remove multi spaces

x-pack/plugins/osquery/common/utils/build_query/remove_multilines.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const removeMultilines = (query: string): string =>
+  query.replaceAll('\n', ' ').replaceAll(/  +/g, ' ');

x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx

@@ -59,6 +59,7 @@ import {
   FormArrayField,
 } from '../../shared_imports';
 import { OsqueryIcon } from '../../components/osquery_icon';
+import { removeMultilines } from '../../../common/utils/build_query/remove_multilines';
 
 export const CommonUseField = getUseField({ component: Field });
 
@@ -746,7 +747,7 @@ export const ECSMappingEditorField = React.memo(
         return;
       }
 
-      const oneLineQuery = query.replaceAll('\n', ' ').replaceAll('  ', ' ');
+      const oneLineQuery = removeMultilines(query);
 
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       let ast: Record<string, any> | undefined;

x-pack/plugins/osquery/server/routes/pack/utils.test.ts

@@ -35,7 +35,7 @@ const oneLiner = {
   default: {
     ecs_mapping: {},
     interval: 3600,
-    query: `select u.username,    p.pid,    p.name,    pos.local_address,    pos.local_port,    p.path,    p.cmdline,    pos.remote_address,    pos.remote_port from processes as p join users as u   on u.uid=p.uid join process_open_sockets as pos   on pos.pid=p.pid where pos.remote_port !='0' limit 1000;`,
+    query: `select u.username, p.pid, p.name, pos.local_address, pos.local_port, p.path, p.cmdline, pos.remote_address, pos.remote_port from processes as p join users as u on u.uid=p.uid join process_open_sockets as pos on pos.pid=p.pid where pos.remote_port !='0' limit 1000;`,
   },
 };
 

x-pack/plugins/osquery/server/routes/pack/utils.ts

@@ -6,6 +6,7 @@
  */
 
 import { pick, reduce } from 'lodash';
+import { removeMultilines } from '../../../common/utils/build_query/remove_multilines';
 import { convertECSMappingToArray, convertECSMappingToObject } from '../utils';
 
 // @ts-expect-error update types
@@ -35,7 +36,7 @@ export const convertSOQueriesToPack = (queries, removeMultiLines?: boolean) =>
       const index = queryId ? queryId : key;
       acc[index] = {
         ...rest,
-        query: removeMultiLines ? query.replaceAll('\n', ' ').replaceAll('  ', ' ') : query,
+        query: removeMultiLines ? removeMultilines(query) : query,
         ecs_mapping: convertECSMappingToObject(ecs_mapping),
       };
 

x-pack/test/api_integration/apis/osquery/packs.ts

@@ -24,7 +24,7 @@ const getDefaultPack = ({ policyIds = [] }: { policyIds?: string[] }) => ({
 });
 
 const singleLineQuery =
-  "select u.username,    p.pid,    p.name,    pos.local_address,    pos.local_port,    p.path,    p.cmdline,    pos.remote_address,    pos.remote_port from processes as p join users as u   on u.uid=p.uid join process_open_sockets as pos   on pos.pid=p.pid where pos.remote_port !='0' limit 1000;";
+  "select u.username, p.pid, p.name, pos.local_address, pos.local_port, p.path, p.cmdline, pos.remote_address, pos.remote_port from processes as p join users as u on u.uid=p.uid join process_open_sockets as pos on pos.pid=p.pid where pos.remote_port !='0' limit 1000;";
 const multiLineQuery = `select u.username,
        p.pid,
        p.name,