[8.14] [Custom threshold][Logs Explorer] Fix an issue with saving pre…

…filled filters in the custom threshold rule on the Logs Explorer page (#183900) (#184087)

# Backport

This will backport the following commits from `main` to `8.14`:
- [[Custom threshold][Logs Explorer] Fix an issue with saving prefilled
filters in the custom threshold rule on the Logs Explorer page
(#183900)](#183900)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Maryam
Saeidi","email":"maryam.saeidi@elastic.co"},"sourceCommit":{"committedDate":"2024-05-23T07:16:07Z","message":"[Custom
threshold][Logs Explorer] Fix an issue with saving prefilled filters in
the custom threshold rule on the Logs Explorer page (#183900)\n\nFixes
#183710\r\n\r\n## Summary\r\n\r\nThis PR fixes the issue of saving
prefilled filters in the custom\r\nthreshold rule by using
`getSearchConfiguration` every time the\r\nserachConfiguration is saved
in rule parameters. Now,\r\n`getSearchConfiguration` does two
things:\r\n1. Ensure the query has the correct type (`Qurey`), or it
will be set as\r\nthe default query.\r\n2. Adjust filters by removing
`$state` and only keeping `meta` and\r\n`query`\r\n\r\nAlso, I adjusted
the related type to exclude `$state`.\r\n\r\n### How to
test\r\n\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/12370520/9d69e601-d021-4ae3-8baf-88286d3716fe","sha":"4ccd47d90e7b812d0d405cdd906a8b775757c1a4","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","backport:prev-minor","ci:project-deploy-observability","Team:obs-ux-management","v8.15.0"],"title":"[Custom
threshold][Logs Explorer] Fix an issue with saving prefilled filters in
the custom threshold rule on the Logs Explorer
page","number":183900,"url":"#183900
threshold][Logs Explorer] Fix an issue with saving prefilled filters in
the custom threshold rule on the Logs Explorer page (#183900)\n\nFixes
#183710\r\n\r\n## Summary\r\n\r\nThis PR fixes the issue of saving
prefilled filters in the custom\r\nthreshold rule by using
`getSearchConfiguration` every time the\r\nserachConfiguration is saved
in rule parameters. Now,\r\n`getSearchConfiguration` does two
things:\r\n1. Ensure the query has the correct type (`Qurey`), or it
will be set as\r\nthe default query.\r\n2. Adjust filters by removing
`$state` and only keeping `meta` and\r\n`query`\r\n\r\nAlso, I adjusted
the related type to exclude `$state`.\r\n\r\n### How to
test\r\n\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/12370520/9d69e601-d021-4ae3-8baf-88286d3716fe","sha":"4ccd47d90e7b812d0d405cdd906a8b775757c1a4"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.15.0","branchLabelMappingKey":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"#183900
threshold][Logs Explorer] Fix an issue with saving prefilled filters in
the custom threshold rule on the Logs Explorer page (#183900)\n\nFixes
#183710\r\n\r\n## Summary\r\n\r\nThis PR fixes the issue of saving
prefilled filters in the custom\r\nthreshold rule by using
`getSearchConfiguration` every time the\r\nserachConfiguration is saved
in rule parameters. Now,\r\n`getSearchConfiguration` does two
things:\r\n1. Ensure the query has the correct type (`Qurey`), or it
will be set as\r\nthe default query.\r\n2. Adjust filters by removing
`$state` and only keeping `meta` and\r\n`query`\r\n\r\nAlso, I adjusted
the related type to exclude `$state`.\r\n\r\n### How to
test\r\n\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/12370520/9d69e601-d021-4ae3-8baf-88286d3716fe","sha":"4ccd47d90e7b812d0d405cdd906a8b775757c1a4"}}]}]
BACKPORT-->

Co-authored-by: Maryam Saeidi <maryam.saeidi@elastic.co>

x-pack/plugins/observability_solution/observability/common/custom_threshold_rule/types.ts

@@ -60,6 +60,7 @@ export enum AlertStates {
 // Types for the executor
 export interface CustomThresholdSearchSourceFields extends SerializedSearchSourceFields {
   query?: Query;
+  filter?: Array<Pick<Filter, 'meta' | 'query'>>;
 }
 
 export interface ThresholdParams {

x-pack/plugins/observability_solution/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx

@@ -125,12 +125,18 @@ export default function Expressions(props: Props) {
         const createdSearchSource = await data.search.searchSource.create(
           initialSearchConfiguration
         );
-        setRuleParams('searchConfiguration', {
-          ...initialSearchConfiguration,
-          ...(ruleParams.searchConfiguration?.query && {
-            query: ruleParams.searchConfiguration.query,
-          }),
-        });
+        setRuleParams(
+          'searchConfiguration',
+          getSearchConfiguration(
+            {
+              ...initialSearchConfiguration,
+              ...(ruleParams.searchConfiguration?.query && {
+                query: ruleParams.searchConfiguration.query,
+              }),
+            },
+            setParamsWarning
+          )
+        );
         setSearchSource(createdSearchSource);
         setDataView(createdSearchSource.getField('index'));
 
@@ -232,7 +238,10 @@ export default function Expressions(props: Props) {
   const onFilterChange = useCallback(
     ({ query }: { query?: Query }) => {
       setParamsWarning(undefined);
-      setRuleParams('searchConfiguration', { ...ruleParams.searchConfiguration, query });
+      setRuleParams(
+        'searchConfiguration',
+        getSearchConfiguration({ ...ruleParams.searchConfiguration, query }, setParamsWarning)
+      );
     },
     [setRuleParams, ruleParams.searchConfiguration]
   );
@@ -442,13 +451,16 @@ export default function Expressions(props: Props) {
         query={ruleParams.searchConfiguration?.query}
         filters={ruleParams.searchConfiguration?.filter}
         onFiltersUpdated={(filter) => {
-          // Since rule params will be sent to the API as is, and we only need meta and query parameters to be
-          // saved in the rule's saved object, we filter extra fields here (such as $state).
-          const filters = filter.map(({ meta, query }) => ({ meta, query }));
-          setRuleParams('searchConfiguration', {
-            ...ruleParams.searchConfiguration,
-            filter: filters,
-          });
+          setRuleParams(
+            'searchConfiguration',
+            getSearchConfiguration(
+              {
+                ...ruleParams.searchConfiguration,
+                filter,
+              },
+              setParamsWarning
+            )
+          );
         }}
       />
       {errors.filterQuery && (

x-pack/plugins/observability_solution/observability/public/components/custom_threshold/helpers/get_search_configuration.test.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { FilterStateStore } from '@kbn/es-query';
 import { defaultQuery, getSearchConfiguration } from './get_search_configuration';
 
 describe('getSearchConfiguration()', () => {
@@ -37,4 +38,72 @@ describe('getSearchConfiguration()', () => {
     expect(getSearchConfiguration({ query }, onWarning)).toEqual({ query: defaultQuery });
     expect(onWarning).toHaveBeenCalledTimes(1);
   });
+
+  it('should return filter without $state field WITHOUT query', () => {
+    const filter = [
+      {
+        meta: {
+          alias: null,
+          disabled: false,
+          field: 'service.name',
+          index: 'dataset-logs-*-*',
+          key: 'service.name',
+          negate: false,
+          params: {
+            query: 'synth-node-0',
+          },
+          type: 'phrase',
+        },
+        query: {
+          match_phrase: {
+            'service.name': 'synth-node-0',
+          },
+        },
+        $state: {
+          store: FilterStateStore.APP_STATE,
+        },
+      },
+    ];
+
+    expect(getSearchConfiguration({ filter }, onWarning)).toEqual({
+      filter: filter.map((aFilter) => ({ meta: aFilter.meta, query: aFilter.query })),
+    });
+    expect(onWarning).toHaveBeenCalledTimes(0);
+  });
+
+  it('should return filter without $state field WITH esql query', () => {
+    const filter = [
+      {
+        meta: {
+          alias: null,
+          disabled: false,
+          field: 'service.name',
+          index: 'dataset-logs-*-*',
+          key: 'service.name',
+          negate: false,
+          params: {
+            query: 'synth-node-0',
+          },
+          type: 'phrase',
+        },
+        query: {
+          match_phrase: {
+            'service.name': 'synth-node-0',
+          },
+        },
+        $state: {
+          store: FilterStateStore.APP_STATE,
+        },
+      },
+    ];
+    const query = {
+      esql: 'random esql',
+    };
+
+    expect(getSearchConfiguration({ filter, query }, onWarning)).toEqual({
+      filter: filter.map((aFilter) => ({ meta: aFilter.meta, query: aFilter.query })),
+      query: defaultQuery,
+    });
+    expect(onWarning).toHaveBeenCalledTimes(1);
+  });
 });

x-pack/plugins/observability_solution/observability/public/components/custom_threshold/helpers/get_search_configuration.ts

@@ -29,13 +29,27 @@ export const getSearchConfiguration = (
 ): CustomThresholdSearchSourceFields => {
   if (fields.query && !isOfQueryType(fields.query)) {
     onWarning(searchConfigQueryWarning);
-    return {
+    return adjustSearchConfigurationFilter({
       ...fields,
       query: defaultQuery,
-    };
+    });
   }
-  return {
+  return adjustSearchConfigurationFilter({
     ...fields,
     query: fields.query,
+  });
+};
+
+const adjustSearchConfigurationFilter = (
+  searchConfiguration: CustomThresholdSearchSourceFields
+): CustomThresholdSearchSourceFields => {
+  // Only meta and query fields are saved in the rule params, so we ignore other fields such as $state
+  const filter = searchConfiguration.filter
+    ? searchConfiguration.filter.map(({ meta, query }) => ({ meta, query }))
+    : undefined;
+
+  return {
+    ...searchConfiguration,
+    filter,
   };
 };