Merge branch 'main' into elastic#61

alexwizp · Sep 25, 2024 · f171f22 · f171f22
2 parents 8c544a2 + 9fb6f55
commit f171f22
Show file tree

Hide file tree

Showing 92 changed files with 1,990 additions and 182 deletions.
diff --git a/oas_docs/output/kibana.serverless.staging.yaml b/oas_docs/output/kibana.serverless.staging.yaml
@@ -15392,6 +15392,39 @@ paths:
       tags:
         - Security Timeline API
         - access:securitySolution
+  /api/risk_score/engine/dangerously_delete_data:
+    delete:
+      description: >-
+        Cleaning up the the Risk Engine by removing the indices, mapping and
+        transforms
+      operationId: CleanUpRiskEngine
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  cleanup_successful:
+                    type: boolean
+          description: Successful response
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: >-
+                  #/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse
+          description: Task manager is unavailable
+        default:
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: >-
+                  #/components/schemas/Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse
+          description: Unexpected error
+      summary: Cleanup the Risk Engine
+      tags:
+        - Security Entity Analytics API
   /api/risk_score/engine/schedule_now:
     post:
       description: >-
@@ -29750,6 +29783,27 @@ components:
       required:
         - id_value
         - id_field
+    Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse:
+      type: object
+      properties:
+        cleanup_successful:
+          example: false
+          type: boolean
+        errors:
+          items:
+            type: object
+            properties:
+              error:
+                type: string
+              seq:
+                type: integer
+            required:
+              - seq
+              - error
+          type: array
+      required:
+        - cleanup_successful
+        - errors
     Security_Entity_Analytics_API_CreateAssetCriticalityRecord:
       allOf:
         - $ref: >-

diff --git a/oas_docs/output/kibana.staging.yaml b/oas_docs/output/kibana.staging.yaml
@@ -18822,6 +18822,39 @@ paths:
       tags:
         - Security Timeline API
         - access:securitySolution
+  /api/risk_score/engine/dangerously_delete_data:
+    delete:
+      description: >-
+        Cleaning up the the Risk Engine by removing the indices, mapping and
+        transforms
+      operationId: CleanUpRiskEngine
+      responses:
+        '200':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                type: object
+                properties:
+                  cleanup_successful:
+                    type: boolean
+          description: Successful response
+        '400':
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: >-
+                  #/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse
+          description: Task manager is unavailable
+        default:
+          content:
+            application/json; Elastic-Api-Version=2023-10-31:
+              schema:
+                $ref: >-
+                  #/components/schemas/Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse
+          description: Unexpected error
+      summary: Cleanup the Risk Engine
+      tags:
+        - Security Entity Analytics API
   /api/risk_score/engine/schedule_now:
     post:
       description: >-
@@ -37759,6 +37792,27 @@ components:
       required:
         - id_value
         - id_field
+    Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse:
+      type: object
+      properties:
+        cleanup_successful:
+          example: false
+          type: boolean
+        errors:
+          items:
+            type: object
+            properties:
+              error:
+                type: string
+              seq:
+                type: integer
+            required:
+              - seq
+              - error
+          type: array
+      required:
+        - cleanup_successful
+        - errors
     Security_Entity_Analytics_API_CreateAssetCriticalityRecord:
       allOf:
         - $ref: >-

diff --git a/packages/kbn-esql-utils/src/utils/append_to_query.test.ts b/packages/kbn-esql-utils/src/utils/append_to_query.test.ts
@@ -168,5 +168,11 @@ AND \`dest\`=="Crete"`
 and \`ip\`::string!="127.0.0.2/32"`
       );
     });
+
+    it('returns undefined for multivalue fields', () => {
+      expect(
+        appendWhereClauseToESQLQuery('from logstash-*', 'dest', ['meow'], '+', 'string')
+      ).toBeUndefined();
+    });
   });
 });
diff --git a/packages/kbn-esql-utils/src/utils/append_to_query.ts b/packages/kbn-esql-utils/src/utils/append_to_query.ts
@@ -21,7 +21,11 @@ export function appendWhereClauseToESQLQuery(
   value: unknown,
   operation: '+' | '-' | 'is_not_null' | 'is_null',
   fieldType?: string
-): string {
+): string | undefined {
+  // multivalues filtering is not supported yet
+  if (Array.isArray(value)) {
+    return undefined;
+  }
   let operator;
   switch (operation) {
     case 'is_not_null':

