EQL: better error message for sequences with only one clause plus UNTIL #132638
Conversation
elasticsearchmachine
added
v9.2.0
Team:Analytics
|
Pinging @elastic/es-analytical-engine (Team:Analytics) |
|
Hi @luigidellaquila, I've created a changelog YAML for you. |
luigidellaquila
added
v8.19.2
v9.1.2
v9.0.6
auto-backport
|
Does this
have a previous report to link to or it's an observation while implementing the fix for |
No earlier reports, I just noticed the problem while fixing the main bug. |
I think this might have some BWC implications. Queries that used to work (incorrectly), will now fail. |
I tend not to consider it a BWC problem, but rather a bug fix, but treating it as a separate issue and discussing it won't hurt. |
| until = queries.remove(queries.size() - 1); | ||
| if (until.isMissingEventFilter()) { | ||
| throw new ParsingException(source, "UNTIL clause cannot be a negative clause (missing event)"); |
There was a problem hiding this comment.
The correct ParsingException would have been ParsingException(until.source(), "UNTIL clause cannot be a....
This reverts commit b63baef.
| assertEquals("1:2: A sequence requires a minimum of 2 queries (excluding UNTIL clause), found [1]", s); | ||
| plan("sequence [any where true] [any where true] until [any where true]"); | ||
| } | ||
|
|
There was a problem hiding this comment.
Add this query as a test, as well: sequence with maxspan=1h ![process where true] until [process where true]
EQL Sequences need at least two clauses in the query. Parsing time checks didn't take into consideration the fact that
UNTILclause doesn't have to account in this number.Here we add a specific error for this case.