Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.x] [Security Solution][Detection Engine] fixes showing all the fields for all indices when trying to edit filters in a rule (#194678) #195624

Merged
merged 1 commit into from
Oct 9, 2024

Conversation

kibanamachine
Copy link
Contributor

…r all indices when trying to edit filters in a rule (elastic#194678)

## Summary

 - addresses elastic#179468
 - fixes issue when rule configured with Data view

**Steps to reproduce:**

1. Create a minimal new index and corresponding data view
    ```JSON
    PUT fields_index
    PUT fields_index/_mapping
    {
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "field-1": {
          "type": "keyword"
        },
        "field-2": {
          "type": "keyword"
        },
        "field-3": {
          "type": "keyword"
        }
      }
    }

    POST fields_index/_doc
    {
     "@timestamp": "2024-10-01T09:26:30.425Z",
     "field-1": "test-0"
    }
    ```
2. Create a security rule with that data view
3. Edit the rule and try to add a filter
4. Fields for all indices show up instead of the fields from the rule
index
5. Switching to indices and back to data view on rule form fixes issue

<details>
<summary>video with the bug</summary>

https://github.com/user-attachments/assets/fc83356d-d727-4662-856e-a4f0b386b71f

</details>

### Additional benefit of fixing the issue.

Previously, there would be 2 additional field_caps requests, querying
ALL indices in ES, when rule edit page loads and rule configured with
data view.

```
http://localhost:5601/kbn/internal/data_views/fields?pattern=&meta_fields=_source&meta_fields=_id&meta_fields=_index&meta_fields=_score&meta_fields=_ignored&allow_no_index=true&apiVersion=1
```
Notice, there is `pattern=` query value, which results in querying all
existing indices
Now, these requests eliminated.

#### Before
<img width="2551" alt="Screenshot 2024-10-02 at 18 21 04"
src="https://github.com/user-attachments/assets/aa2b6acb-897d-488f-9ddd-409379c6b54a">

#### After

<img width="2557" alt="Screenshot 2024-10-02 at 18 22 41"
src="https://github.com/user-attachments/assets/baeeecda-bf16-4d37-ae07-3cdc136d18b4">

(cherry picked from commit 5a71d84)
@kibanamachine kibanamachine merged commit 2e2ba4c into elastic:8.x Oct 9, 2024
34 checks passed
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 20.6MB 20.6MB +140.0B

