Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ResponseOps] Add pagination and sorting to the alerts search strategy #126813

12 changes: 12 additions & 0 deletions x-pack/plugins/rule_registry/common/search_strategy/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,20 @@ import { IEsSearchRequest, IEsSearchResponse } from 'src/plugins/data/common';
export type RuleRegistrySearchRequest = IEsSearchRequest & {
featureIds: ValidFeatureId[];
query?: { bool: estypes.QueryDslBoolQuery };
sort?: RuleRegistrySearchRequestSort[];
pagination?: RuleRegistrySearchRequestPagination;
};

export interface RuleRegistrySearchRequestPagination {
pageIndex: number;
pageSize: number;
}

export interface RuleRegistrySearchRequestSort {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should just use the estypes.Sort type from import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

field: string;
direction: 'asc' | 'desc';
}

type Prev = [
never,
0,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ describe('ruleRegistrySearchStrategyProvider()', () => {
});

let getAuthzFilterSpy: jest.SpyInstance;
const search = jest.fn().mockImplementation(() => of(response));

beforeEach(() => {
ruleDataService.findIndicesByFeature.mockImplementation(() => {
Expand All @@ -80,7 +81,7 @@ describe('ruleRegistrySearchStrategyProvider()', () => {

data.search.getSearchStrategy.mockImplementation(() => {
return {
search: () => of(response),
search,
};
});

Expand All @@ -95,6 +96,7 @@ describe('ruleRegistrySearchStrategyProvider()', () => {
ruleDataService.findIndicesByFeature.mockClear();
data.search.getSearchStrategy.mockClear();
getAuthzFilterSpy.mockClear();
search.mockClear();
});

it('should handle a basic search request', async () => {
Expand Down Expand Up @@ -199,4 +201,65 @@ describe('ruleRegistrySearchStrategyProvider()', () => {
.toPromise();
expect(result).toBe(EMPTY_RESPONSE);
});

it('should support pagination', async () => {
const request: RuleRegistrySearchRequest = {
featureIds: [AlertConsumers.LOGS],
pagination: {
pageSize: 10,
pageIndex: 1,
chrisronline marked this conversation as resolved.
Show resolved Hide resolved
},
};
const options = {};
const deps = {
request: {},
};

const strategy = ruleRegistrySearchStrategyProvider(
data,
ruleDataService,
alerting,
logger,
security,
spaces
);

await strategy
.search(request, options, deps as unknown as SearchStrategyDependencies)
.toPromise();
expect(search.mock.calls.length).toBe(1);
expect(search.mock.calls[0][0].params.body.size).toBe(10);
expect(search.mock.calls[0][0].params.body.from).toBe(10);
});

it('should support sorting', async () => {
const request: RuleRegistrySearchRequest = {
featureIds: [AlertConsumers.LOGS],
sort: [
{
field: 'test',
direction: 'desc',
},
],
};
const options = {};
const deps = {
request: {},
};

const strategy = ruleRegistrySearchStrategyProvider(
data,
ruleDataService,
alerting,
logger,
security,
spaces
);

await strategy
.search(request, options, deps as unknown as SearchStrategyDependencies)
.toPromise();
expect(search.mock.calls.length).toBe(1);
expect(search.mock.calls[0][0].params.body.sort).toStrictEqual([{ test: { order: 'desc' } }]);
});
});
Original file line number Diff line number Diff line change
Expand Up @@ -91,18 +91,31 @@ export const ruleRegistrySearchStrategyProvider = (
filter.push(getSpacesFilter(space.id) as estypes.QueryDslQueryContainer);
}

const sort = request.sort
? request.sort.map(({ field, direction }) => {
return {
[field]: {
order: direction,
},
};
})
: {};
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

super small nitpick: should we try to be consistent with the types? (array)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure


const query = {
bool: {
...request.query?.bool,
filter,
},
};
const size = request.pagination ? request.pagination.pageSize : MAX_ALERT_SEARCH_SIZE;
const params = {
index: indices,
body: {
_source: false,
fields: ['*'],
size: MAX_ALERT_SEARCH_SIZE,
sort,
size,
from: request.pagination ? request.pagination.pageIndex * size : 0,
query,
},
};
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,11 @@ export default ({ getService }: FtrProviderContext) => {
beforeEach(async () => {
await esArchiver.load('x-pack/test/functional/es_archives/observability/alerts');
});

afterEach(async () => {
await esArchiver.unload('x-pack/test/functional/es_archives/observability/alerts');
});

it('should return alerts from log rules', async () => {
const result = await bsearch.send<RuleRegistrySearchResponse>({
supertest,
Expand All @@ -52,6 +54,31 @@ export default ({ getService }: FtrProviderContext) => {
});
expect(consumers.every((consumer) => consumer === AlertConsumers.LOGS));
});

it('should support pagination and sorting', async () => {
const result = await bsearch.send<RuleRegistrySearchResponse>({
supertest,
options: {
featureIds: [AlertConsumers.LOGS],
pagination: {
pageSize: 2,
pageIndex: 1,
},
sort: [
{
field: 'kibana.alert.evaluation.value',
direction: 'desc',
},
],
},
strategy: 'ruleRegistryAlertsSearchStrategy',
});
expect(result.rawResponse.hits.total).to.eql(5);
expect(result.rawResponse.hits.hits.length).to.eql(2);
const first = result.rawResponse.hits.hits[0].fields?.['kibana.alert.evaluation.value'];
const second = result.rawResponse.hits.hits[1].fields?.['kibana.alert.evaluation.value'];
expect(first > second).to.be(true);
});
});

describe('siem', () => {
Expand Down