From d4d8b6ac2a72d01bfeaf749f895caf1a7cc88351 Mon Sep 17 00:00:00 2001
From: Christos Nasikas <christos.nasikas@elastic.co>
Date: Wed, 15 Jul 2020 12:33:41 +0300
Subject: [PATCH] Fix test

---
 .../signals/get_filter.test.ts                | 85 +++++++++----------
 1 file changed, 40 insertions(+), 45 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
index f34879781e0b02..a5740d7719f475 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.test.ts
@@ -192,71 +192,66 @@ describe('get_filter', () => {
         index: ['auditbeat-*'],
         lists: [getExceptionListItemSchemaMock()],
       });
+
       expect(filter).toEqual({
         bool: {
+          must: [],
           filter: [
             {
               bool: {
-                filter: [
+                should: [
                   {
-                    bool: {
-                      minimum_should_match: 1,
-                      should: [
-                        {
-                          match: {
-                            'host.name': 'siem',
-                          },
-                        },
-                      ],
+                    match: {
+                      'host.name': 'siem',
                     },
                   },
-                  {
-                    bool: {
-                      filter: [
-                        {
-                          nested: {
-                            path: 'some.parentField',
-                            query: {
-                              bool: {
-                                minimum_should_match: 1,
-                                should: [
-                                  {
-                                    match: {
-                                      'some.parentField.nested.field': 'some value',
-                                    },
+                ],
+                minimum_should_match: 1,
+              },
+            },
+            {
+              bool: {
+                must_not: {
+                  bool: {
+                    filter: [
+                      {
+                        nested: {
+                          path: 'some.parentField',
+                          query: {
+                            bool: {
+                              should: [
+                                {
+                                  match_phrase: {
+                                    'some.parentField.nested.field': 'some value',
                                   },
-                                ],
-                              },
+                                },
+                              ],
+                              minimum_should_match: 1,
                             },
-                            score_mode: 'none',
                           },
+                          score_mode: 'none',
                         },
-                        {
-                          bool: {
-                            must_not: {
-                              bool: {
-                                minimum_should_match: 1,
-                                should: [
-                                  {
-                                    match: {
-                                      'some.not.nested.field': 'some value',
-                                    },
-                                  },
-                                ],
+                      },
+                      {
+                        bool: {
+                          should: [
+                            {
+                              match_phrase: {
+                                'some.not.nested.field': 'some value',
                               },
                             },
-                          },
+                          ],
+                          minimum_should_match: 1,
                         },
-                      ],
-                    },
+                      },
+                    ],
                   },
-                ],
+                },
               },
             },
           ],
-          must: [],
-          must_not: [],
           should: [],
+          must_not: [],
         },
       });
     });