[Maps] Add query bar inputs to geo threshold alerts tracked points & boundaries

x-pack/plugins/stack_alerts/server/alert_types/geo_threshold/alert_type.ts

@@ -15,6 +15,7 @@ import {
   ActionVariable,
   AlertTypeState,
 } from '../../../../alerts/server';
+import { Query } from '../../../../../../src/plugins/data/common/query';
 
 export const GEO_THRESHOLD_ID = '.geo-threshold';
 export type TrackingEvent = 'entered' | 'exited';
@@ -155,6 +156,8 @@ export const ParamsSchema = schema.object({
   boundaryGeoField: schema.string({ minLength: 1 }),
   boundaryNameField: schema.maybe(schema.string({ minLength: 1 })),
   delayOffsetWithUnits: schema.maybe(schema.string({ minLength: 1 })),
+  indexQuery: schema.maybe(schema.any({})),
+  boundaryIndexQuery: schema.maybe(schema.any({})),
 });
 
 export interface GeoThresholdParams {
@@ -170,6 +173,8 @@ export interface GeoThresholdParams {
   boundaryGeoField: string;
   boundaryNameField?: string;
   delayOffsetWithUnits?: string;
+  indexQuery?: Query;
+  boundaryIndexQuery?: Query;
 }
 
 export function getAlertType(

x-pack/plugins/stack_alerts/server/alert_types/geo_threshold/es_query_builder.ts

@@ -7,21 +7,42 @@
 import { ILegacyScopedClusterClient } from 'kibana/server';
 import { SearchResponse } from 'elasticsearch';
 import { Logger } from '../../types';
+import {
+  Query,
+  IIndexPattern,
+  fromKueryExpression,
+  toElasticsearchQuery,
+  luceneStringToDsl,
+} from '../../../../../../src/plugins/data/common';
 
 export const OTHER_CATEGORY = 'other';
 // Consider dynamically obtaining from config?
 const MAX_TOP_LEVEL_QUERY_SIZE = 0;
 const MAX_SHAPES_QUERY_SIZE = 10000;
 const MAX_BUCKETS_LIMIT = 65535;
 
