Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update datafeed_high_count_network_denies.json #101681

Merged
merged 1 commit into from
Jun 9, 2021
Merged

Update datafeed_high_count_network_denies.json #101681

merged 1 commit into from
Jun 9, 2021

Conversation

randomuserid
Copy link
Contributor

@randomuserid randomuserid commented Jun 8, 2021 •
edited
Loading

adds a boolean OR between the two possible field values

Summary

Summarize your PR. If it involves visual changes include a screenshot or gif.

Adds a test to a data feed query, a fix for #101679

For maintainers

Update datafeed_high_count_network_denies.json
85b0673 
add a boolean OR between the two possible field values
@randomuserid randomuserid requested a review from a team as a code owner June 8, 2021 22:22
@randomuserid randomuserid self-assigned this Jun 8, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/ml-ui (:ml)

@randomuserid randomuserid added auto-backport Deprecated - use backport:version if exact versions are needed release_note:fix v7.13.2 v7.14.0 v8.0.0 labels Jun 8, 2021
@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @randomuserid

blaklaybul
blaklaybul suggested changes Jun 9, 2021
View reviewed changes
Copy link
Contributor

@blaklaybul blaklaybul left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, but can we use term instead of match in the must->should array?

@randomuserid
Copy link
Contributor Author

Looks good, but can we use term instead of match in the must->should array?

From what I can see, all of our OR clauses are written like this. I don't remember why but there were some threads in the Elasticsearch channel. Do we want to modify this one alone, or wait and change them all in a future test cycle

@blaklaybul
Copy link
Contributor

Could you find the thread? Typically we use filters instead of match since it's more performant. I'd be curious to know if this is no longer the case! It's fine to leave as is, to keep the datafeeds standardized.

blaklaybul
blaklaybul approved these changes Jun 9, 2021
View reviewed changes
Copy link
Contributor

@blaklaybul blaklaybul left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Query update looks like it will work as intended. In the future we should review the performance of our security datafeeds and think about standardizing them around the most performant queries.

@randomuserid randomuserid merged commit eb3842b into master Jun 9, 2021
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jun 9, 2021
@randomuserid @kibanamachine
Update datafeed_high_count_network_denies.json (elastic#101681)
dd45015 
add a boolean OR between the two possible field values
@kibanamachine kibanamachine mentioned this pull request Jun 9, 2021
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jun 9, 2021
@randomuserid @kibanamachine
Update datafeed_high_count_network_denies.json (elastic#101681)
f0c644d 
add a boolean OR between the two possible field values
@kibanamachine kibanamachine mentioned this pull request Jun 9, 2021
Merged
@kibanamachine
Copy link
Contributor

💚 Backport successful

Status Branch Result
✅ 7.13
✅ 7.x

The backport PRs will be merged automatically after passing CI.

kibanamachine added a commit that referenced this pull request Jun 9, 2021
@kibanamachine @randomuserid
Update datafeed_high_count_network_denies.json (#101681) (#101825)
eb7fad6 
add a boolean OR between the two possible field values

Co-authored-by: Craig Chamberlain <[email protected]>
kibanamachine added a commit that referenced this pull request Jun 9, 2021
@kibanamachine @randomuserid
Update datafeed_high_count_network_denies.json (#101681) (#101826)
bfee1d4 
add a boolean OR between the two possible field values

Co-authored-by: Craig Chamberlain <[email protected]>
jloleysens added a commit to jloleysens/kibana that referenced this pull request Jun 10, 2021
@jloleysens
Merge branch 'master' of github.com:elastic/kibana into fleet/update-…
eb54fc0 
…add-agent-flyout

