alertOnGroupDisappear,
           timeframe,
@@ -205,6 +208,7 @@ export const getData = async (
       compositeSize,
       alertOnGroupDisappear,
       searchConfiguration,
+      esQueryConfig,
       lastPeriodEnd,
       groupBy,
       afterKey,

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/metric_query.test.ts

@@ -42,6 +42,11 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
       query: '',
     },
   };
+  const esQueryConfig = {
+    allowLeadingWildcards: false,
+    queryStringOptions: {},
+    ignoreFilterIfFieldNotInIndex: false,
+  };
 
   const groupBy = 'host.doggoname';
   const timeFieldName = 'mockedTimeFieldName';
@@ -58,6 +63,7 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
       100,
       true,
       searchConfiguration,
+      esQueryConfig,
       void 0,
       groupBy
     );
@@ -114,6 +120,7 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
       100,
       true,
       currentSearchConfiguration,
+      esQueryConfig,
       void 0,
       groupBy
     );
@@ -225,6 +232,7 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
       100,
       true,
       currentSearchConfiguration,
+      esQueryConfig,
       void 0,
       groupBy
     );

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/metric_query.ts

@@ -7,7 +7,7 @@
 
 import moment from 'moment';
 import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
-import { Filter } from '@kbn/es-query';
+import type { EsQueryConfig, Filter } from '@kbn/es-query';
 import {
   Aggregators,
   CustomMetricExpressionParams,
@@ -52,6 +52,7 @@ export const createBoolQuery = (
   timeframe: { start: number; end: number },
   timeFieldName: string,
   searchConfiguration: SearchConfigurationType,
+  esQueryConfig: EsQueryConfig,
   additionalQueries: QueryDslQueryContainer[] = []
 ) => {
   const rangeQuery: QueryDslQueryContainer = {
@@ -64,7 +65,7 @@ export const createBoolQuery = (
   };
   const filters = QueryDslQueryContainerToFilter([rangeQuery, ...additionalQueries]);
 
-  return getSearchConfigurationBoolQuery(searchConfiguration, filters);
+  return getSearchConfigurationBoolQuery(searchConfiguration, filters, esQueryConfig);
 };
 
 export const getElasticsearchMetricQuery = (
@@ -74,6 +75,7 @@ export const getElasticsearchMetricQuery = (
   compositeSize: number,
   alertOnGroupDisappear: boolean,
   searchConfiguration: SearchConfigurationType,
+  esQueryConfig: EsQueryConfig,
   lastPeriodEnd?: number,
   groupBy?: string | string[],
   afterKey?: Record<string, string>,
@@ -204,7 +206,7 @@ export const getElasticsearchMetricQuery = (
     aggs.groupings.composite.after = afterKey;
   }
 
-  const query = createBoolQuery(timeframe, timeFieldName, searchConfiguration);
+  const query = createBoolQuery(timeframe, timeFieldName, searchConfiguration, esQueryConfig);
 
   return {
     track_total_hits: true,

x-pack/plugins/observability_solution/observability/server/utils/get_es_query_config.test.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { uiSettingsServiceMock } from '@kbn/core-ui-settings-server-mocks';
+import { getEsQueryConfig } from './get_es_query_config';
+
+describe('getEsQueryConfig', () => {
+  const uiSettingsClient = uiSettingsServiceMock.createClient();
+
+  it('should get the es query config correctly', async () => {
+    const settings = await getEsQueryConfig(uiSettingsClient);
+
+    expect(settings).toEqual({
+      allowLeadingWildcards: false,
+      ignoreFilterIfFieldNotInIndex: false,
+      queryStringOptions: false,
+    });
+  });
+});

x-pack/plugins/observability_solution/observability/server/utils/get_es_query_config.ts

@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IUiSettingsClient } from '@kbn/core/server';
+import { UI_SETTINGS } from '@kbn/data-plugin/server';
+
+export async function getEsQueryConfig(uiSettings: IUiSettingsClient) {
+  const allowLeadingWildcards = await uiSettings.get(UI_SETTINGS.QUERY_ALLOW_LEADING_WILDCARDS);
+  const queryStringOptions = await uiSettings.get(UI_SETTINGS.QUERY_STRING_OPTIONS);
+  const ignoreFilterIfFieldNotInIndex = await uiSettings.get(
+    UI_SETTINGS.COURIER_IGNORE_FILTER_IF_FIELD_NOT_IN_INDEX
+  );
+
+  return {
+    allowLeadingWildcards,
+    queryStringOptions,
+    ignoreFilterIfFieldNotInIndex,
+  };
+}

x-pack/plugins/observability_solution/observability/server/utils/get_parsed_filtered_query.ts

@@ -5,9 +5,11 @@
  * 2.0.
  */
 
+import Boom from '@hapi/boom';
 import {
   BoolQuery,
   buildEsQuery,
+  EsQueryConfig,
   Filter,
   fromKueryExpression,
   toElasticsearchQuery,
@@ -23,27 +25,21 @@ export const getParsedFilterQuery: (filter: string | undefined) => Array<Record<
     const parsedQuery = toElasticsearchQuery(fromKueryExpression(filter));
     return [parsedQuery];
   } catch (error) {
-    return [];
+    throw Boom.badRequest(`Invalid filter query: ${error.message}`);
   }
 };
 
 export const getSearchConfigurationBoolQuery: (
   searchConfiguration: SearchConfigurationType,
-  additionalFilters: Filter[]
-) => { bool: BoolQuery } = (searchConfiguration, additionalFilters) => {
+  additionalFilters: Filter[],
+  esQueryConfig?: EsQueryConfig
+) => { bool: BoolQuery } = (searchConfiguration, additionalFilters, esQueryConfig) => {
   try {
     const searchConfigurationFilters = (searchConfiguration.filter as Filter[]) || [];
     const filters = [...additionalFilters, ...searchConfigurationFilters];
 
-    return buildEsQuery(undefined, searchConfiguration.query, filters, {});
+    return buildEsQuery(undefined, searchConfiguration.query, filters, esQueryConfig);
   } catch (error) {
-    return {
-      bool: {
-        must: [],
-        must_not: [],
-        filter: [],
-        should: [],
-      },
-    };
+    throw Boom.badRequest(`Invalid search query: ${error.message}`);
   }
 };

x-pack/plugins/observability_solution/observability/tsconfig.json

@@ -109,6 +109,7 @@
     "@kbn/slo-schema",
     "@kbn/license-management-plugin",
     "@kbn/observability-alerting-rule-utils",
+    "@kbn/core-ui-settings-server-mocks",
   ],
   "exclude": [
     "target/**/*"