[7.x] [Security Solution] [Detections] Combine multiple timestamp searches into single request (#96078) #97722
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…into single request (elastic#96078) * merge multiple timestamp queries into one single search * fix types and unit tests * remove unused code for sending secondary search * removes unused excludeDocsWithTimestampOverride * adds integration tests to cover cases that should / should not generate signals when timestamp override is present in rule * adds integration test to ensure unmapped sort fields do not break search after functionality of detection rules * Need to figure out why moving the tests around fixed them... * updates tests with new es archive data and fixes bug where exclusion filter was hardcoded to event.ingested :yikes: * remove dead commented out code * fixes typo in test file, removes redundant delete signals call in integration test, fixes logic for possibility of receving a null value in sort ids, removes unused utility function for checking valid sort ids * a unit test for checking if an empty string of a sort id is present was failing because we moved the logic for checking that out of the build search query function and up into the big loop. So I moved that unit test into the search after bulk create test file. * fix types * removes isEmpty since it doesn't check for empty strings
Merged
4 tasks
💚 Build Succeeded
Metrics [docs]
To update your PR or re-run it, just comment with: cc @dhurley14 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backports the following commits to 7.x: