-
Notifications
You must be signed in to change notification settings - Fork 8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Strip field from events for event search #149113
Changes from 6 commits
f8f7ccd
01732ca
a2714aa
dc5ae64
6f9ccc8
f1465ab
71b840d
27bdd4e
f476fd4
07e933a
3102896
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
|
@@ -7,6 +7,7 @@ | |||||||||||
import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; | ||||||||||||
import { isEmpty } from 'lodash'; | ||||||||||||
import type { Filter } from '@kbn/es-query'; | ||||||||||||
import type { OverrideBodyQuery } from './types'; | ||||||||||||
import type { | ||||||||||||
RuleFilterArray, | ||||||||||||
TimestampOverride, | ||||||||||||
|
@@ -27,6 +28,7 @@ interface BuildEventsSearchQuery { | |||||||||||
secondaryTimestamp: TimestampOverride | undefined; | ||||||||||||
trackTotalHits?: boolean; | ||||||||||||
additionalFilters?: estypes.QueryDslQueryContainer[]; | ||||||||||||
overrideBody?: OverrideBodyQuery; | ||||||||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @nkhristinin could we add some js docs comments explaining what this property is used for? Something like this suggestion?
Suggested change
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Hey, thanks! Added comment to a single search function. |
||||||||||||
} | ||||||||||||
|
||||||||||||
interface BuildEqlSearchRequestParams { | ||||||||||||
|
@@ -132,6 +134,7 @@ export const buildEventsSearchQuery = ({ | |||||||||||
secondaryTimestamp, | ||||||||||||
trackTotalHits, | ||||||||||||
additionalFilters, | ||||||||||||
overrideBody, | ||||||||||||
}: BuildEventsSearchQuery) => { | ||||||||||||
const timestamps = secondaryTimestamp | ||||||||||||
? [primaryTimestamp, secondaryTimestamp] | ||||||||||||
|
@@ -193,6 +196,7 @@ export const buildEventsSearchQuery = ({ | |||||||||||
...(aggregations ? { aggregations } : {}), | ||||||||||||
runtime_mappings: runtimeMappings, | ||||||||||||
sort, | ||||||||||||
...overrideBody, | ||||||||||||
}, | ||||||||||||
}; | ||||||||||||
|
||||||||||||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -342,3 +342,8 @@ export type EventGroupingMultiBucketAggregationResult = ESSearchResponse< | |
}; | ||
} | ||
>; | ||
|
||
export interface OverrideBodyQuery { | ||
_source: estypes.SearchSourceConfig; | ||
fields: estypes.Fields; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. search query body has some other fields as well, as: On second note - would it make sense to define them as non required fields in this interface? It would make this parameter more flexible, if you would want to override There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Good suggestion! I changed those fields to optional. I was trying to change Later in a single search after we cast this query to So if somebody need to add new fields, it shouldn't be a problem to add it into There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. thanks for looking into it. |
||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
small typo