Merge branch 'main' into 204520-fwd-compatibilty-failure

elastic · Dec 18, 2024 · 7ee03ad · 7ee03ad
2 parents e3c191f + 65bc6bc
commit 7ee03ad
Show file tree

Hide file tree

Showing 13 changed files with 59 additions and 55 deletions.
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/base/Dockerfile b/src/dev/build/tasks/os_packages/docker_generator/templates/base/Dockerfile
@@ -114,7 +114,7 @@ EXPOSE 5601
 RUN for iter in {1..10}; do \
       microdnf update --setopt=tsflags=nodocs -y && \
       microdnf install --setopt=tsflags=nodocs -y \
-        fontconfig freetype shadow-utils nss findutils && \
+      fontconfig liberation-fonts-common freetype shadow-utils nss findutils && \
       microdnf clean all && exit_code=0 && break || exit_code=$? && echo "microdnf error: retry $iter in 10s" && \
       sleep 10; \
     done; \
@@ -126,15 +126,15 @@ RUN for iter in {1..10}; do \
       apt-get update  && \
       apt-get upgrade -y  && \
       apt-get install -y --no-install-recommends \
-       fontconfig libnss3 curl ca-certificates && \
+      fontconfig fonts-liberation libnss3 curl ca-certificates && \
       apt-get clean && \
       rm -rf /var/lib/apt/lists/* && exit_code=0 && break || exit_code=$? && echo "apt-get error: retry $iter in 10s" && \
       sleep 10; \
     done; \
     (exit $exit_code)
 {{/ubuntu}}
 {{#wolfi}}
-RUN apk --no-cache add bash curl fontconfig libstdc++ libnss findutils shadow ca-certificates
+RUN apk --no-cache add bash curl fontconfig font-liberation libstdc++ libnss findutils shadow ca-certificates
 {{/wolfi}}
 
 # Bring in Kibana from the initial stage.

diff --git a/x-pack/platform/plugins/private/translations/translations/fr-FR.json b/x-pack/platform/plugins/private/translations/translations/fr-FR.json
@@ -37591,7 +37591,6 @@
     "xpack.securitySolution.detectionEngine.body.summary.message": "La règle {ruleName} a généré {signalsCount} alertes",
     "xpack.securitySolution.detectionEngine.buttonManageRules": "Gérer les règles",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkActionConfirmationCloseButtonLabel": "Fermer",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmation.confirmButtonLabel": "Modifier {customRulesCount, plural, =1 {# règle personnalisée} other {# règles personnalisées}}",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmationCancelButtonLabel": "Annuler",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxHelpText": "Entrez le modèle des index Elasticsearch que vous souhaitez ajouter. Par défaut, le menu déroulant comprend des modèles d'indexation définis dans les paramètres avancés de la solution Security.",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxLabel": "Ajouter des modèles d'indexation pour les règles sélectionnées",
@@ -37625,8 +37624,6 @@
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setInvestigationFieldsWarningCallout": "Vous êtes sur le point d'écraser des champs en surbrillance personnalisés pour {rulesCount, plural, one {la règle sélectionnée} other {les # règles sélectionnées}}. Pour appliquer et enregistrer les modifications, cliquez sur Enregistrer.",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setTagsWarningCallout": "Vous êtes sur le point d'écraser les balises pour {rulesCount, plural, one {# règle sélectionnée} other {# règles sélectionnées}}. Sélectionnez Enregistrer pour appliquer les modifications.",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.tagsComoboxRequiredErrorMessage": "Au moins une balise est requise.",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkExportConfirmation.confirmButtonLabel": "Exporter {customRulesCount, plural, =1 {# règle personnalisée} other {# règles personnalisées}}",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkManualRuleRunConfirmation.confirmButtonLabel": "Planifier {customRulesCount, plural, =1 {# règle personnalisée} other {# règles personnalisées}}",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkDeleteConfirmationTitle": "Confirmer la suppression groupée",
     "xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationCancel": "Annuler",
     "xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationConfirm": "Supprimer",
@@ -38848,7 +38845,6 @@
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addRuleActionsTitle": "Ajouter des actions sur les règles",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addTagsTitle": "Ajouter des balises",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.applyTimelineTemplateTitle": "Appliquer le modèle de chronologie",
-    "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkActionConfirmationPartlyTitle": "L'action peut être appliquée uniquement à {customRulesCount, plural, =1 {# règle personnalisée} other {# règles personnalisées}}",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditConfirmationDeniedTitle": "Impossible de modifier {rulesCount, plural, =1 {# règle} other {# règles}}.",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastDescription": "{rulesCount, plural, =1 {# règle est} other {# règles sont}} en cours de mise à jour.",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastNotifyButtonLabel": "M'envoyer une notification à la fin",

diff --git a/x-pack/platform/plugins/private/translations/translations/ja-JP.json b/x-pack/platform/plugins/private/translations/translations/ja-JP.json
@@ -37449,7 +37449,6 @@
     "xpack.securitySolution.detectionEngine.body.summary.message": "ルール{ruleName}は{signalsCount}件のアラートを生成しました",
     "xpack.securitySolution.detectionEngine.buttonManageRules": "ルールの管理",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkActionConfirmationCloseButtonLabel": "閉じる",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmation.confirmButtonLabel": "{customRulesCount, plural, other {# 個のカスタムルール}}を編集",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmationCancelButtonLabel": "キャンセル",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxHelpText": "追加するElasticsearchインデックスのパターンを入力します。デフォルトでは、ドロップダウンには、セキュリティソリューション詳細設定で定義されたインデックスパターンが含まれます。",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxLabel": "選択したルールのインデックスパターンを追加",
@@ -37483,8 +37482,6 @@
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setInvestigationFieldsWarningCallout": "選択した{rulesCount, plural, other {#個のルール}}のカスタムハイライトされたフィールドを上書きしようとしています。変更を適用して、保存するには、［保存］をクリックします。",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setTagsWarningCallout": "{rulesCount, plural, other {# 個の選択したルール}}のタグを上書きしようとしています。［保存］をクリックすると、変更が適用されます。\n",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.tagsComoboxRequiredErrorMessage": "1つ以上のタグが必要です。",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkExportConfirmation.confirmButtonLabel": "{customRulesCount, plural, other {# 個のカスタムルール}}をエクスポート",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkManualRuleRunConfirmation.confirmButtonLabel": "{customRulesCount, plural, other {# 個のカスタムルール}}をスケジュール",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkDeleteConfirmationTitle": "一括削除の確認",
     "xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationCancel": "キャンセル",
     "xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationConfirm": "削除",
@@ -38705,7 +38702,6 @@
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addRuleActionsTitle": "ルールアクションを追加",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addTagsTitle": "タグを追加",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.applyTimelineTemplateTitle": "タイムラインテンプレートを適用",
-    "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkActionConfirmationPartlyTitle": "このアクションは、{customRulesCount, plural, other {#個のカスタムルール}}にのみ適用できます",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditConfirmationDeniedTitle": "{rulesCount, plural, other {# 個のルール}}を編集できません",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastDescription": "{rulesCount, plural, other  {#個のルール}}を更新しています。",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastNotifyButtonLabel": "完了時に通知",

diff --git a/x-pack/platform/plugins/private/translations/translations/zh-CN.json b/x-pack/platform/plugins/private/translations/translations/zh-CN.json
@@ -36878,7 +36878,6 @@
     "xpack.securitySolution.detectionEngine.body.summary.message": "规则 {ruleName} 生成了 {signalsCount} 个告警",
     "xpack.securitySolution.detectionEngine.buttonManageRules": "管理规则",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkActionConfirmationCloseButtonLabel": "关闭",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmation.confirmButtonLabel": "编辑 {customRulesCount, plural, other {# 个定制规则}}",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmationCancelButtonLabel": "取消",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxHelpText": "输入要添加的 Elasticsearch 索引的模式。默认情况下，下拉列表将包括 Security Solution 高级设置中定义的索引模式。",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxLabel": "为选定规则添加索引模式",
@@ -36912,8 +36911,6 @@
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setInvestigationFieldsWarningCallout": "您即将覆盖选定的 {rulesCount, plural, other {# 个规则}}的突出显示的定制字段。要应用并保存更改，请单击'保存'。",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setTagsWarningCallout": "您即将覆盖 {rulesCount, plural, other {# 个选定规则}}的标签，按'保存'可应用更改。",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.tagsComoboxRequiredErrorMessage": "至少需要一个标签。",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkExportConfirmation.confirmButtonLabel": "导出 {customRulesCount, plural, other {# 个定制规则}}",
-    "xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkManualRuleRunConfirmation.confirmButtonLabel": "计划 {customRulesCount, plural, other {# 个定制规则}}",
     "xpack.securitySolution.detectionEngine.components.allRules.bulkDeleteConfirmationTitle": "确认批量删除",
     "xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationCancel": "取消",
     "xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationConfirm": "删除",
@@ -38131,7 +38128,6 @@
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addRuleActionsTitle": "添加规则操作",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addTagsTitle": "添加标签",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.applyTimelineTemplateTitle": "应用时间线模板",
-    "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkActionConfirmationPartlyTitle": "只能对 {customRulesCount, plural, other {# 个定制规则}}应用此操作",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditConfirmationDeniedTitle": "无法编辑 {rulesCount, plural, other {# 个规则}}",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastDescription": "{rulesCount, plural, other {# 个规则}}正在更新。",
     "xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastNotifyButtonLabel": "在完成时通知我",