+const getEsFormattedQuery = (query: Query, indexPattern?: IIndexPattern) => {
+  let esFormattedQuery;
+
+  const queryLanguage = query.language;
+  if (queryLanguage === 'kuery') {
+    const ast = fromKueryExpression(query.query);
+    esFormattedQuery = toElasticsearchQuery(ast, indexPattern);
+  } else {
+    esFormattedQuery = luceneStringToDsl(query.query);
+  }
+  return esFormattedQuery;
+};
+
 export async function getShapesFilters(
   boundaryIndexTitle: string,
   boundaryGeoField: string,
   geoField: string,
   callCluster: ILegacyScopedClusterClient['callAsCurrentUser'],
   log: Logger,
   alertId: string,
-  boundaryNameField?: string
+  boundaryNameField?: string,
+  boundaryIndexQuery?: Query
 ) {
   const filters: Record<string, unknown> = {};
   const shapesIdsNamesMap: Record<string, unknown> = {};
@@ -30,8 +51,10 @@ export async function getShapesFilters(
     index: boundaryIndexTitle,
     body: {
       size: MAX_SHAPES_QUERY_SIZE,
+      ...(boundaryIndexQuery ? { query: getEsFormattedQuery(boundaryIndexQuery) } : {}),
     },
   });
+
   boundaryData.hits.hits.forEach(({ _index, _id }) => {
     filters[_id] = {
       geo_shape: {
@@ -66,6 +89,7 @@ export async function executeEsQueryFactory(
     boundaryGeoField,
     geoField,
     boundaryIndexTitle,
+    indexQuery,
   }: {
     entity: string;
     index: string;
@@ -74,6 +98,7 @@ export async function executeEsQueryFactory(
     geoField: string;
     boundaryIndexTitle: string;
     boundaryNameField?: string;
+    indexQuery?: Query;
   },
   { callCluster }: { callCluster: ILegacyScopedClusterClient['callAsCurrentUser'] },
   log: Logger,
@@ -83,6 +108,19 @@ export async function executeEsQueryFactory(
     gteDateTime: Date | null,
     ltDateTime: Date | null
   ): Promise<SearchResponse<unknown> | undefined> => {
+    let esFormattedQuery;
+    if (indexQuery) {
+      const gteEpochDateTime = gteDateTime ? new Date(gteDateTime).getTime() : null;
+      const ltEpochDateTime = ltDateTime ? new Date(ltDateTime).getTime() : null;
+      const dateRangeUpdatedQuery =
+        indexQuery.language === 'kuery'
+          ? `(${dateField} >= "${gteEpochDateTime}" and ${dateField} < "${ltEpochDateTime}") and (${indexQuery.query})`
+          : `(${dateField}:[${gteDateTime} TO ${ltDateTime}]) AND (${indexQuery.query})`;
+      esFormattedQuery = getEsFormattedQuery({
+        query: dateRangeUpdatedQuery,
+        language: indexQuery.language,
+      });
+    }
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const esQuery: Record<string, any> = {
       index,
@@ -120,27 +158,29 @@ export async function executeEsQueryFactory(
             },
           },
         },
-        query: {
-          bool: {
-            must: [],
-            filter: [
-              {
-                match_all: {},
-              },
-              {
-                range: {
-                  [dateField]: {
-                    ...(gteDateTime ? { gte: gteDateTime } : {}),
-                    lt: ltDateTime, // 'less than' to prevent overlap between intervals
-                    format: 'strict_date_optional_time',
+        query: esFormattedQuery
+          ? esFormattedQuery
+          : {
+              bool: {
+                must: [],
+                filter: [
+                  {
+                    match_all: {},
                   },
-                },
+                  {
+                    range: {
+                      [dateField]: {
+                        ...(gteDateTime ? { gte: gteDateTime } : {}),
+                        lt: ltDateTime, // 'less than' to prevent overlap between intervals
+                        format: 'strict_date_optional_time',
+                      },
+                    },
+                  },
+                ],
+                should: [],
+                must_not: [],
               },
-            ],
-            should: [],
-            must_not: [],
-          },
-        },
+            },
         stored_fields: ['*'],
         docvalue_fields: [
           {

x-pack/plugins/stack_alerts/server/alert_types/geo_threshold/geo_threshold.ts

@@ -194,7 +194,8 @@ export const getGeoThresholdExecutor = ({ logger: log }: { logger: Logger }) =>
           services.callCluster,
           log,
           alertId,
-          params.boundaryNameField
+          params.boundaryNameField,
+          params.boundaryIndexQuery
         );
 
     const executeEsQuery = await executeEsQueryFactory(params, services, log, shapesFilters);

x-pack/plugins/triggers_actions_ui/kibana.json

@@ -4,8 +4,8 @@
   "server": true,
   "ui": true,
   "optionalPlugins": ["alerts", "stackAlerts", "features", "home"],
-  "requiredPlugins": ["management", "charts", "data", "kibanaReact"],
+  "requiredPlugins": ["management", "charts", "data", "kibanaReact", "savedObjects"],
   "configPath": ["xpack", "trigger_actions_ui"],
   "extraPublicDirs": ["public/common", "public/common/constants"],
-  "requiredBundles": ["home", "alerts", "esUiShared"]
+  "requiredBundles": ["home", "alerts", "esUiShared", "kibanaReact", "kibanaUtils"]
 }

