Merge branch 'main' into eui/62.0.3

packages/kbn-doc-links/src/get_doc_links.ts

@@ -357,7 +357,7 @@ export const getDocLinks = ({ kibanaBranch }: GetDocLinkOptions): DocLinks => {
       policyResponseTroubleshooting: {
         full_disk_access: `${SECURITY_SOLUTION_DOCS}deploy-elastic-endpoint.html#enable-fda-endpoint`,
         macos_system_ext: `${SECURITY_SOLUTION_DOCS}deploy-elastic-endpoint.html#system-extension-endpoint`,
-        linux_deadlock: `${SECURITY_SOLUTION_DOCS}ts-management.html`,
+        linux_deadlock: `${SECURITY_SOLUTION_DOCS}ts-management.html#linux-deadlock`,
       },
       responseActions: `${SECURITY_SOLUTION_DOCS}response-actions.html`,
     },

src/plugins/data_view_editor/public/lib/get_indices.test.ts

@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { getIndices, responseToItemArray } from './get_indices';
+import { getIndices, getIndicesViaResolve, responseToItemArray } from './get_indices';
 import { httpServiceMock } from '@kbn/core/public/mocks';
 import { ResolveIndexResponseItemIndexAttrs } from '../types';
 
@@ -39,6 +39,10 @@ const http = httpServiceMock.createStartContract();
 http.get.mockResolvedValue(successfulResolveResponse);
 
 describe('getIndices', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
   it('should work in a basic case', async () => {
     const uncalledSearchClient = jest.fn();
     const result = await getIndices({
@@ -103,6 +107,23 @@ describe('getIndices', () => {
     expect(responseToItemArray({}, getTags)).toEqual([]);
   });
 
+  describe('getIndicesViaResolve', () => {
+    it('should encode the pattern for a working URI', async () => {
+      const spy = jest.spyOn(http, 'get');
+      const pattern = 'test-%';
+      await getIndicesViaResolve({
+        http,
+        pattern,
+        showAllIndices: true,
+        isRollupIndex: () => false,
+      });
+      expect(spy).toHaveBeenCalledWith(
+        '/internal/index-pattern-management/resolve_index/test-%25',
+        { query: { expand_wildcards: 'all' } }
+      );
+    });
+  });
+
   describe('errors', () => {
     it('should handle thrown errors gracefully', async () => {
       http.get.mockImplementationOnce(() => {

src/plugins/data_view_editor/public/lib/get_indices.ts

@@ -50,18 +50,23 @@ export const getIndicesViaResolve = async ({
   pattern: string;
   showAllIndices: boolean;
   isRollupIndex: (indexName: string) => boolean;
-}) =>
-  http
-    .get<ResolveIndexResponse>(`/internal/index-pattern-management/resolve_index/${pattern}`, {
-      query: showAllIndices ? { expand_wildcards: 'all' } : undefined,
-    })
+}) => {
+  const encodedPattern = encodeURIComponent(pattern);
+  return http
+    .get<ResolveIndexResponse>(
+      `/internal/index-pattern-management/resolve_index/${encodedPattern}`,
+      {
+        query: showAllIndices ? { expand_wildcards: 'all' } : undefined,
+      }
+    )
     .then((response) => {
       if (!response) {
         return [];
       } else {
         return responseToItemArray(response, getIndexTags(isRollupIndex));
       }
     });
+};
 
 export async function getIndices({
   http,

src/plugins/data_views/common/data_views/data_view.test.ts

@@ -6,19 +6,15 @@
  * Side Public License, v 1.
  */
 
-import { map, last } from 'lodash';
-
-import { DataView } from './data_view';
-
+import { FieldFormat } from '@kbn/field-formats-plugin/common';
+import { fieldFormatsMock } from '@kbn/field-formats-plugin/common/mocks';
 import { CharacterNotAllowedInField } from '@kbn/kibana-utils-plugin/common';
-
+import { last, map } from 'lodash';
+import { stubbedSavedObjectIndexPattern } from '../data_view.stub';
+import { stubLogstashFields } from '../field.stub';
 import { DataViewField } from '../fields';
-
-import { fieldFormatsMock } from '@kbn/field-formats-plugin/common/mocks';
-import { FieldFormat } from '@kbn/field-formats-plugin/common';
 import { RuntimeField, RuntimeTypeExceptComposite } from '../types';
-import { stubLogstashFields } from '../field.stub';
-import { stubbedSavedObjectIndexPattern } from '../data_view.stub';
+import { DataView } from './data_view';
 
 class MockFieldFormatter {}
 
@@ -41,7 +37,7 @@ const runtimeField = {
   type: 'string',
 };
 
-fieldFormatsMock.getInstance = jest.fn().mockImplementation(() => new MockFieldFormatter()) as any;
+fieldFormatsMock.getInstance = jest.fn().mockImplementation(() => new MockFieldFormatter());
 
 // helper function to create index patterns
 function create(id: string, spec?: object) {
@@ -309,6 +305,29 @@ describe('IndexPattern', () => {
       expect(indexPattern.toSpec()!.fields!['@tags'].runtimeField).toBeUndefined();
     });
 
+    test('ignore runtime field mapping if a mapped field exists with the same name', () => {
+      expect(indexPattern.getRuntimeMappings()).toEqual({
+        runtime_field: { script: { source: "emit('hello world')" }, type: 'keyword' },
+      });
+
+      // add a runtime field called "theme"
+      indexPattern.addRuntimeField('theme', runtimeWithAttrs);
+
+      // add a new mapped field also called "theme"
+      indexPattern.fields.add({
+        name: 'theme',
+        type: 'keyword',
+        aggregatable: true,
+        searchable: true,
+        readFromDocValues: false,
+        isMapped: true,
+      });
+
+      expect(indexPattern.getRuntimeMappings()).toEqual({
+        runtime_field: { script: { source: "emit('hello world')" }, type: 'keyword' },
+      });
+    });
+
     test('add and remove runtime field as new field', () => {
       indexPattern.addRuntimeField('new_field', runtimeWithAttrs);
       expect(indexPattern.toSpec().runtimeFieldMap).toEqual({
@@ -354,9 +373,9 @@ describe('IndexPattern', () => {
       expect(indexPattern.toSpec()!.fields!.new_field).toBeUndefined();
     });
 
-    test('should not allow runtime field with * in name', async () => {
+    test('should not allow runtime field with * in name', () => {
       try {
-        await indexPattern.addRuntimeField('test*123', runtime);
+        indexPattern.addRuntimeField('test*123', runtime);
       } catch (e) {
         expect(e).toBeInstanceOf(CharacterNotAllowedInField);
       }

src/plugins/data_views/common/data_views/data_view.ts

@@ -496,6 +496,7 @@ export class DataView implements DataViewBase {
 
   /**
    * Get all runtime field definitions.
+   * NOTE: this does not strip out runtime fields that match mapped field names
    * @returns map of runtime field definitions by field name
    */
 
@@ -582,8 +583,19 @@ export class DataView implements DataViewBase {
    * Return the "runtime_mappings" section of the ES search query.
    */
   getRuntimeMappings(): estypes.MappingRuntimeFields {
-    // @ts-expect-error The ES client does not yet include the "composite" runtime type
-    return _.cloneDeep(this.runtimeFieldMap);
+    const mappedFields = this.getMappedFieldNames();
+    const records = Object.keys(this.runtimeFieldMap).reduce<Record<string, RuntimeFieldSpec>>(
+      (acc, fieldName) => {
+        // do not include fields that are mapped
+        if (!mappedFields.includes(fieldName)) {
+          acc[fieldName] = this.runtimeFieldMap[fieldName];
+        }
+
+        return acc;
+      },
+      {}
+    );
+    return records as estypes.MappingRuntimeFields;
   }
 
   /**
@@ -667,6 +679,15 @@ export class DataView implements DataViewBase {
     delete this.fieldFormatMap[fieldName];
   };
 
+  private getMappedFieldNames() {
+    return this.fields.getAll().reduce<string[]>((acc, dataViewField) => {
+      if (dataViewField.isMapped) {
+        acc.push(dataViewField.name);
+      }
+      return acc;
+    }, []);
+  }
+
   /**
    * Add composite runtime field and all subfields.
    * @param name field name

test/functional/apps/management/_exclude_index_pattern.ts

@@ -12,9 +12,12 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['settings']);
   const es = getService('es');
+  const security = getService('security');
 
   describe('creating and deleting default index', function describeIndexTests() {
-    it('data view creation with exclusion', async () => {
+    before(async function () {
+      await security.testUser.setRoles(['kibana_admin', 'index_a', 'index_b']);
+      await PageObjects.settings.navigateTo();
       await es.transport.request({
         path: '/index-a/_doc',
         method: 'POST',
@@ -26,13 +29,26 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         method: 'POST',
         body: { title: 'hello' },
       });
-
       await PageObjects.settings.createIndexPattern('index-*,-index-b');
+    });
 
+    it('data view creation with exclusion', async () => {
       const fieldCount = await PageObjects.settings.getFieldsTabCount();
-
       // five metafields plus keyword and text version of 'user' field
       expect(parseInt(fieldCount, 10)).to.be(6);
     });
+
+    after(async () => {
+      await es.transport.request({
+        path: '/index-a',
+        method: 'DELETE',
+      });
+      await es.transport.request({
+        path: '/index-b',
+        method: 'DELETE',
+      });
+      await PageObjects.settings.removeIndexPattern();
+      await security.testUser.restoreDefaults();
+    });
   });
 }

test/functional/config.base.js

@@ -249,6 +249,36 @@ export default async function ({ readConfigFile }) {
           kibana: [],
         },
 
+        index_a: {
+          elasticsearch: {
+            cluster: [],
+            indices: [
+              {
+                names: ['index-a'],
+                privileges: ['read', 'view_index_metadata', 'manage', 'create_index', 'index'],
+                field_security: { grant: ['*'], except: [] },
+              },
+            ],
+            run_as: [],
+          },
+          kibana: [],
+        },
+
+        index_b: {
+          elasticsearch: {
+            cluster: [],
+            indices: [
+              {
+                names: ['index-b'],
+                privileges: ['read', 'view_index_metadata', 'manage', 'create_index', 'index'],
+                field_security: { grant: ['*'], except: [] },
+              },
+            ],
+            run_as: [],
+          },
+          kibana: [],
+        },
+
         kibana_sample_read: {
           elasticsearch: {
             cluster: [],

x-pack/plugins/security_solution/public/management/components/policy_response/policy_response_friendly_names.ts

@@ -390,8 +390,13 @@ export const descriptions = Object.freeze(
     ],
     [
       'linux_deadlock',
-      // intentionally blank for now: https://github.com/elastic/security-team/issues/4264#issuecomment-1194136633
-      '',
+      i18n.translate(
+        'xpack.securitySolution.endpoint.details.policyResponse.description.linux_deadlock',
+        {
+          defaultMessage:
+            'Malware protection was disabled to avoid a potential system deadlock. To resolve this issue, the file systems causing this need to be identified in integration policy advanced settings (linux.advanced.fanotify.ignored_filesystems). Learn more in our',
+        }
+      ),
     ],
   ])
 );
@@ -421,7 +426,7 @@ const linkTexts = Object.freeze(
       i18n.translate(
         'xpack.securitySolution.endpoint.details.policyResponse.link.text.linux_deadlock',
         {
-          defaultMessage: ' Learn more.',
+          defaultMessage: ' troubleshooting docs.',
         }
       ),
     ],