forked from elastic/elasticsearch
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
EQL: Add integration tests harness to test EQL feature parity with or…
…iginal implementation The tests use the original test queries from https://github.com/endgameinc/eql/blob/master/eql/etc/test_queries.toml for EQL implementation correctness validation. The file test_queries_unsupported.toml serves as a "blacklist" for the queries that we do not support. Currently all of the queries are blacklisted. Over the time the expectation is to eventually have an empty "blacklist" when all of the queries are fully supported. The tests use the original test vector from https://raw.githubusercontent.com/endgameinc/eql/master/eql/etc/test_data.json that was translated to ECS format that matches the latest mapping being used for Endgame platform event streaming and is loaded from endgame.dat file. The endgame.json file contains the matching index mappings/setting. Only one EQL and the response is stubbed for now to match the expected output from that query. This part would need some tweaking after EQL is fully wired. The input .toml file is parsed by hand for now, which is sufficient for our purposes and avoids introducing another dependency just for this particular test case. Related to elastic#49581
- Loading branch information
Showing
18 changed files
with
5,771 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
58 changes: 58 additions & 0 deletions
58
.../plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequestBuilder.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.xpack.eql.action; | ||
|
|
||
| import org.elasticsearch.action.ActionRequestBuilder; | ||
| import org.elasticsearch.client.ElasticsearchClient; | ||
| import org.elasticsearch.index.query.QueryBuilder; | ||
|
|
||
| public class EqlSearchRequestBuilder extends ActionRequestBuilder<EqlSearchRequest, EqlSearchResponse> { | ||
| public EqlSearchRequestBuilder(ElasticsearchClient client, EqlSearchAction action) { | ||
| super(client, action, new EqlSearchRequest()); | ||
| } | ||
|
|
||
| public EqlSearchRequestBuilder indices(String... indices) { | ||
| request.indices(indices); | ||
| return this; | ||
| } | ||
|
|
||
| public EqlSearchRequestBuilder query(QueryBuilder query) { | ||
| request.query(query); | ||
| return this; | ||
| } | ||
|
|
||
| public EqlSearchRequestBuilder timestampField(String timestampField) { | ||
| request.timestampField(timestampField); | ||
| return this; | ||
| } | ||
|
|
||
| public EqlSearchRequestBuilder eventTypeField(String eventTypeField) { | ||
| request.eventTypeField(eventTypeField); | ||
| return this; | ||
| } | ||
|
|
||
| public EqlSearchRequestBuilder implicitJoinKeyField(String implicitJoinKeyField) { | ||
| request.implicitJoinKeyField(implicitJoinKeyField); | ||
| return this; | ||
| } | ||
|
|
||
| public EqlSearchRequestBuilder fetchSize(int size) { | ||
| request.fetchSize(size); | ||
| return this; | ||
| } | ||
|
|
||
| public EqlSearchRequestBuilder searchAfter(Object[] values) { | ||
| request.searchAfter(values); | ||
| return this; | ||
| } | ||
|
|
||
| public EqlSearchRequestBuilder rule(String rule) { | ||
| request.rule(rule); | ||
| return this; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
41 changes: 41 additions & 0 deletions
41
...plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/AbstractEqlIntegTestCase.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
| package org.elasticsearch.xpack.eql.action; | ||
|
|
||
| import org.elasticsearch.common.settings.Settings; | ||
| import org.elasticsearch.license.LicenseService; | ||
| import org.elasticsearch.plugins.Plugin; | ||
| import org.elasticsearch.test.ESIntegTestCase; | ||
| import org.elasticsearch.xpack.core.XPackSettings; | ||
| import org.elasticsearch.xpack.eql.plugin.EqlPlugin; | ||
|
|
||
| import java.util.Collection; | ||
| import java.util.Collections; | ||
|
|
||
| import static org.elasticsearch.test.ESIntegTestCase.Scope.SUITE; | ||
|
|
||
| @ESIntegTestCase.ClusterScope(scope = SUITE, numDataNodes = 0, numClientNodes = 0, maxNumDataNodes = 0) | ||
| public abstract class AbstractEqlIntegTestCase extends ESIntegTestCase { | ||
|
|
||
| @Override | ||
| protected Settings nodeSettings(int nodeOrdinal) { | ||
| Settings.Builder settings = Settings.builder().put(super.nodeSettings(nodeOrdinal)); | ||
| settings.put(XPackSettings.SECURITY_ENABLED.getKey(), false); | ||
| settings.put(XPackSettings.MONITORING_ENABLED.getKey(), false); | ||
| settings.put(XPackSettings.WATCHER_ENABLED.getKey(), false); | ||
| settings.put(XPackSettings.GRAPH_ENABLED.getKey(), false); | ||
| settings.put(XPackSettings.MACHINE_LEARNING_ENABLED.getKey(), false); | ||
| settings.put(EqlPlugin.EQL_ENABLED_SETTING.getKey(), true); | ||
| settings.put(LicenseService.SELF_GENERATED_LICENSE_TYPE.getKey(), "trial"); | ||
| return settings.build(); | ||
| } | ||
|
|
||
| @Override | ||
| protected Collection<Class<? extends Plugin>> nodePlugins() { | ||
| return Collections.singletonList(LocalStateEqlXPackPlugin.class); | ||
| } | ||
| } | ||
|
|
Oops, something went wrong.