[Security Sollution][Alerts] fixes rule preview issue for new terms f…

…ield
elastic · Nov 18, 2022 · 5b2a6d4 · 5b2a6d4
1 parent bca45a1
commit 5b2a6d4
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 16 deletions.
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/rule_preview/helpers.ts b/x-pack/plugins/security_solution/public/detections/components/rules/rule_preview/helpers.ts
@@ -15,6 +15,7 @@ import type { ChartSeriesConfigs } from '../../../../common/components/charts/co
 import type { FieldValueQueryBar } from '../query_bar';
 import type { TimeframePreviewOptions } from '../../../pages/detection_engine/rules/types';
 import { DataSourceType } from '../../../pages/detection_engine/rules/types';
+import { MAX_NUMBER_OF_NEW_TERMS_FIELDS } from '../../../../../common/constants';
 
 /**
  * Determines whether or not to display noise warning.
@@ -108,6 +109,10 @@ export const getHistogramConfig = (
   };
 };
 
+const isNewTermsPreviewDisabled = (newTermsFields: string[]): boolean => {
+  return newTermsFields.length === 0 || newTermsFields.length > MAX_NUMBER_OF_NEW_TERMS_FIELDS;
+};
+
 export const getIsRulePreviewDisabled = ({
   ruleType,
   isQueryBarValid,
@@ -157,7 +162,7 @@ export const getIsRulePreviewDisabled = ({
     return isEmpty(queryBar.query.query) && isEmpty(queryBar.filters);
   }
   if (ruleType === 'new_terms') {
-    return newTermsFields.length === 0;
+    return isNewTermsPreviewDisabled(newTermsFields);
   }
   return false;
 };
diff --git a/...k/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx b/...k/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
@@ -145,7 +145,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
     schema,
   });
 
-  const { getFields, getFormData, reset, submit } = form;
+  const { getFields, getFormData, reset, submit, validate } = form;
   const [formData] = useFormData<DefineStepRule>({
     form,
     watch: [
@@ -391,21 +391,18 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   }, [onSubmit]);
 
   const getData = useCallback(async () => {
-    const result = await submit();
-    result.data = {
-      ...result.data,
-      eqlOptions: optionsSelected,
+    // submit sometimes do not return correct validation state of form
+    // validate is called to ensure form validation state is up to date
+    const [result, isValid] = await Promise.all([submit(), validate()]);
+    return {
+      isValid,
+      data: {
+        // when result.isValid === false, result.data might be empty, so getFormData is called
+        ...(result.isValid ? result.data : getFormData()),
+        eqlOptions: optionsSelected,
+      },
     };
-    return result.isValid
-      ? result
-      : {
-          isValid: false,
-          data: {
-            ...getFormData(),
-            eqlOptions: optionsSelected,
-          },
-        };
-  }, [getFormData, optionsSelected, submit]);
+  }, [getFormData, optionsSelected, submit, validate]);
 
   useEffect(() => {
     let didCancel = false;