* 'master' of github.com:elastic/kibana: (35 commits)
  [Cases] Improve connectors mapping (elastic#101145)
  [ML] Fixes display of job group badges in recognizer wizard (elastic#101775)
  Fix es_archives path (elastic#101737)
  [kbnArchiver] convert archive names to root-relative paths (elastic#101839)
  [Reporting] Make "ScreenCapturePanel" shareable for Canvas (elastic#100623)
  [Alerting UI] Converted Rules and Connectors management pages to new layout. (elastic#101697)
  [Fleet] Support granular integrations in policy editor (elastic#101531)
  [Security Solution][Detections] Update detection alert mappings to ECS v1.10.0 (elastic#101680)
  [Fleet] Integrations UI: Adjust policies list UI (elastic#101600)
  chore(NA): moving @kbn/server-route-repository into bazel (elastic#101484)
  Support owner and description attributes inside the Manifest file, use in API docs (elastic#101786)
  [Security Solution] fix security empty overview links (elastic#101536)
  Unskips migration tests now that elastic search is fixed (elastic#101682)
  Fix endpoint -> integrations onboarding link (elastic#101804)
  [Alerting] Log warning when rules are not rescheduled due to Saved Object not found error (elastic#101591)
  Update datafeed_high_count_network_denies.json (elastic#101681)
  [Index patterns] Field editor example app (elastic#100524)
  [DOCS] Adding file upload to add data page (elastic#101674)
  [Security Solution][Endpoint] Adds Endpoint Host Isolation Status common component (elastic#101782)
  Upgrade ws v7.3.1->v7.4.2 and v6.2.1->v6.2.2 (elastic#101402)
  ...

# Conflicts:
#	x-pack/plugins/fleet/public/components/agent_enrollment_flyout/agent_policy_selection.tsx
#	x-pack/plugins/fleet/public/components/agent_enrollment_flyout/index.tsx
#	x-pack/plugins/fleet/public/components/agent_enrollment_flyout/managed_instructions.tsx
#	x-pack/plugins/fleet/public/components/agent_enrollment_flyout/standalone_instructions.tsx
jloleysens added a commit to jloleysens/kibana that referenced this pull request Jun 10, 2021
@jloleysens
Merge branch 'master' of github.com:elastic/kibana into fleet/adjust-…
96e51d9 
…add-integrations-redirect

* 'master' of github.com:elastic/kibana: (44 commits)
  Allow navigating discover flyout via arrow keys (elastic#101772)
  [Cases] Improve connectors mapping (elastic#101145)
  [ML] Fixes display of job group badges in recognizer wizard (elastic#101775)
  Fix es_archives path (elastic#101737)
  [kbnArchiver] convert archive names to root-relative paths (elastic#101839)
  [Reporting] Make "ScreenCapturePanel" shareable for Canvas (elastic#100623)
  [Alerting UI] Converted Rules and Connectors management pages to new layout. (elastic#101697)
  [Fleet] Support granular integrations in policy editor (elastic#101531)
  [Security Solution][Detections] Update detection alert mappings to ECS v1.10.0 (elastic#101680)
  [Fleet] Integrations UI: Adjust policies list UI (elastic#101600)
  chore(NA): moving @kbn/server-route-repository into bazel (elastic#101484)
  Support owner and description attributes inside the Manifest file, use in API docs (elastic#101786)
  [Security Solution] fix security empty overview links (elastic#101536)
  Unskips migration tests now that elastic search is fixed (elastic#101682)
  Fix endpoint -> integrations onboarding link (elastic#101804)
  [Alerting] Log warning when rules are not rescheduled due to Saved Object not found error (elastic#101591)
  Update datafeed_high_count_network_denies.json (elastic#101681)
  [Index patterns] Field editor example app (elastic#100524)
  [DOCS] Adding file upload to add data page (elastic#101674)
  [Security Solution][Endpoint] Adds Endpoint Host Isolation Status common component (elastic#101782)
  ...

# Conflicts:
#	x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/index.tsx
#	x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/details_page/components/package_policies/package_policies_table.tsx
semd pushed a commit that referenced this pull request Jun 10, 2021
@randomuserid @semd
Update datafeed_high_count_network_denies.json (#101681)
fbb0197 
add a boolean OR between the two possible field values
@spalger spalger deleted the 101679 branch May 8, 2022 22:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@blaklaybul blaklaybul blaklaybul approved these changes

Assignees

@randomuserid randomuserid

Labels
auto-backport Deprecated - use backport:version if exact versions are needed :ml release_note:fix v7.13.2 v7.14.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@randomuserid @elasticmachine @kibanamachine @blaklaybul