diff --git a/...blic/detection_engine/rule_management/components/rule_details/rule_definition_section.tsx b/...blic/detection_engine/rule_management/components/rule_details/rule_definition_section.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React from 'react';
+import React, { useMemo } from 'react';
 import { isEmpty } from 'lodash/fp';
 import {
   EuiDescriptionList,
@@ -23,8 +23,8 @@ import type {
 import type { Filter } from '@kbn/es-query';
 import type { SavedQuery } from '@kbn/data-plugin/public';
 import { mapAndFlattenFilters } from '@kbn/data-plugin/public';
-import type { DataView } from '@kbn/data-views-plugin/public';
 import { FilterItems } from '@kbn/unified-search-plugin/public';
+import { isDataView } from '../../../../common/components/query_bar';
 import type {
   AlertSuppressionMissingFieldsStrategy,
   EqlOptionalFields,
@@ -40,8 +40,6 @@ import { AlertSuppressionLabel } from '../../../rule_creation_ui/components/desc
 import { useGetSavedQuery } from '../../../../detections/pages/detection_engine/rules/use_get_saved_query';
 import * as threatMatchI18n from '../../../../common/components/threat_match/translations';
 import * as timelinesI18n from '../../../../timelines/components/timeline/translations';
-import { useRuleIndexPattern } from '../../../rule_creation_ui/pages/form';
-import { DataSourceType } from '../../../../detections/pages/detection_engine/rules/types';
 import type { Duration } from '../../../../detections/pages/detection_engine/rules/types';
 import { convertHistoryStartToSize } from '../../../../detections/pages/detection_engine/rules/helpers';
 import { MlJobsDescription } from '../../../rule_creation/components/ml_jobs_description/ml_jobs_description';
@@ -65,6 +63,7 @@ import {
   EQL_OPTIONS_EVENT_TIEBREAKER_FIELD_LABEL,
   EQL_OPTIONS_EVENT_TIMESTAMP_FIELD_LABEL,
 } from '../../../rule_creation/components/eql_query_edit/translations';
+import { useDataView } from './three_way_diff/final_edit/fields/hooks/use_data_view';
 
 interface SavedQueryNameProps {
   savedQueryName: string;
@@ -89,16 +88,34 @@ export const Filters = ({
   index,
   'data-test-subj': dataTestSubj,
 }: FiltersProps) => {
-  const flattenedFilters = mapAndFlattenFilters(filters);
-
   const defaultIndexPattern = useDefaultIndexPattern();
+  const useDataViewParams = dataViewId
+    ? { dataViewId }
+    : { indexPatterns: index ?? defaultIndexPattern };
+  const { dataView } = useDataView(useDataViewParams);
+  const isEsql = filters.some((filter) => filter?.query?.language === 'esql');
+  const searchBarFilters = useMemo(() => {
+    if (!index || isDataView(index) || isEsql) {
+      return filters;
+    }
+    const filtersWithUpdatedMetaIndex = filters.map((filter) => {
+      return {
+        ...filter,
+        meta: {
+          ...filter.meta,
+          index: index.join(','),
+        },
+      };
+    });
 
-  const { indexPattern } = useRuleIndexPattern({
-    dataSourceType: dataViewId ? DataSourceType.DataView : DataSourceType.IndexPatterns,
-    index: index ?? defaultIndexPattern,
-    dataViewId,
-  });
+    return filtersWithUpdatedMetaIndex;
+  }, [filters, index, isEsql]);
+
+  if (!dataView) {
+    return null;
+  }
 
