fix usePersistentQuery implementation

elastic · Nov 13, 2024 · 5c09dbb · 5c09dbb
1 parent c75f4a6
commit 5c09dbb
Showing 1 changed file with 35 additions and 20 deletions.
diff --git a/...lic/detection_engine/rule_creation_ui/components/step_define_rule/use_persistent_query.ts b/...lic/detection_engine/rule_creation_ui/components/step_define_rule/use_persistent_query.ts
@@ -8,6 +8,7 @@
 import { useEffect, useRef } from 'react';
 import { isEqual } from 'lodash';
 import usePrevious from 'react-use/lib/usePrevious';
+import type { FieldHook } from '../../../../shared_imports';
 import { useFormData, type FormHook } from '../../../../shared_imports';
 import type { DefineStepRule } from '../../../../detections/pages/detection_engine/rules/types';
 import {
@@ -23,6 +24,9 @@ import {
   type FieldValueQueryBar,
 } from '../query_bar';
 
+const EQL_QUERY_LANGUAGE = 'eql';
+const ESQL_QUERY_LANGIAGE = 'esql';
+
 interface UsePersistentQueryParams {
   form: FormHook<DefineStepRule>;
   ruleTypePath: string;
@@ -42,57 +46,68 @@ export function usePersistentQuery({
     watch: [ruleTypePath, queryPath],
   });
   const previousRuleType = usePrevious(ruleType);
-  const queryRef = useRef<FieldValueQueryBar | undefined>();
-  const eqlQueryRef = useRef<FieldValueQueryBar | undefined>();
-  const esqlQueryRef = useRef<FieldValueQueryBar | undefined>();
+  const queryRef = useRef<FieldValueQueryBar>(DEFAULT_KQL_QUERY_FIELD_VALUE);
+  const eqlQueryRef = useRef<FieldValueQueryBar>(DEFAULT_EQL_QUERY_FIELD_VALUE);
+  const esqlQueryRef = useRef<FieldValueQueryBar>(DEFAULT_ESQL_QUERY_FIELD_VALUE);
 
   useEffect(() => {
-    if (isEqlRule(ruleType)) {
+    if (!ruleType) {
+      return;
+    }
+
+    if (currentQuery?.query?.language === EQL_QUERY_LANGUAGE) {
       eqlQueryRef.current = currentQuery;
-    } else if (isEsqlRule(ruleType)) {
+    } else if (currentQuery?.query?.language === ESQL_QUERY_LANGIAGE) {
       esqlQueryRef.current = currentQuery;
     } else {
       queryRef.current = currentQuery;
     }
   }, [ruleType, currentQuery]);
 
   useEffect(() => {
-    if (ruleType === previousRuleType) {
+    if (ruleType === previousRuleType || !ruleType) {
       return;
     }
 
-    const queryField = form.getFields()[queryPath];
+    const queryField = form.getFields()[queryPath] as FieldHook<FieldValueQueryBar>;
 
-    if (isEsqlRule(ruleType)) {
+    if (isEqlRule(ruleType) && queryField.value?.query?.language !== EQL_QUERY_LANGUAGE) {
       queryField.reset({
-        defaultValue: esqlQueryRef.current ?? DEFAULT_ESQL_QUERY_FIELD_VALUE,
+        defaultValue: eqlQueryRef.current,
       });
 
       return;
     }
 
-    if (isEqlRule(ruleType)) {
+    if (isEsqlRule(ruleType) && queryField.value?.query?.language !== ESQL_QUERY_LANGIAGE) {
       queryField.reset({
-        defaultValue: eqlQueryRef.current ?? DEFAULT_EQL_QUERY_FIELD_VALUE,
+        defaultValue: esqlQueryRef.current,
       });
 
       return;
     }
 
-    if (isThreatMatchRule(ruleType)) {
+    if (isThreatMatchRule(ruleType) && isEqual(queryRef.current, DEFAULT_KQL_QUERY_FIELD_VALUE)) {
       queryField.reset({
-        defaultValue: isEqual(queryRef.current, DEFAULT_KQL_QUERY_FIELD_VALUE)
-          ? DEFAULT_THREAT_MATCH_KQL_QUERY_FIELD_VALUE
-          : queryRef.current,
+        defaultValue: DEFAULT_THREAT_MATCH_KQL_QUERY_FIELD_VALUE,
       });
 
       return;
     }
 
-    queryField.reset({
-      defaultValue: isEqual(queryRef.current, DEFAULT_THREAT_MATCH_KQL_QUERY_FIELD_VALUE)
-        ? DEFAULT_KQL_QUERY_FIELD_VALUE
-        : queryRef.current,
-    });
+    if (
+      isThreatMatchRule(previousRuleType) &&
+      isEqual(queryRef.current, DEFAULT_THREAT_MATCH_KQL_QUERY_FIELD_VALUE)
+    ) {
+      queryField.reset({
+        defaultValue: DEFAULT_KQL_QUERY_FIELD_VALUE,
+      });
+    }
+
+    if (isEqlRule(previousRuleType) || isEsqlRule(previousRuleType)) {
+      queryField.reset({
+        defaultValue: queryRef.current ?? DEFAULT_KQL_QUERY_FIELD_VALUE,
+      });
+    }
   }, [queryPath, ruleType, previousRuleType, form]);
 }