x-pack/plugins/triggers_actions_ui/public/application/app.tsx

@@ -15,6 +15,7 @@ import {
   ChromeBreadcrumb,
   CoreStart,
   ScopedHistory,
+  SavedObjectsClientContract,
 } from 'kibana/public';
 import { Section, routeToAlertDetails } from './constants';
 import { KibanaFeature } from '../../../features/common';
@@ -24,27 +25,32 @@ import { ChartsPluginStart } from '../../../../../src/plugins/charts/public';
 import { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
 import { PluginStartContract as AlertingStart } from '../../../alerts/public';
 import { suspendedComponentWithProps } from './lib/suspended_component_with_props';
+import { Storage } from '../../../../../src/plugins/kibana_utils/public';
 
 const TriggersActionsUIHome = lazy(async () => import('./home'));
 const AlertDetailsRoute = lazy(
   () => import('./sections/alert_details/components/alert_details_route')
 );
 
 export interface AppDeps {
-  dataPlugin: DataPublicPluginStart;
+  data: DataPublicPluginStart;
   charts: ChartsPluginStart;
   chrome: ChromeStart;
   alerts?: AlertingStart;
   navigateToApp: CoreStart['application']['navigateToApp'];
   docLinks: DocLinksStart;
   toastNotifications: ToastsSetup;
+  storage?: Storage;
   http: HttpSetup;
   uiSettings: IUiSettingsClient;
   setBreadcrumbs: (crumbs: ChromeBreadcrumb[]) => void;
   capabilities: ApplicationStart['capabilities'];
   actionTypeRegistry: ActionTypeRegistryContract;
   alertTypeRegistry: AlertTypeRegistryContract;
   history: ScopedHistory;
+  savedObjects?: {
+    client: SavedObjectsClientContract;
+  };
   kibanaFeatures: KibanaFeature[];
 }
 

x-pack/plugins/triggers_actions_ui/public/application/app_context.tsx

@@ -5,6 +5,7 @@
  */
 
 import React, { createContext, useContext } from 'react';
+import { KibanaContextProvider } from '../../../../../src/plugins/kibana_react/public';
 import { AppDeps } from './app';
 
 const AppContext = createContext<AppDeps | null>(null);
@@ -16,7 +17,11 @@ export const AppContextProvider = ({
   appDeps: AppDeps | null;
   children: React.ReactNode;
 }) => {
-  return appDeps ? <AppContext.Provider value={appDeps}>{children}</AppContext.Provider> : null;
+  return appDeps ? (
+    <KibanaContextProvider services={appDeps}>
+      <AppContext.Provider value={appDeps}>{children}</AppContext.Provider>
+    </KibanaContextProvider>
+  ) : null;
 };
 
 export const useAppDependencies = (): AppDeps => {

x-pack/plugins/triggers_actions_ui/public/application/boot.tsx

@@ -6,21 +6,20 @@
 
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
-import { SavedObjectsClientContract } from 'src/core/public';
-
 import { App, AppDeps } from './app';
 import { setSavedObjectsClient } from '../common/lib/index_threshold_api';
 
 interface BootDeps extends AppDeps {
   element: HTMLElement;
-  savedObjects: SavedObjectsClientContract;
   I18nContext: any;
 }
 
 export const boot = (bootDeps: BootDeps) => {
-  const { I18nContext, element, savedObjects, ...appDeps } = bootDeps;
+  const { I18nContext, element, ...appDeps } = bootDeps;
 
-  setSavedObjectsClient(savedObjects);
+  if (appDeps.savedObjects) {
+    setSavedObjectsClient(appDeps.savedObjects.client);
+  }
 
   render(
     <I18nContext>

x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/geo_threshold/query_builder/index.tsx

@@ -28,6 +28,12 @@ import { EntityByExpression } from './expressions/entity_by_expression';
 import { BoundaryIndexExpression } from './expressions/boundary_index_expression';
 import { IIndexPattern } from '../../../../../../../../../src/plugins/data/common/index_patterns';
 import { getTimeOptions } from '../../../../../common/lib/get_time_options';
+import {
+  esQuery,
+  Query,
+  QueryStringInput,
+} from '../../../../../../../../../src/plugins/data/public';
+import { esKuery } from '../../../../../../../../../src/plugins/data/public';
 
 const DEFAULT_VALUES = {
   TRACKING_EVENT: '',
@@ -65,20 +71,34 @@ const labelForDelayOffset = (
   </>
 );
 