+  const flattenedFilters = mapAndFlattenFilters(searchBarFilters);
   const styles = filtersStyles;
 
   return (
@@ -109,7 +126,7 @@ export const Filters = ({
       responsive={false}
       gutterSize="xs"
     >
-      <FilterItems filters={flattenedFilters} indexPatterns={[indexPattern as DataView]} readOnly />
+      <FilterItems filters={flattenedFilters} indexPatterns={[dataView]} readOnly />
     </EuiFlexGroup>
   );
 };

diff --git a/...ment/components/rule_details/three_way_diff/comparison_side/comparison_side_help_info.tsx b/...ment/components/rule_details/three_way_diff/comparison_side/comparison_side_help_info.tsx
@@ -57,7 +57,7 @@ export function ComparisonSideHelpInfo({ options }: ComparisonSideHelpInfoProps)
                 <ul>
                   {optionsWithDescriptions.map(
                     ({ title: displayName, description: explanation }) => (
-                      <li>
+                      <li key={displayName}>
                         <strong>{displayName}</strong> {'-'} {explanation}
                       </li>
                     )

diff --git a/...anagement/components/rule_details/three_way_diff/final_edit/fields/hooks/use_data_view.ts b/...anagement/components/rule_details/three_way_diff/final_edit/fields/hooks/use_data_view.ts
@@ -9,7 +9,7 @@ import { useEffect, useState } from 'react';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import { useKibana } from '../../../../../../../../common/lib/kibana';
 
-type UseDataViewParams =
+export type UseDataViewParams =
   | { indexPatterns: string[]; dataViewId?: never }
   | { indexPatterns?: never; dataViewId: string };
 
@@ -33,6 +33,7 @@ export function useDataView(indexPatternsOrDataViewId: UseDataViewParams): UseDa
         if (indexPatternsOrDataViewId.indexPatterns) {
           const indexPatternsDataView = await dataViewsService.create({
             title: indexPatternsOrDataViewId.indexPatterns.join(','),
+            id: indexPatternsOrDataViewId.indexPatterns.join(','),
             allowNoIndex: true,
           });
 

diff --git a/...e_management_ui/components/rules_table/bulk_actions/bulk_action_rule_errors_list.test.tsx b/...e_management_ui/components/rules_table/bulk_actions/bulk_action_rule_errors_list.test.tsx
@@ -64,11 +64,11 @@ describe('Component BulkEditRuleErrorsList', () => {
     ],
     [
       BulkActionsDryRunErrCode.MACHINE_LEARNING_INDEX_PATTERN,
-      "2 custom machine learning rules (these rules don't have index patterns)",
+      "2 machine learning rules (these rules don't have index patterns)",
     ],
     [
       BulkActionsDryRunErrCode.ESQL_INDEX_PATTERN,
-      "2 custom ES|QL rules (these rules don't have index patterns)",
+      "2 ES|QL rules (these rules don't have index patterns)",
     ],
     [
       BulkActionsDryRunErrCode.MACHINE_LEARNING_AUTH,

diff --git a/...e/rule_management_ui/components/rules_table/bulk_actions/bulk_action_rule_errors_list.tsx b/...e/rule_management_ui/components/rules_table/bulk_actions/bulk_action_rule_errors_list.tsx
@@ -41,7 +41,7 @@ const BulkEditRuleErrorItem = ({
         <li key={message}>
           <FormattedMessage
             id="xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.machineLearningRulesIndexEditDescription"
-            defaultMessage="{rulesCount, plural, =1 {# custom machine learning rule} other {# custom machine learning rules}} (these rules don't have index patterns)"
+            defaultMessage="{rulesCount, plural, =1 {# machine learning rule} other {# machine learning rules}} (these rules don't have index patterns)"
             values={{ rulesCount }}
           />
         </li>
@@ -61,7 +61,7 @@ const BulkEditRuleErrorItem = ({
         <li key={message}>
           <FormattedMessage
             id="xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.esqlRulesIndexEditDescription"
-            defaultMessage="{rulesCount, plural, =1 {# custom ES|QL rule} other {# custom ES|QL rules}} (these rules don't have index patterns)"
+            defaultMessage="{rulesCount, plural, =1 {# ES|QL rule} other {# ES|QL rules}} (these rules don't have index patterns)"
             values={{ rulesCount }}
           />
         </li>