cc @vitaliidm

kibanamachine added a commit that referenced this pull request Oct 10, 2024
…elds for all indices when trying to edit filters in a rule (#194678) (#195783)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[Security Solution][Detection Engine] fixes showing all the fields
for all indices when trying to edit filters in a rule
(#194678)](#194678)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Vitalii
Dmyterko","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-09T14:56:42Z","message":"[Security
Solution][Detection Engine] fixes showing all the fields for all indices
when trying to edit filters in a rule (#194678)\n\n## Summary\r\n\r\n -
addresses https://github.com/elastic/kibana/issues/179468\r\n - fixes
issue when rule configured with Data view\r\n \r\n**Steps to
reproduce:**\r\n\r\n1. Create a minimal new index and corresponding data
view\r\n ```JSON\r\n PUT fields_index\r\n PUT fields_index/_mapping\r\n
{\r\n \"properties\": {\r\n \"@timestamp\": {\r\n \"type\": \"date\"\r\n
},\r\n \"field-1\": {\r\n \"type\": \"keyword\"\r\n },\r\n \"field-2\":
{\r\n \"type\": \"keyword\"\r\n },\r\n \"field-3\": {\r\n \"type\":
\"keyword\"\r\n }\r\n }\r\n }\r\n \r\n POST fields_index/_doc\r\n {\r\n
\"@timestamp\": \"2024-10-01T09:26:30.425Z\",\r\n \"field-1\":
\"test-0\"\r\n }\r\n ```\r\n2. Create a security rule with that data
view\r\n3. Edit the rule and try to add a filter\r\n4. Fields for all
indices show up instead of the fields from the rule\r\nindex\r\n5.
Switching to indices and back to data view on rule form fixes
issue\r\n\r\n<details>\r\n<summary>video with the
bug</summary>\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/fc83356d-d727-4662-856e-a4f0b386b71f\r\n\r\n\r\n</details>\r\n\r\n###
Additional benefit of fixing the issue.\r\n\r\nPreviously, there would
be 2 additional field_caps requests, querying\r\nALL indices in ES, when
rule edit page loads and rule configured with\r\ndata
view.\r\n\r\n```\r\nhttp://localhost:5601/kbn/internal/data_views/fields?pattern=&meta_fields=_source&meta_fields=_id&meta_fields=_index&meta_fields=_score&meta_fields=_ignored&allow_no_index=true&apiVersion=1\r\n```\r\nNotice,
there is `pattern=` query value, which results in querying
all\r\nexisting indices\r\nNow, these requests
eliminated.\r\n\r\n\r\n#### Before\r\n<img width=\"2551\"
alt=\"Screenshot 2024-10-02 at 18 21
04\"\r\nsrc=\"https://github.com/user-attachments/assets/aa2b6acb-897d-488f-9ddd-409379c6b54a\">\r\n\r\n\r\n####
After\r\n\r\n<img width=\"2557\" alt=\"Screenshot 2024-10-02 at 18 22
41\"\r\nsrc=\"https://github.com/user-attachments/assets/baeeecda-bf16-4d37-ae07-3cdc136d18b4\">","sha":"5a71d8445de185a7b6a73163a123b6a448f63f90","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","v9.0.0","Team:
SecuritySolution","backport:prev-major","Team:Detection Engine","8.16
candidate","v8.16.0"],"title":"[Security Solution][Detection Engine]
fixes showing all the fields for all indices when trying to edit filters
in a
rule","number":194678,"url":"https://github.com/elastic/kibana/pull/194678","mergeCommit":{"message":"[Security
Solution][Detection Engine] fixes showing all the fields for all indices
when trying to edit filters in a rule (#194678)\n\n## Summary\r\n\r\n -
addresses https://github.com/elastic/kibana/issues/179468\r\n - fixes
issue when rule configured with Data view\r\n \r\n**Steps to
reproduce:**\r\n\r\n1. Create a minimal new index and corresponding data
view\r\n ```JSON\r\n PUT fields_index\r\n PUT fields_index/_mapping\r\n
{\r\n \"properties\": {\r\n \"@timestamp\": {\r\n \"type\": \"date\"\r\n
},\r\n \"field-1\": {\r\n \"type\": \"keyword\"\r\n },\r\n \"field-2\":
{\r\n \"type\": \"keyword\"\r\n },\r\n \"field-3\": {\r\n \"type\":
\"keyword\"\r\n }\r\n }\r\n }\r\n \r\n POST fields_index/_doc\r\n {\r\n
\"@timestamp\": \"2024-10-01T09:26:30.425Z\",\r\n \"field-1\":
\"test-0\"\r\n }\r\n ```\r\n2. Create a security rule with that data
view\r\n3. Edit the rule and try to add a filter\r\n4. Fields for all
indices show up instead of the fields from the rule\r\nindex\r\n5.
Switching to indices and back to data view on rule form fixes
issue\r\n\r\n<details>\r\n<summary>video with the
bug</summary>\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/fc83356d-d727-4662-856e-a4f0b386b71f\r\n\r\n\r\n</details>\r\n\r\n###
Additional benefit of fixing the issue.\r\n\r\nPreviously, there would
be 2 additional field_caps requests, querying\r\nALL indices in ES, when
rule edit page loads and rule configured with\r\ndata
view.\r\n\r\n```\r\nhttp://localhost:5601/kbn/internal/data_views/fields?pattern=&meta_fields=_source&meta_fields=_id&meta_fields=_index&meta_fields=_score&meta_fields=_ignored&allow_no_index=true&apiVersion=1\r\n```\r\nNotice,
there is `pattern=` query value, which results in querying
all\r\nexisting indices\r\nNow, these requests
eliminated.\r\n\r\n\r\n#### Before\r\n<img width=\"2551\"
alt=\"Screenshot 2024-10-02 at 18 21
04\"\r\nsrc=\"https://github.com/user-attachments/assets/aa2b6acb-897d-488f-9ddd-409379c6b54a\">\r\n\r\n\r\n####
After\r\n\r\n<img width=\"2557\" alt=\"Screenshot 2024-10-02 at 18 22
41\"\r\nsrc=\"https://github.com/user-attachments/assets/baeeecda-bf16-4d37-ae07-3cdc136d18b4\">","sha":"5a71d8445de185a7b6a73163a123b6a448f63f90"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/194678","number":194678,"mergeCommit":{"message":"[Security
Solution][Detection Engine] fixes showing all the fields for all indices
when trying to edit filters in a rule (#194678)\n\n## Summary\r\n\r\n -
addresses https://github.com/elastic/kibana/issues/179468\r\n - fixes
issue when rule configured with Data view\r\n \r\n**Steps to
reproduce:**\r\n\r\n1. Create a minimal new index and corresponding data
view\r\n ```JSON\r\n PUT fields_index\r\n PUT fields_index/_mapping\r\n
{\r\n \"properties\": {\r\n \"@timestamp\": {\r\n \"type\": \"date\"\r\n
},\r\n \"field-1\": {\r\n \"type\": \"keyword\"\r\n },\r\n \"field-2\":
{\r\n \"type\": \"keyword\"\r\n },\r\n \"field-3\": {\r\n \"type\":
\"keyword\"\r\n }\r\n }\r\n }\r\n \r\n POST fields_index/_doc\r\n {\r\n
\"@timestamp\": \"2024-10-01T09:26:30.425Z\",\r\n \"field-1\":
\"test-0\"\r\n }\r\n ```\r\n2. Create a security rule with that data
view\r\n3. Edit the rule and try to add a filter\r\n4. Fields for all
indices show up instead of the fields from the rule\r\nindex\r\n5.
Switching to indices and back to data view on rule form fixes
issue\r\n\r\n<details>\r\n<summary>video with the
bug</summary>\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/fc83356d-d727-4662-856e-a4f0b386b71f\r\n\r\n\r\n</details>\r\n\r\n###