+function validateQuery(query: Query) {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-unused-expressions
+    query.language === 'kuery'
+      ? esKuery.fromKueryExpression(query.query)
+      : esQuery.luceneStringToDsl(query.query);
+  } catch (err) {
+    return false;
+  }
+  return true;
+}
+
 export const GeoThresholdAlertTypeExpression: React.FunctionComponent<AlertTypeParamsExpressionProps<
   GeoThresholdAlertParams,
   AlertsContextValue
 >> = ({ alertParams, alertInterval, setAlertParams, setAlertProperty, errors, alertsContext }) => {
   const {
     index,
     indexId,
+    indexQuery,
     geoField,
     entity,
     dateField,
     trackingEvent,
     boundaryType,
     boundaryIndexTitle,
     boundaryIndexId,
+    boundaryIndexQuery,
     boundaryGeoField,
     boundaryNameField,
     delayOffsetWithUnits,
@@ -100,6 +120,12 @@ export const GeoThresholdAlertTypeExpression: React.FunctionComponent<AlertTypeP
       }
     }
   };
+  const [tempIndexQuery, setTempIndexQuery] = useState<Query>(
+    indexQuery || {
+      query: '',
+      language: 'kuery',
+    }
+  );
   const [boundaryIndexPattern, _setBoundaryIndexPattern] = useState<IIndexPattern>({
     id: '',
     fields: [],
@@ -116,6 +142,12 @@ export const GeoThresholdAlertTypeExpression: React.FunctionComponent<AlertTypeP
       }
     }
   };
+  const [tempBoundaryIndexQuery, setTempBoundaryIndexQuery] = useState<Query>(
+    boundaryIndexQuery || {
+      query: '',
+      language: 'kuery',
+    }
+  );
   const [delayOffset, _setDelayOffset] = useState<number>(0);
   function setDelayOffset(_delayOffset: number) {
     setAlertParams('delayOffsetWithUnits', `${_delayOffset}${delayOffsetUnit}`);
@@ -246,6 +278,23 @@ export const GeoThresholdAlertTypeExpression: React.FunctionComponent<AlertTypeP
         indexFields={indexPattern.fields}
         isInvalid={indexId && dateField && geoField ? !entity : false}
       />
+      <EuiSpacer size="s" />
+      <EuiFlexItem>
+        <QueryStringInput
+          disableAutoFocus
+          bubbleSubmitEvent
+          indexPatterns={indexPattern ? [indexPattern] : []}
+          query={tempIndexQuery}
+          onChange={(query) => {
+            if (query.language) {
+              if (validateQuery(query)) {
+                setAlertParams('indexQuery', query);
+              }
+              setTempIndexQuery(query);
+            }
+          }}
+        />
+      </EuiFlexItem>
 
       <EuiSpacer size="l" />
       <EuiTitle size="xs">
@@ -314,6 +363,24 @@ export const GeoThresholdAlertTypeExpression: React.FunctionComponent<AlertTypeP
         }
         boundaryNameField={boundaryNameField}
       />
+      <EuiSpacer size="s" />
+      <EuiFlexItem>
+        <QueryStringInput
+          disableAutoFocus
+          bubbleSubmitEvent
+          indexPatterns={boundaryIndexPattern ? [boundaryIndexPattern] : []}
+          query={tempBoundaryIndexQuery}
+          onChange={(query) => {
+            if (query.language) {
+              if (validateQuery(query)) {
+                setAlertParams('boundaryIndexQuery', query);
+              }
+              setTempBoundaryIndexQuery(query);
+            }
+          }}
+        />
+      </EuiFlexItem>
+      <EuiSpacer size="l" />
     </Fragment>
   );
 };