fix EQL rule creation from a timeline

elastic · Nov 23, 2024 · f7eeda7 · f7eeda7
1 parent 5d470f2
commit f7eeda7
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 119 deletions.
diff --git a/x-pack/plugins/security_solution/public/common/utils/use_set_field_value_cb.test.ts b/x-pack/plugins/security_solution/public/common/utils/use_set_field_value_cb.test.ts
diff --git a/x-pack/plugins/security_solution/public/common/utils/use_set_field_value_cb.ts b/x-pack/plugins/security_solution/public/common/utils/use_set_field_value_cb.ts
diff --git a/...tion/public/detection_engine/rule_creation/components/esql_query_edit/esql_query_edit.tsx b/...tion/public/detection_engine/rule_creation/components/esql_query_edit/esql_query_edit.tsx
@@ -13,10 +13,10 @@ import type { FieldConfig } from '../../../../shared_imports';
 import { UseField } from '../../../../shared_imports';
 import type { FieldValueQueryBar } from '../../../rule_creation_ui/components/query_bar_field';
 import { QueryBarField } from '../../../rule_creation_ui/components/query_bar_field';
+import { esqlQueryRequiredValidatorFactory } from './validators/esql_query_required_validator_factory';
 import { esqlQueryValidatorFactory } from './validators/esql_query_validator_factory';
 import { EsqlInfoIcon } from './esql_info_icon';
 import * as i18n from './translations';
-import { esqlQueryRequiredValidatorFactory } from './validators/esql_query_required_validator_factory';
 
 interface EsqlQueryEditProps {
   path: string;

diff --git a/...y_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx b/...y_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx
@@ -26,7 +26,6 @@ import type { FieldSpec } from '@kbn/data-plugin/common';
 import type { SavedQuery } from '@kbn/data-plugin/public';
 import type { DataViewBase } from '@kbn/es-query';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { useSetFieldValueWithCallback } from '../../../../common/utils/use_set_field_value_cb';
 import type { SetRuleQuery } from '../../../../detections/containers/detection_engine/rules/use_rule_from_timeline';
 import { useRuleFromTimeline } from '../../../../detections/containers/detection_engine/rules/use_rule_from_timeline';
 import { isMlRule } from '../../../../../common/machine_learning/helpers';
@@ -196,12 +195,6 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   const alertSuppressionUpsellingMessage = useUpsellingMessage('alert_suppression_rule_form');
   const { getFields, reset, setFieldValue } = form;
 
-  const setRuleTypeCallback = useSetFieldValueWithCallback({
-    field: 'ruleType',
-    value: ruleType,
-    setFieldValue,
-  });
-
   // Callback for when user toggles between Data Views and Index Patterns
   const onChangeDataSource = useCallback(
     (optionId: string) => {
@@ -258,19 +251,26 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   const handleSetRuleFromTimeline = useCallback<SetRuleQuery>(
     ({ index: timelineIndex, queryBar: timelineQueryBar, eqlOptions }) => {
       const setQuery = () => {
+        setPersistentEqlQuery(timelineQueryBar);
         setFieldValue('index', timelineIndex);
         setFieldValue('queryBar', timelineQueryBar);
       };
       if (timelineQueryBar.query.language === 'eql') {
-        setPersistentEqlQuery(timelineQueryBar);
-        setPersistentEqlOptions(eqlOptions ?? {});
-        setRuleTypeCallback('eql', setQuery);
-        setFieldValue('eqlOptions', eqlOptions ?? {});
+        setFieldValue('ruleType', 'eql');
+
+        // Forms needs to be re-rendered with a new rule type first
+        // setTimeout is used to delay setting rule type specific values.
+        // Without that form turns out in an "impossible" state.
+        setTimeout(() => {
+          setPersistentEqlOptions(eqlOptions ?? {});
+          setQuery();
+          setFieldValue('eqlOptions', eqlOptions ?? {});
+        });
       } else {
         setQuery();
       }
     },
-    [setFieldValue, setRuleTypeCallback, setPersistentEqlQuery, setPersistentEqlOptions]
+    [setFieldValue, setPersistentEqlQuery, setPersistentEqlOptions]
   );
 
   const { onOpenTimeline, loading: timelineQueryLoading } =
@@ -620,20 +620,17 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
             <>
               <EuiSpacer size="s" />
               {isEqlRule(ruleType) ? (
-                <>
-                  <EqlQueryEdit
-                    key="eqlQueryBar"
-                    path="queryBar"
-                    eqlOptionsPath="eqlOptions"
-                    fieldsToValidateOnChange={ALERT_SUPPRESSION_FIELDS_FIELD_NAME}
-                    required
-                    showFilterBar
-                    dataView={indexPattern}
-                    loading={isIndexPatternLoading}
-                    disabled={isLoading}
-                    onValidityChange={setIsQueryBarValid}
-                  />
-                </>
+                <EqlQueryEdit
+                  path="queryBar"
+                  eqlOptionsPath="eqlOptions"
+                  fieldsToValidateOnChange={ALERT_SUPPRESSION_FIELDS_FIELD_NAME}
+                  required
+                  showFilterBar
+                  dataView={indexPattern}
+                  loading={isIndexPatternLoading}
+                  disabled={isLoading}
+                  onValidityChange={setIsQueryBarValid}
+                />
               ) : isEsqlRule(ruleType) ? (
                 <EsqlQueryEdit
                   path="queryBar"