Additional benefit of fixing the issue.\r\n\r\nPreviously, there would
be 2 additional field_caps requests, querying\r\nALL indices in ES, when
rule edit page loads and rule configured with\r\ndata
view.\r\n\r\n```\r\nhttp://localhost:5601/kbn/internal/data_views/fields?pattern=&meta_fields=_source&meta_fields=_id&meta_fields=_index&meta_fields=_score&meta_fields=_ignored&allow_no_index=true&apiVersion=1\r\n```\r\nNotice,
there is `pattern=` query value, which results in querying
all\r\nexisting indices\r\nNow, these requests
eliminated.\r\n\r\n\r\n#### Before\r\n<img width=\"2551\"
alt=\"Screenshot 2024-10-02 at 18 21
04\"\r\nsrc=\"https://github.com/user-attachments/assets/aa2b6acb-897d-488f-9ddd-409379c6b54a\">\r\n\r\n\r\n####
After\r\n\r\n<img width=\"2557\" alt=\"Screenshot 2024-10-02 at 18 22
41\"\r\nsrc=\"https://github.com/user-attachments/assets/baeeecda-bf16-4d37-ae07-3cdc136d18b4\">","sha":"5a71d8445de185a7b6a73163a123b6a448f63f90"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/195624","number":195624,"state":"MERGED","mergeCommit":{"sha":"2e2ba4c6c0ac60cad7dfefc83abad31cdfccb05e","message":"[8.x]
[Security Solution][Detection Engine] fixes showing all the fields for
all indices when trying to edit filters in a rule (#194678)
(#195624)\n\n# Backport\n\nThis will backport the following commits from
`main` to `8.x`:\n- [[Security Solution][Detection Engine] fixes showing
all the fields\nfor all indices when trying to edit filters in a
rule\n(#194678)](https://github.com/elastic/kibana/pull/194678)\n\n<!---
Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the
[Backport
tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT
[{\"author\":{\"name\":\"Vitalii\nDmyterko\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-10-09T14:56:42Z\",\"message\":\"[Security\nSolution][Detection
Engine] fixes showing all the fields for all indices\nwhen trying to
edit filters in a rule (#194678)\\n\\n## Summary\\r\\n\\r\\n
-\naddresses https://github.com/elastic/kibana/issues/179468\\r\\n -
fixes\nissue when rule configured with Data view\\r\\n \\r\\n**Steps
to\nreproduce:**\\r\\n\\r\\n1. Create a minimal new index and
corresponding data\nview\\r\\n ```JSON\\r\\n PUT fields_index\\r\\n PUT
fields_index/_mapping\\r\\n\n{\\r\\n \\\"properties\\\": {\\r\\n
\\\"@timestamp\\\": {\\r\\n \\\"type\\\": \\\"date\\\"\\r\\n\n},\\r\\n
\\\"field-1\\\": {\\r\\n \\\"type\\\": \\\"keyword\\\"\\r\\n },\\r\\n
\\\"field-2\\\":\n{\\r\\n \\\"type\\\": \\\"keyword\\\"\\r\\n },\\r\\n
\\\"field-3\\\": {\\r\\n \\\"type\\\":\n\\\"keyword\\\"\\r\\n }\\r\\n
}\\r\\n }\\r\\n \\r\\n POST fields_index/_doc\\r\\n
{\\r\\n\n\\\"@timestamp\\\": \\\"2024-10-01T09:26:30.425Z\\\",\\r\\n
\\\"field-1\\\":\n\\\"test-0\\\"\\r\\n }\\r\\n ```\\r\\n2. Create a
security rule with that data\nview\\r\\n3. Edit the rule and try to add
a filter\\r\\n4. Fields for all\nindices show up instead of the fields
from the rule\\r\\nindex\\r\\n5.\nSwitching to indices and back to data
view on rule form fixes\nissue\\r\\n\\r\\n<details>\\r\\n<summary>video
with
the\nbug</summary>\\r\\n\\r\\n\\r\\n\\r\\nhttps://github.com/user-attachments/assets/fc83356d-d727-4662-856e-a4f0b386b71f\\r\\n\\r\\n\\r\\n</details>\\r\\n\\r\\n###\nAdditional
benefit of fixing the issue.\\r\\n\\r\\nPreviously, there would\nbe 2