diff --git a/packages/kbn-management/settings/application/hooks/use_fields.ts b/packages/kbn-management/settings/application/hooks/use_fields.ts
@@ -7,11 +7,13 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-import { Query } from '@elastic/eui';
+import { Ast, Query } from '@elastic/eui';
 import { getFieldDefinitions } from '@kbn/management-settings-field-definition';
 import { FieldDefinition } from '@kbn/management-settings-types';
 import { UiSettingsScope } from '@kbn/core-ui-settings-common';
+import { Clause } from '@elastic/eui/src/components/search_bar/query/ast';
 import { useServices } from '../services';
+import { CATEGORY_FIELD } from '../query_input';
 import { useSettings } from './use_settings';
 
 /**
@@ -29,7 +31,19 @@ export const useFields = (scope: UiSettingsScope, query?: Query): FieldDefinitio
     isOverridden: (key) => isOverriddenSetting(key, scope),
   });
   if (query) {
-    return Query.execute(query, fields);
+    const clauses: Clause[] = query.ast.clauses.map((clause) =>
+      // If the clause value contains `:` and is not a category filter, add it as a term clause
+      // This allows searching for settings that include `:` in their names
+      clause.type === 'field' && clause.field !== CATEGORY_FIELD
+        ? {
+            type: 'term',
+            match: 'must',
+            value: `${clause.field}:${clause.value}`,
+          }
+        : clause
+    );
+
+    return Query.execute(new Query(Ast.create(clauses), undefined, query.text), fields);
   }
   return fields;
 };
diff --git a/packages/kbn-test/src/es/test_es_cluster.ts b/packages/kbn-test/src/es/test_es_cluster.ts
@@ -191,7 +191,10 @@ export function createTestEsCluster<
     `transport.port=${transportPort ?? esTestConfig.getTransportPort()}`,
     // For multi-node clusters, we make all nodes master-eligible by default.
     ...(nodes.length > 1
-      ? ['discovery.type=zen', `cluster.initial_master_nodes=${nodes.map((n) => n.name).join(',')}`]
+      ? [
+          'discovery.type=multi-node',
+          `cluster.initial_master_nodes=${nodes.map((n) => n.name).join(',')}`,
+        ]
       : ['discovery.type=single-node']),
   ];
 

diff --git a/packages/kbn-unified-data-table/src/components/data_table_columns.tsx b/packages/kbn-unified-data-table/src/components/data_table_columns.tsx
@@ -189,7 +189,13 @@ function buildEuiGridColumn({
     cellActions = columnCellActions;
   } else {
     cellActions = dataViewField
-      ? buildCellActions(dataViewField, toastNotifications, valueToStringConverter, onFilter)
+      ? buildCellActions(
+          dataViewField,
+          isPlainRecord,
+          toastNotifications,
+          valueToStringConverter,
+          onFilter
+        )
       : [];
 
