[Response Ops][Alerting] Fixing bug with agg building for ES query ru…

…le when there are multi-terms and a group by field (#182865) (cherry picked from commit 3f7731c)
elastic · May 8, 2024 · 59cf29c · 59cf29c
1 parent 87db89b
commit 59cf29c
Show file tree

Hide file tree

Showing 2 changed files with 58 additions and 7 deletions.
diff --git a/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.test.ts b/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.test.ts
@@ -793,6 +793,51 @@ describe('buildAgg', () => {
       });
     });
 
+    it('should create correct aggregation when condition params are defined and multi terms selected', async () => {
+      expect(
+        buildAggregation({
+          aggType: 'sum',
+          aggField: 'avg-field',
+          termField: ['the-term', 'second-term'],
+          termSize: 100,
+          condition: {
+            resultLimit: 1000,
+            conditionScript: `params.compareValue <= 0`,
+          },
+        })
+      ).toEqual({
+        groupAgg: {
+          multi_terms: {
+            size: 100,
+            terms: [{ field: 'the-term' }, { field: 'second-term' }],
+            order: {
+              metricAgg: 'desc',
+            },
+          },
+          aggs: {
+            conditionSelector: {
+              bucket_selector: {
+                buckets_path: {
+                  compareValue: 'metricAgg',
+                },
+                script: `params.compareValue <= 0`,
+              },
+            },
+            metricAgg: {
+              sum: {
+                field: 'avg-field',
+              },
+            },
+          },
+        },
+        groupAggCount: {
+          stats_bucket: {
+            buckets_path: 'groupAgg._count',
+          },
+        },
+      });
+    });
+
     it('should add topHitsAgg if topHitsSize is defined', () => {
       expect(
         buildAggregation({

diff --git a/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.ts b/x-pack/plugins/triggers_actions_ui/common/data/lib/build_agg.ts
@@ -46,7 +46,7 @@ export const buildAggregation = ({
   condition,
   topHitsSize,
 }: BuildAggregationOpts): Record<string, AggregationsAggregationContainer> => {
-  const aggContainer = {
+  const aggContainer: AggregationsAggregationContainer = {
     aggs: {},
   };
   const isCountAgg = isCountAggregation(aggType);
@@ -78,7 +78,7 @@ export const buildAggregation = ({
         : terms
       : terms;
 
-  let aggParent: any = aggContainer;
+  let aggParent: AggregationsAggregationContainer = aggContainer;
 
   const getAggName = () => (isDateAgg ? 'sortValueAgg' : 'metricAgg');
 
@@ -114,9 +114,15 @@ export const buildAggregation = ({
     // if not count add an order
     if (!isCountAgg) {
       const sortOrder = aggType === 'min' ? 'asc' : 'desc';
-      aggParent.aggs.groupAgg.terms!.order = {
-        [getAggName()]: sortOrder,
-      };
+      if (isMultiTerms && aggParent.aggs.groupAgg.multi_terms) {
+        aggParent.aggs.groupAgg.multi_terms.order = {
+          [getAggName()]: sortOrder,
+        };
+      } else if (aggParent.aggs.groupAgg.terms) {
+        aggParent.aggs.groupAgg.terms.order = {
+          [getAggName()]: sortOrder,
+        };
+      }
     } else if (includeConditionInQuery) {
       aggParent.aggs.groupAgg.aggs = {
         conditionSelector: {
@@ -193,7 +199,7 @@ export const buildAggregation = ({
   }
 
   if (timeSeries && dateRangeInfo) {
-    aggParent = aggParent.aggs.dateAgg;
+    aggParent = aggParent?.aggs?.dateAgg ?? {};
 
     // finally, the metric aggregation, if requested
     if (!isCountAgg) {
@@ -207,5 +213,5 @@ export const buildAggregation = ({
     }
   }
 
-  return aggContainer.aggs;
+  return aggContainer.aggs ?? {};
 };