additional field_caps requests, querying\\r\\nALL indices in ES,
when\nrule edit page loads and rule configured
with\\r\\ndata\nview.\\r\\n\\r\\n```\\r\\nhttp://localhost:5601/kbn/internal/data_views/fields?pattern=&meta_fields=_source&meta_fields=_id&meta_fields=_index&meta_fields=_score&meta_fields=_ignored&allow_no_index=true&apiVersion=1\\r\\n```\\r\\nNotice,\nthere
is `pattern=` query value, which results in querying\nall\\r\\nexisting
indices\\r\\nNow, these requests\neliminated.\\r\\n\\r\\n\\r\\n####
Before\\r\\n<img width=\\\"2551\\\"\nalt=\\\"Screenshot 2024-10-02 at 18
21\n04\\\"\\r\\nsrc=\\\"https://github.com/user-attachments/assets/aa2b6acb-897d-488f-9ddd-409379c6b54a\\\">\\r\\n\\r\\n\\r\\n####\nAfter\\r\\n\\r\\n<img
width=\\\"2557\\\" alt=\\\"Screenshot 2024-10-02 at 18
22\n41\\\"\\r\\nsrc=\\\"https://github.com/user-attachments/assets/baeeecda-bf16-4d37-ae07-3cdc136d18b4\\\">\",\"sha\":\"5a71d8445de185a7b6a73163a123b6a448f63f90\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.16.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"release_note:fix\",\"v9.0.0\",\"Team:\nSecuritySolution\",\"backport:prev-minor\",\"Team:Detection
Engine\",\"8.16\ncandidate\"],\"title\":\"[Security Solution][Detection
Engine] fixes showing\nall the fields for all indices when trying to
edit filters in
a\nrule\",\"number\":194678,\"url\":\"https://github.com/elastic/kibana/pull/194678\",\"mergeCommit\":{\"message\":\"[Security\nSolution][Detection
Engine] fixes showing all the fields for all indices\nwhen trying to
edit filters in a rule (#194678)\\n\\n## Summary\\r\\n\\r\\n
-\naddresses https://github.com/elastic/kibana/issues/179468\\r\\n -
fixes\nissue when rule configured with Data view\\r\\n \\r\\n**Steps
to\nreproduce:**\\r\\n\\r\\n1. Create a minimal new index and
corresponding data\nview\\r\\n ```JSON\\r\\n PUT fields_index\\r\\n PUT
fields_index/_mapping\\r\\n\n{\\r\\n \\\"properties\\\": {\\r\\n
\\\"@timestamp\\\": {\\r\\n \\\"type\\\": \\\"date\\\"\\r\\n\n},\\r\\n
\\\"field-1\\\": {\\r\\n \\\"type\\\": \\\"keyword\\\"\\r\\n },\\r\\n
\\\"field-2\\\":\n{\\r\\n \\\"type\\\": \\\"keyword\\\"\\r\\n },\\r\\n
\\\"field-3\\\": {\\r\\n \\\"type\\\":\n\\\"keyword\\\"\\r\\n }\\r\\n
}\\r\\n }\\r\\n \\r\\n POST fields_index/_doc\\r\\n
{\\r\\n\n\\\"@timestamp\\\": \\\"2024-10-01T09:26:30.425Z\\\",\\r\\n
\\\"field-1\\\":\n\\\"test-0\\\"\\r\\n }\\r\\n ```\\r\\n2. Create a
security rule with that data\nview\\r\\n3. Edit the rule and try to add
a filter\\r\\n4. Fields for all\nindices show up instead of the fields
from the rule\\r\\nindex\\r\\n5.\nSwitching to indices and back to data
view on rule form fixes\nissue\\r\\n\\r\\n<details>\\r\\n<summary>video
with
the\nbug</summary>\\r\\n\\r\\n\\r\\n\\r\\nhttps://github.com/user-attachments/assets/fc83356d-d727-4662-856e-a4f0b386b71f\\r\\n\\r\\n\\r\\n</details>\\r\\n\\r\\n###\nAdditional
benefit of fixing the issue.\\r\\n\\r\\nPreviously, there would\nbe 2
additional field_caps requests, querying\\r\\nALL indices in ES,
when\nrule edit page loads and rule configured
with\\r\\ndata\nview.\\r\\n\\r\\n```\\r\\nhttp://localhost:5601/kbn/internal/data_views/fields?pattern=&meta_fields=_source&meta_fields=_id&meta_fields=_index&meta_fields=_score&meta_fields=_ignored&allow_no_index=true&apiVersion=1\\r\\n```\\r\\nNotice,\nthere
