Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Resolver children pagination #74603

Merged
merged 10 commits into from
Aug 10, 2020
Merged

[Security Solution] Resolver children pagination #74603

merged 10 commits into from
Aug 10, 2020

Conversation

jonathan-buttner
Copy link
Contributor

@jonathan-buttner jonathan-buttner commented Aug 6, 2020 •
edited
Loading

This PR adds support back for the children api pagination. We do this by emulating the search_after functionality with two range queries on @timestamp and event.sequence.

@jonathan-buttner jonathan-buttner added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Endpoint Data Visibility Team managing the endpoint resolver v7.9.0 labels Aug 6, 2020
@jonathan-buttner jonathan-buttner marked this pull request as ready for review August 10, 2020 13:33
@jonathan-buttner jonathan-buttner requested review from a team as code owners August 10, 2020 13:33
@elasticmachine
Copy link
Contributor

Pinging @elastic/endpoint-data-visibility-team (Team:Endpoint Data Visibility)

michaelolo24
michaelolo24 reviewed Aug 10, 2020
View reviewed changes
x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts
const sequence = eventSequence(lastResult);
const cursor = {
timestamp: lastResult['@timestamp'],
sequence: sequence === undefined ? 0 : sequence,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sequence can never be null then right? I would assume so, but just wanted to make sure

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you mean === null ? Or just not defined? The eventSequence helper uses

kibana/x-pack/plugins/security_solution/common/endpoint/models/ecs_safety_helpers.ts

Line 27 in 97a3afe

export function firstNonNullValue<T>(valueOrCollection: ECSField<T>): T | undefined {

Which should only return a number or undefined. event.sequence should always be there unless there was an endpoint bug but we should probably handle the scenario where event.sequence is not defined.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea, you can ignore me. Looks good 👍

@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Build metrics

async chunks size

id value diff baseline
securitySolution 7.3MB +510.0B 7.3MB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@jonathan-buttner jonathan-buttner merged commit 7fd2c2b into elastic:master Aug 10, 2020
@jonathan-buttner jonathan-buttner deleted the resolver-children-pagination branch August 10, 2020 15:54
jonathan-buttner added a commit to jonathan-buttner/kibana that referenced this pull request Aug 10, 2020
@jonathan-buttner
[Security Solution] Resolver children pagination (elastic#74603)
4cdea7b 
* Handle info and change events for children

* Adding sequence

* Fixing children pagination

* Fixing tests

* Adding docs
@jonathan-buttner jonathan-buttner mentioned this pull request Aug 10, 2020
Merged
jonathan-buttner added a commit that referenced this pull request Aug 10, 2020
@jonathan-buttner
[Security Solution] Resolver children pagination (#74603) (#74672)
21cd104 
* Handle info and change events for children

* Adding sequence

* Fixing children pagination

* Fixing tests

* Adding docs
gmmorris added a commit to gmmorris/kibana that referenced this pull request Aug 11, 2020
@gmmorris
Merge branch 'master' into task-manager/prevent-reschedule-of-running…
87c2879 
…-task

* master: (42 commits)
  Allow any hostname for chromium proxy bypass (elastic#74693)
  [ML] ML on Kibana Management: Add ability to pass a group ID filter to job management page (elastic#74533)
  [Metrics UI] Fix No Data preview pluralization (elastic#74399)
  [Bug][Security_Solution][Telemetry] Capitalize S in macOS (elastic#74688)
  Remove karma tests  from legacy maps (elastic#74668)
  [Ingest Manager] stop creating events-* index pattern and placeholder index (elastic#74683)
  [Enterprise Search] Update the browser/document title on plugin navigation (elastic#74392)
  [visualizations] Add i18n translation for 'No results found' (elastic#74619)
  [maps] convert vector style properties to TS (elastic#74553)
  bump geckodriver binary to 0.27 (elastic#74638)
  fix: update apm agents to catch abort requests (elastic#74658)
  [Security Solution] Resolver children pagination (elastic#74603)
  add memoryStatus to df analytics page and analytics table in management (elastic#74570)
  [Ingest Manager] Allow prerelease in package version (elastic#74452)
  [App Arch]: remove legacy karma tests (elastic#74599)
  [i18n] revert reverted changes (elastic#74633)
  [Lens] Clear out all attribute properties before updating (elastic#74483)
  [Uptime] Fix full reloads while navigating to alert/ml (elastic#73796)
  Index pattern field class refactor (elastic#73180)
  [ML] Functional tests - stabilize DFA job type check (elastic#74631)
  ...
gmmorris added a commit to gmmorris/kibana that referenced this pull request Aug 11, 2020
@gmmorris
Merge branch 'master' into event-log/use-alerts-actions-clients
bbc3999 
* master: (339 commits)
  [Ingest Node Pipelines] Sentence-case processor names (elastic#74645)
  Bump angular dependency from 1.7.9 to 1.8.0 (elastic#74482)
  [ML] Fixing schema for custom rule conditions (elastic#74676)
  [ML] Refactor in preparation for new es client (elastic#74552)
  [ML] Adding initial file analysis overrides (elastic#74376)
  Allow any hostname for chromium proxy bypass (elastic#74693)
  [ML] ML on Kibana Management: Add ability to pass a group ID filter to job management page (elastic#74533)
  [Metrics UI] Fix No Data preview pluralization (elastic#74399)
  [Bug][Security_Solution][Telemetry] Capitalize S in macOS (elastic#74688)
  Remove karma tests  from legacy maps (elastic#74668)
  [Ingest Manager] stop creating events-* index pattern and placeholder index (elastic#74683)
  [Enterprise Search] Update the browser/document title on plugin navigation (elastic#74392)
  [visualizations] Add i18n translation for 'No results found' (elastic#74619)
  [maps] convert vector style properties to TS (elastic#74553)
  bump geckodriver binary to 0.27 (elastic#74638)
  fix: update apm agents to catch abort requests (elastic#74658)
  [Security Solution] Resolver children pagination (elastic#74603)
  add memoryStatus to df analytics page and analytics table in management (elastic#74570)
  [Ingest Manager] Allow prerelease in package version (elastic#74452)
  [App Arch]: remove legacy karma tests (elastic#74599)
  ...
jloleysens added a commit to jloleysens/kibana that referenced this pull request Aug 11, 2020
@jloleysens
Merge branch 'master' of github.com:elastic/kibana into ingest-pipeli…
97eea65 
…nes/processor-forms-a-d

* 'master' of github.com:elastic/kibana: (26 commits)
  [Telemetry][API Integration] size_in_bytes to be a number (elastic#74664)
  [ILM] Convert node details flyout to TS (elastic#73707)
  [Ingest Node Pipelines] Sentence-case processor names (elastic#74645)
  Bump angular dependency from 1.7.9 to 1.8.0 (elastic#74482)
  [ML] Fixing schema for custom rule conditions (elastic#74676)
  [ML] Refactor in preparation for new es client (elastic#74552)
  [ML] Adding initial file analysis overrides (elastic#74376)
  Allow any hostname for chromium proxy bypass (elastic#74693)
  [ML] ML on Kibana Management: Add ability to pass a group ID filter to job management page (elastic#74533)
  [Metrics UI] Fix No Data preview pluralization (elastic#74399)
  [Bug][Security_Solution][Telemetry] Capitalize S in macOS (elastic#74688)
  Remove karma tests  from legacy maps (elastic#74668)
  [Ingest Manager] stop creating events-* index pattern and placeholder index (elastic#74683)
  [Enterprise Search] Update the browser/document title on plugin navigation (elastic#74392)
  [visualizations] Add i18n translation for 'No results found' (elastic#74619)
  [maps] convert vector style properties to TS (elastic#74553)
  bump geckodriver binary to 0.27 (elastic#74638)
  fix: update apm agents to catch abort requests (elastic#74658)
  [Security Solution] Resolver children pagination (elastic#74603)
  add memoryStatus to df analytics page and analytics table in management (elastic#74570)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@michaelolo24 michaelolo24 michaelolo24 approved these changes

@bkimmel bkimmel Awaiting requested review from bkimmel

Assignees
No one assigned
Labels
release_note:skip Skip the PR/issue when compiling release notes Team:Endpoint Data Visibility Team managing the endpoint resolver v7.10.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@jonathan-buttner @elasticmachine @kibanamachine @michaelolo24