     if (columnCellActions?.length && cellActionsHandling === 'append') {

diff --git a/packages/kbn-unified-data-table/src/components/default_cell_actions.test.tsx b/packages/kbn-unified-data-table/src/components/default_cell_actions.test.tsx
@@ -45,6 +45,7 @@ describe('Default cell actions ', function () {
   it('should not show cell actions for unfilterable fields', async () => {
     const cellActions = buildCellActions(
       { name: 'foo', filterable: false } as DataViewField,
+      false,
       servicesMock.toastNotifications,
       dataTableContextMock.valueToStringConverter
     );
@@ -61,6 +62,7 @@ describe('Default cell actions ', function () {
   it('should show filter actions for filterable fields', async () => {
     const cellActions = buildCellActions(
       { name: 'foo', filterable: true } as DataViewField,
+      false,
       servicesMock.toastNotifications,
       dataTableContextMock.valueToStringConverter,
       jest.fn()
@@ -71,6 +73,7 @@ describe('Default cell actions ', function () {
   it('should show Copy action for _source field', async () => {
     const cellActions = buildCellActions(
       { name: '_source', type: '_source', filterable: false } as DataViewField,
+      false,
       servicesMock.toastNotifications,
       dataTableContextMock.valueToStringConverter
     );
@@ -87,65 +90,97 @@ describe('Default cell actions ', function () {
     const component = mountWithIntl(
       <UnifiedDataTableContext.Provider value={dataTableContextMock}>
         <FilterInBtn
-          Component={(props: any) => <EuiButton {...props} />}
-          rowIndex={1}
-          colIndex={1}
-          columnId="extension"
-          isExpanded={false}
+          cellActionProps={{
+            Component: (props: any) => <EuiButton {...props} />,
+            rowIndex: 1,
+            colIndex: 1,
+            columnId: 'extension',
+            isExpanded: false,
+          }}
+          field={{ name: 'extension', filterable: true } as DataViewField}
+          isPlainRecord={false}
         />
       </UnifiedDataTableContext.Provider>
     );
     const button = findTestSubject(component, 'filterForButton');
     await button.simulate('click');
-    expect(dataTableContextMock.onFilter).toHaveBeenCalledWith({}, 'jpg', '+');
+    expect(dataTableContextMock.onFilter).toHaveBeenCalledWith(
+      { name: 'extension', filterable: true },
+      'jpg',
+      '+'
+    );
   });
   it('triggers filter function when FilterInBtn is clicked for a non-provided value', async () => {
     const component = mountWithIntl(
       <UnifiedDataTableContext.Provider value={dataTableContextMock}>
         <FilterInBtn
-          Component={(props: any) => <EuiButton {...props} />}
-          rowIndex={0}
-          colIndex={1}
-          columnId="extension"
-          isExpanded={false}
+          cellActionProps={{
+            Component: (props: any) => <EuiButton {...props} />,
+            rowIndex: 0,
+            colIndex: 1,
+            columnId: 'extension',
+            isExpanded: false,
+          }}
+          field={{ name: 'extension', filterable: true } as DataViewField}
+          isPlainRecord={false}
         />
       </UnifiedDataTableContext.Provider>
     );
     const button = findTestSubject(component, 'filterForButton');
     await button.simulate('click');
-    expect(dataTableContextMock.onFilter).toHaveBeenCalledWith({}, undefined, '+');
+    expect(dataTableContextMock.onFilter).toHaveBeenCalledWith(
+      { name: 'extension', filterable: true },
+      undefined,
+      '+'
+    );
   });
   it('triggers filter function when FilterInBtn is clicked for an empty string value', async () => {
     const component = mountWithIntl(
       <UnifiedDataTableContext.Provider value={dataTableContextMock}>
         <FilterInBtn
-          Component={(props: any) => <EuiButton {...props} />}
-          rowIndex={4}
-          colIndex={1}
-          columnId="message"
-          isExpanded={false}
+          cellActionProps={{
+            Component: (props: any) => <EuiButton {...props} />,
+            rowIndex: 4,
+            colIndex: 1,
+            columnId: 'message',
+            isExpanded: false,
+          }}
+          field={{ name: 'message', filterable: true } as DataViewField}
+          isPlainRecord={false}
         />
       </UnifiedDataTableContext.Provider>
     );
     const button = findTestSubject(component, 'filterForButton');
     await button.simulate('click');
-    expect(dataTableContextMock.onFilter).toHaveBeenCalledWith({}, '', '+');
+    expect(dataTableContextMock.onFilter).toHaveBeenCalledWith(
+      { name: 'message', filterable: true },
+      '',
+      '+'
+    );
   });
   it('triggers filter function when FilterOutBtn is clicked', async () => {
     const component = mountWithIntl(
       <UnifiedDataTableContext.Provider value={dataTableContextMock}>
         <FilterOutBtn
-          Component={(props: any) => <EuiButton {...props} />}
-          rowIndex={1}
-          colIndex={1}
-          columnId="extension"
-          isExpanded={false}
+          cellActionProps={{
+            Component: (props: any) => <EuiButton {...props} />,
+            rowIndex: 1,
+            colIndex: 1,
+            columnId: 'extension',
+            isExpanded: false,
+          }}
+          field={{ name: 'extension', filterable: true } as DataViewField}
+          isPlainRecord={false}
         />
       </UnifiedDataTableContext.Provider>
     );
     const button = findTestSubject(component, 'filterOutButton');
     await button.simulate('click');
-    expect(dataTableContextMock.onFilter).toHaveBeenCalledWith({}, 'jpg', '-');
+    expect(dataTableContextMock.onFilter).toHaveBeenCalledWith(
+      { name: 'extension', filterable: true },
+      'jpg',
+      '-'
+    );
   });
   it('triggers clipboard copy when CopyBtn is clicked', async () => {
     const component = mountWithIntl(