is `pattern=` query value, which results in querying\nall\\r\\nexisting
indices\\r\\nNow, these requests\neliminated.\\r\\n\\r\\n\\r\\n####
Before\\r\\n<img width=\\\"2551\\\"\nalt=\\\"Screenshot 2024-10-02 at 18
21\n04\\\"\\r\\nsrc=\\\"https://github.com/user-attachments/assets/aa2b6acb-897d-488f-9ddd-409379c6b54a\\\">\\r\\n\\r\\n\\r\\n####\nAfter\\r\\n\\r\\n<img
width=\\\"2557\\\" alt=\\\"Screenshot 2024-10-02 at 18
22\n41\\\"\\r\\nsrc=\\\"https://github.com/user-attachments/assets/baeeecda-bf16-4d37-ae07-3cdc136d18b4\\\">\",\"sha\":\"5a71d8445de185a7b6a73163a123b6a448f63f90\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/194678\",\"number\":194678,\"mergeCommit\":{\"message\":\"[Security\nSolution][Detection
Engine] fixes showing all the fields for all indices\nwhen trying to
edit filters in a rule (#194678)\\n\\n## Summary\\r\\n\\r\\n
-\naddresses https://github.com/elastic/kibana/issues/179468\\r\\n -
fixes\nissue when rule configured with Data view\\r\\n \\r\\n**Steps
to\nreproduce:**\\r\\n\\r\\n1. Create a minimal new index and
corresponding data\nview\\r\\n ```JSON\\r\\n PUT fields_index\\r\\n PUT
fields_index/_mapping\\r\\n\n{\\r\\n \\\"properties\\\": {\\r\\n
\\\"@timestamp\\\": {\\r\\n \\\"type\\\": \\\"date\\\"\\r\\n\n},\\r\\n
\\\"field-1\\\": {\\r\\n \\\"type\\\": \\\"keyword\\\"\\r\\n },\\r\\n
\\\"field-2\\\":\n{\\r\\n \\\"type\\\": \\\"keyword\\\"\\r\\n },\\r\\n
\\\"field-3\\\": {\\r\\n \\\"type\\\":\n\\\"keyword\\\"\\r\\n }\\r\\n
}\\r\\n }\\r\\n \\r\\n POST fields_index/_doc\\r\\n
{\\r\\n\n\\\"@timestamp\\\": \\\"2024-10-01T09:26:30.425Z\\\",\\r\\n
\\\"field-1\\\":\n\\\"test-0\\\"\\r\\n }\\r\\n ```\\r\\n2. Create a
security rule with that data\nview\\r\\n3. Edit the rule and try to add
a filter\\r\\n4. Fields for all\nindices show up instead of the fields
from the rule\\r\\nindex\\r\\n5.\nSwitching to indices and back to data
view on rule form fixes\nissue\\r\\n\\r\\n<details>\\r\\n<summary>video
with
the\nbug</summary>\\r\\n\\r\\n\\r\\n\\r\\nhttps://github.com/user-attachments/assets/fc83356d-d727-4662-856e-a4f0b386b71f\\r\\n\\r\\n\\r\\n</details>\\r\\n\\r\\n###\nAdditional
benefit of fixing the issue.\\r\\n\\r\\nPreviously, there would\nbe 2
additional field_caps requests, querying\\r\\nALL indices in ES,
when\nrule edit page loads and rule configured
with\\r\\ndata\nview.\\r\\n\\r\\n```\\r\\nhttp://localhost:5601/kbn/internal/data_views/fields?pattern=&meta_fields=_source&meta_fields=_id&meta_fields=_index&meta_fields=_score&meta_fields=_ignored&allow_no_index=true&apiVersion=1\\r\\n```\\r\\nNotice,\nthere
is `pattern=` query value, which results in querying\nall\\r\\nexisting
indices\\r\\nNow, these requests\neliminated.\\r\\n\\r\\n\\r\\n####
Before\\r\\n<img width=\\\"2551\\\"\nalt=\\\"Screenshot 2024-10-02 at 18
21\n04\\\"\\r\\nsrc=\\\"https://github.com/user-attachments/assets/aa2b6acb-897d-488f-9ddd-409379c6b54a\\\">\\r\\n\\r\\n\\r\\n####\nAfter\\r\\n\\r\\n<img
width=\\\"2557\\\" alt=\\\"Screenshot 2024-10-02 at 18
22\n41\\\"\\r\\nsrc=\\\"https://github.com/user-attachments/assets/baeeecda-bf16-4d37-ae07-3cdc136d18b4\\\">\",\"sha\":\"5a71d8445de185a7b6a73163a123b6a448f63f90\"}}]}]\nBACKPORT-->\n\nCo-authored-by:
Vitalii Dmyterko <[email protected]>"}}]}]
BACKPORT-->

Co-authored-by: Vitalii Dmyterko <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants