[Obx-ux-mgmt][Alerting]Mismatch between preview chart and rule execut…

…ion regarding wildcards (elastic#201553) ## Summary It fixes elastic#186624 by making the preview chat represent the wildcard correctly. The missing use case was when passing the query without " " |Tested cases|Note| |---|---| |<img width="596" alt="Screenshot 2024-11-25 at 12 04 14" src="https://github.com/user-attachments/assets/8140d175-9ff3-4d1a-ac72-baf1e7878326">|<img width="594" alt="Screenshot 2024-11-25 at 12 04 27" src="https://github.com/user-attachments/assets/cf0eeb97-0fe7-4509-b4db-c8e4b54e0def">We can't show "NoData" in this case. I tested the same formula in Lens and got the same results. It's not ideal, but at least we don't have any data/bars that could mislead the user| |<img width="596" alt="Screenshot 2024-11-25 at 11 59 53" src="https://github.com/user-attachments/assets/cc128bd7-f4aa-403a-8c0a-398b36694064">|| |<img width="596" alt="Screenshot 2024-11-25 at 11 59 41" src="https://github.com/user-attachments/assets/7f4ae425-6c3b-4067-ab45-0e8282ddd901">|| |<img width="596" alt="Screenshot 2024-11-25 at 11 59 28" src="https://github.com/user-attachments/assets/e2e6dfde-834a-4921-8471-a7270bbd2f9c">|| |<img width="596" alt="Screenshot 2024-11-25 at 11 59 08" src="https://github.com/user-attachments/assets/6ffc641d-b043-4740-897f-5d4e94adda41">|| |<img width="596" alt="Screenshot 2024-11-25 at 11 58 58" src="https://github.com/user-attachments/assets/5122e9df-b392-4785-8a2b-5219c818dfed">||
e40pud · Nov 26, 2024 · f0c8fde · f0c8fde
1 parent 65345f0
commit f0c8fde
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 6 deletions.
diff --git a/...servability_solution/observability/public/components/rule_condition_chart/helpers.test.ts b/...servability_solution/observability/public/components/rule_condition_chart/helpers.test.ts
@@ -75,6 +75,32 @@ const useCases = [
       sourceField: '',
     },
   ],
+  [
+    {
+      aggType: Aggregators.COUNT,
+      field: '',
+      filter: `container.name:container's name-1`,
+      name: '',
+    },
+    {
+      operation: 'count',
+      operationWithField: `count(kql='container.name:container\\'s name-1')`,
+      sourceField: '',
+    },
+  ],
+  [
+    {
+      aggType: Aggregators.COUNT,
+      field: '',
+      filter: 'host.name: host-*',
+      name: '',
+    },
+    {
+      operation: 'count',
+      operationWithField: `count(kql='host.name: host-*')`,
+      sourceField: '',
+    },
+  ],
   [
     {
       aggType: Aggregators.CARDINALITY,
@@ -136,7 +162,7 @@ const useCases = [
     },
     {
       operation: 'counter_rate',
-      operationWithField: `counter_rate(max(system.network.in.bytes), kql='host.name : foo')`,
+      operationWithField: `counter_rate(max(system.network.in.bytes), kql='host.name : "foo"')`,
       sourceField: 'system.network.in.bytes',
     },
   ],

diff --git a/...ns/observability_solution/observability/public/components/rule_condition_chart/helpers.ts b/...ns/observability_solution/observability/public/components/rule_condition_chart/helpers.ts
@@ -15,15 +15,15 @@ export interface LensOperation {
 }
 
 export const getLensOperationFromRuleMetric = (metric: GenericMetric): LensOperation => {
-  const { aggType, field, filter } = metric;
+  const { aggType, field, filter = '' } = metric;
   let operation: string = aggType;
   const operationArgs: string[] = [];
-  const aggFilter = JSON.stringify(filter || '').replace(/"|\\/g, '');
+  const escapedFilter = filter.replace(/'/g, "\\'");
 
   if (aggType === Aggregators.RATE) {
     return {
       operation: 'counter_rate',
-      operationWithField: `counter_rate(max(${field}), kql='${aggFilter}')`,
+      operationWithField: `counter_rate(max(${field}), kql='${escapedFilter}')`,
       sourceField: field || '',
     };
   }
@@ -45,8 +45,7 @@ export const getLensOperationFromRuleMetric = (metric: GenericMetric): LensOpera
     operationArgs.push('percentile=99');
   }
 
-  if (aggFilter) operationArgs.push(`kql='${aggFilter}'`);
-
+  if (escapedFilter) operationArgs.push(`kql='${escapedFilter}'`);
   return {
     operation,
     operationWithField: `${operation}(${operationArgs.join(', ')})`,