[Security Solution] [Maps] Kibana index pattern, comma bug fix (#80208)…

… (#80769)
elastic · Oct 16, 2020 · 4b1cd6d · 4b1cd6d
1 parent a50e8c9
commit 4b1cd6d
Show file tree

Hide file tree

Showing 3 changed files with 79 additions and 2 deletions.
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts b/x-pack/plugins/security_solution/public/network/components/embeddables/__mocks__/mock.ts
@@ -484,3 +484,30 @@ export const mockCCSGlobIndexPattern: IndexPatternSavedObject = {
     title: '*:*',
   },
 };
+
+export const mockCommaFilebeatAuditbeatGlobIndexPattern: IndexPatternSavedObject = {
+  id: 'filebeat-*,auditbeat-*',
+  type: 'index-pattern',
+  _version: 'abc',
+  attributes: {
+    title: 'filebeat-*,auditbeat-*',
+  },
+};
+
+export const mockCommaFilebeatAuditbeatCCSGlobIndexPattern: IndexPatternSavedObject = {
+  id: '*:filebeat-*,*:auditbeat-*',
+  type: 'index-pattern',
+  _version: 'abc',
+  attributes: {
+    title: '*:filebeat-*,*:auditbeat-*',
+  },
+};
+
+export const mockCommaFilebeatExclusionGlobIndexPattern: IndexPatternSavedObject = {
+  id: 'filebeat-*,-filebeat-7.6.0*',
+  type: 'index-pattern',
+  _version: 'abc',
+  attributes: {
+    title: 'filebeat-*,-filebeat-7.6.0*',
+  },
+};
diff --git a/...ins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx b/...ins/security_solution/public/network/components/embeddables/embedded_map_helpers.test.tsx
@@ -12,9 +12,12 @@ import {
   mockAPMRegexIndexPattern,
   mockAPMTransactionIndexPattern,
   mockAuditbeatIndexPattern,
+  mockCCSGlobIndexPattern,
+  mockCommaFilebeatAuditbeatCCSGlobIndexPattern,
+  mockCommaFilebeatAuditbeatGlobIndexPattern,
+  mockCommaFilebeatExclusionGlobIndexPattern,
   mockFilebeatIndexPattern,
   mockGlobIndexPattern,
-  mockCCSGlobIndexPattern,
 } from './__mocks__/mock';
 
 const mockEmbeddable = embeddablePluginMock.createStartContract();
@@ -122,5 +125,44 @@ describe('embedded_map_helpers', () => {
       });
       expect(matchingIndexPatterns).toEqual([mockFilebeatIndexPattern]);
     });
+
+    test('matches on comma separated Kibana index pattern', () => {
+      const matchingIndexPatterns = findMatchingIndexPatterns({
+        kibanaIndexPatterns: [
+          mockCommaFilebeatAuditbeatGlobIndexPattern,
+          mockAuditbeatIndexPattern,
+        ],
+        siemDefaultIndices,
+      });
+      expect(matchingIndexPatterns).toEqual([
+        mockCommaFilebeatAuditbeatGlobIndexPattern,
+        mockAuditbeatIndexPattern,
+      ]);
+    });
+
+    test('matches on excluded comma separated Kibana index pattern', () => {
+      const matchingIndexPatterns = findMatchingIndexPatterns({
+        kibanaIndexPatterns: [
+          mockCommaFilebeatExclusionGlobIndexPattern,
+          mockAuditbeatIndexPattern,
+        ],
+        siemDefaultIndices,
+      });
+      expect(matchingIndexPatterns).toEqual([
+        mockCommaFilebeatExclusionGlobIndexPattern,
+        mockAuditbeatIndexPattern,
+      ]);
+    });
+
+    test('matches on CCS comma separated Kibana index pattern', () => {
+      const matchingIndexPatterns = findMatchingIndexPatterns({
+        kibanaIndexPatterns: [
+          mockCommaFilebeatAuditbeatCCSGlobIndexPattern,
+          mockAuditbeatIndexPattern,
+        ],
+        siemDefaultIndices: ['cluster2:filebeat-*', 'cluster1:auditbeat-*'],
+      });
+      expect(matchingIndexPatterns).toEqual([mockCommaFilebeatAuditbeatCCSGlobIndexPattern]);
+    });
   });
 });
diff --git a/.../plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.tsx b/.../plugins/security_solution/public/network/components/embeddables/embedded_map_helpers.tsx
@@ -150,7 +150,15 @@ export const findMatchingIndexPatterns = ({
       const pattern = kip.attributes.title;
       return (
         !ignoredIndexPatterns.includes(pattern) &&
-        siemDefaultIndices.some((sdi) => minimatch(sdi, pattern))
+        siemDefaultIndices.some((sdi) => {
+          const splitPattern = pattern.split(',') ?? [];
+          return splitPattern.length > 1
+            ? splitPattern.some((p) => {
+                const isMatch = minimatch(sdi, p);
+                return isMatch && p.charAt(0) === '-' ? false : isMatch;
+              })
+            : minimatch(sdi, pattern);
+        })
       );
     });
   } catch {