Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Metrics UI] Metrics threshold stores malformed KQL as an empty filter #119416

Closed
jasonrhodes opened this issue Nov 23, 2021 · 1 comment · Fixed by #119557
Closed

[Metrics UI] Metrics threshold stores malformed KQL as an empty filter #119416

jasonrhodes opened this issue Nov 23, 2021 · 1 comment · Fixed by #119557
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Team: Actionable Observability - DEPRECATED For Observability Alerting and SLOs use "Team:obs-ux-management", for AIops "Team:obs-knowledge" Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services v7.16.0 v8.0.0 v8.1.0

Comments

@jasonrhodes
Copy link
Member

jasonrhodes commented Nov 23, 2021

Summary

In the Metrics Threshold rule type, a user can add a KQL string filter to narrow down the results of a query for the rule to evaluate. It looks like this:

Metric threshold rule type create dialogue, KQL text input

If you take this same exact filter seen here and apply it in the Discover KQL bar and push "Enter", you'll see the following error:

Expected AND, OR, end of input, whitespace but 'A' found. host.name: (hyperion.local)AND host.architecture: 'x86_64' ---------------------------^

Expected AND, OR, end of input, whitespace but "A" found. host.name: (hyperion.local)AND host.architecture: "x86_64" ---------------------------^

Unfortunately, the KQL bar in the rule type create/edit dialogue doesn't catch this particular validation error. More importantly, when we attempt to parse the filter, we swallow any errors we encounter. This means that a malformed KQL string can be saved in the saved object's filterQuery field as '', even when that saved object's filterQueryText field (the raw string entered and shown in the create/edit UI) is not empty.

Since this filter is very important for a rule to work as intended, we need to be sure we validate this on the client side and stop swallowing errors we encounter while parsing the value.

Acceptance Criteria

  • KQL is validated on the client to the same degree as is being done in Discover, currently
  • Errors encountered while attempting to parse the filterQueryString should not be swallowed

Note: we should check our other rule types to see if this problem exists elsewhere, as well.

@jasonrhodes jasonrhodes added bug Fixes for quality problems that affect the customer experience v8.0.0 Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services v7.16.0 v8.1.0 Team: Actionable Observability - DEPRECATED For Observability Alerting and SLOs use "Team:obs-ux-management", for AIops "Team:obs-knowledge" labels Nov 23, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/infra-monitoring-ui (Team:Infra Monitoring UI)

@jasonrhodes jasonrhodes changed the title [Metrics UI] Metrics threshold stores mal-formed KQL as an empty filter [Metrics UI] Metrics threshold stores malformed KQL as an empty filter Nov 23, 2021
@Zacqary Zacqary self-assigned this Nov 23, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Team: Actionable Observability - DEPRECATED For Observability Alerting and SLOs use "Team:obs-ux-management", for AIops "Team:obs-knowledge" Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services v7.16.0 v8.0.0 v8.1.0
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants