CR: deduplicate and merge fields

elastic · May 14, 2024 · 131929e · 131929e
1 parent 0cef907
commit 131929e
Show file tree

Hide file tree

Showing 2 changed files with 56 additions and 2 deletions.
diff --git a/..._solution/public/detection_engine/rule_creation_ui/hooks/use_all_esql_rule_fields.test.ts b/..._solution/public/detection_engine/rule_creation_ui/hooks/use_all_esql_rule_fields.test.ts
@@ -50,7 +50,16 @@ const mockEsqlDatatable = {
 describe('useAllEsqlRuleFields', () => {
   beforeEach(() => {
     jest.clearAllMocks();
-    getESQLQueryColumnsMock.mockResolvedValue(mockEsqlDatatable.columns);
+    getESQLQueryColumnsMock.mockImplementation(({ esqlQuery }) =>
+      Promise.resolve(
+        esqlQuery === 'deduplicate_test'
+          ? [
+              { id: 'agent.name', name: 'agent.name', meta: { type: 'string' } }, // agent.name is already present in mockIndexPatternFields
+              { id: '_custom_field_0', name: '_custom_field_0', meta: { type: 'string' } },
+            ]
+          : mockEsqlDatatable.columns
+      )
+    );
     parseEsqlQueryMock.mockReturnValue({ isEsqlQueryAggregating: false });
   });
 
@@ -136,4 +145,35 @@ describe('useAllEsqlRuleFields', () => {
       ]);
     });
   });
+
+  it('should deduplicate index pattern fields and ES|QL fields when fields have same name', async () => {
+    //  getESQLQueryColumnsMock.mockClear();
+    parseEsqlQueryMock.mockReturnValue({ isEsqlQueryAggregating: false });
+
+    const { result, waitFor } = renderHook(
+      () =>
+        useAllEsqlRuleFields({
+          esqlQuery: 'deduplicate_test',
+          indexPatternsFields: mockIndexPatternFields,
+        }),
+      { wrapper }
+    );
+
+    await waitFor(() => {
+      expect(result.current.fields).toEqual([
+        {
+          name: 'agent.name',
+          type: 'string',
+        },
+        {
+          name: '_custom_field_0',
+          type: 'string',
+        },
+        {
+          name: 'agent.type',
+          type: 'string',
+        },
+      ]);
+    });
+  });
 });
diff --git a/...urity_solution/public/detection_engine/rule_creation_ui/hooks/use_all_esql_rule_fields.ts b/...urity_solution/public/detection_engine/rule_creation_ui/hooks/use_all_esql_rule_fields.ts
@@ -60,6 +60,18 @@ export const useEsqlFields: UseEsqlFields = (esqlQuery) => {
   };
 };
 
+/**
+ * if ES|QL fields and index pattern fields have same name, duplicates will be removed and the rest of fields merged
+ * ES|QL fields are first in order, since these are the fields that returned in ES|QL response
+ * */
+const deduplicateAndMergeFields = (
+  esqlFields: DataViewFieldBase[],
+  indexPatternsFields: DataViewFieldBase[]
+) => {
+  const esqlFieldsSet = new Set<string>(esqlFields.map((field) => field.name));
+  return [...esqlFields, ...indexPatternsFields.filter((field) => !esqlFieldsSet.has(field.name))];
+};
+
 type UseAllEsqlRuleFields = (params: {
   esqlQuery: string | undefined;
   indexPatternsFields: DataViewFieldBase[];
@@ -94,7 +106,9 @@ export const useAllEsqlRuleFields: UseAllEsqlRuleFields = ({ esqlQuery, indexPat
     if (!debouncedEsqlQuery) {
       return indexPatternsFields;
     }
-    return isEsqlQueryAggregating ? esqlFields : [...esqlFields, ...indexPatternsFields];
+    return isEsqlQueryAggregating
+      ? esqlFields
+      : deduplicateAndMergeFields(esqlFields, indexPatternsFields);
   }, [esqlFields, debouncedEsqlQuery, indexPatternsFields, isEsqlQueryAggregating]);
 
   return {