@@ -58,115 +58,117 @@ describe('convertToBuildEsQuery', () => {
5858 dateFormatTZ : 'Browser' ,
5959 } ;
6060
61- it ( 'should, by default, build a query where the `nested` fields syntax includes the `"ignore_unmapped":true` option' , ( ) => {
62- const [ converted , _ ] = convertToBuildEsQuery ( {
63- config,
64- dataView : createStubDataView ( { spec : { } } ) ,
65- queries : queryWithNestedFields ,
66- dataViewSpec : mockDataViewSpec ,
67- filters,
68- } ) ;
69-
70- expect ( JSON . parse ( converted ?? '' ) ) . to . eql ( {
71- bool : {
72- must : [ ] ,
73- filter : [
74- {
75- bool : {
76- filter : [
77- {
78- bool : {
79- filter : [
80- {
81- // ✅ Nested fields are converted to use the `nested` query syntax
82- nested : {
83- path : 'threat.enrichments' ,
84- query : {
85- bool : {
86- should : [
87- {
88- match : {
89- 'threat.enrichments.matched.atomic' :
90- 'a4f87cbcd2a4241da77b6bf0c5d9e8553fec991f' ,
91- } ,
61+ const expectedConverted = {
62+ bool : {
63+ must : [ ] ,
64+ filter : [
65+ {
66+ bool : {
67+ filter : [
68+ {
69+ bool : {
70+ filter : [
71+ {
72+ // ✅ Nested fields are converted to use the `nested` query syntax
73+ nested : {
74+ path : 'threat.enrichments' ,
75+ query : {
76+ bool : {
77+ should : [
78+ {
79+ match : {
80+ 'threat.enrichments.matched.atomic' :
81+ 'a4f87cbcd2a4241da77b6bf0c5d9e8553fec991f' ,
9282 } ,
93- ] ,
94- minimum_should_match : 1 ,
95- } ,
83+ } ,
84+ ] ,
85+ minimum_should_match : 1 ,
9686 } ,
97- score_mode : 'none' ,
98- // ✅ The `nested` query syntax includes the `ignore_unmapped` option
99- ignore_unmapped : true ,
10087 } ,
88+ score_mode : 'none' ,
89+ // ✅ The `nested` query syntax includes the `ignore_unmapped` option
90+ ignore_unmapped : true ,
10191 } ,
102- {
103- nested : {
104- path : 'threat.enrichments' ,
105- query : {
106- bool : {
107- should : [
108- {
109- match : {
110- 'threat.enrichments.matched.type' : 'indicator_match_rule' ,
111- } ,
92+ } ,
93+ {
94+ nested : {
95+ path : 'threat.enrichments' ,
96+ query : {
97+ bool : {
98+ should : [
99+ {
100+ match : {
101+ 'threat.enrichments.matched.type' : 'indicator_match_rule' ,
112102 } ,
113- ] ,
114- minimum_should_match : 1 ,
115- } ,
103+ } ,
104+ ] ,
105+ minimum_should_match : 1 ,
116106 } ,
117- score_mode : 'none' ,
118- ignore_unmapped : true ,
119107 } ,
108+ score_mode : 'none' ,
109+ ignore_unmapped : true ,
120110 } ,
121- {
122- nested : {
123- path : 'threat.enrichments' ,
124- query : {
125- bool : {
126- should : [
127- {
128- match : {
129- 'threat.enrichments.matched.field' : 'file.hash.md5' ,
130- } ,
111+ } ,
112+ {
113+ nested : {
114+ path : 'threat.enrichments' ,
115+ query : {
116+ bool : {
117+ should : [
118+ {
119+ match : {
120+ 'threat.enrichments.matched.field' : 'file.hash.md5' ,
131121 } ,
132- ] ,
133- minimum_should_match : 1 ,
134- } ,
122+ } ,
123+ ] ,
124+ minimum_should_match : 1 ,
135125 } ,
136- score_mode : 'none' ,
137- ignore_unmapped : true ,
138126 } ,
127+ score_mode : 'none' ,
128+ ignore_unmapped : true ,
139129 } ,
140- ] ,
141- } ,
130+ } ,
131+ ] ,
142132 } ,
143- {
144- bool : {
145- should : [
146- {
147- exists : {
148- // ✅ Non-nested fields are NOT converted to the `nested` query syntax
149- // ✅ Non-nested fields do NOT include the `ignore_unmapped` option
150- field : '@timestamp' ,
151- } ,
133+ } ,
134+ {
135+ bool : {
136+ should : [
137+ {
138+ exists : {
139+ // ✅ Non-nested fields are NOT converted to the `nested` query syntax
140+ // ✅ Non-nested fields do NOT include the `ignore_unmapped` option
141+ field : '@timestamp' ,
152142 } ,
153- ] ,
154- minimum_should_match : 1 ,
155- } ,
143+ } ,
144+ ] ,
145+ minimum_should_match : 1 ,
156146 } ,
157- ] ,
158- } ,
147+ } ,
148+ ] ,
159149 } ,
160- {
161- exists : {
162- field : '_id' ,
163- } ,
150+ } ,
151+ {
152+ exists : {
153+ field : '_id' ,
164154 } ,
165- ] ,
166- should : [ ] ,
167- must_not : [ ] ,
168- } ,
155+ } ,
156+ ] ,
157+ should : [ ] ,
158+ must_not : [ ] ,
159+ } ,
160+ } ;
161+
162+ it ( 'should, by default, build a query where the `nested` fields syntax includes the `"ignore_unmapped":true` option' , ( ) => {
163+ const [ converted , _ ] = convertToBuildEsQuery ( {
164+ config,
165+ dataView : createStubDataView ( { spec : { } } ) ,
166+ queries : queryWithNestedFields ,
167+ dataViewSpec : mockDataViewSpec ,
168+ filters,
169169 } ) ;
170+
171+ expect ( JSON . parse ( converted ?? '' ) ) . to . eql ( expectedConverted ) ;
170172 } ) ;
171173
172174 it ( 'should, when the default is overridden, build a query where `nested` fields include the `"ignore_unmapped":false` option' , ( ) => {
@@ -280,6 +282,82 @@ describe('convertToBuildEsQuery', () => {
280282 } ,
281283 } ) ;
282284 } ) ;
285+
286+ describe ( 'When ignoreFilterIfFieldNotInIndex is true' , ( ) => {
287+ const updatedConfig = { ...config , ignoreFilterIfFieldNotInIndex : true } ;
288+
289+ it ( 'should use dataViewSpec when an empty dataView is provided' , ( ) => {
290+ mockDataViewSpec . fields = {
291+ _id : {
292+ name : '_id' ,
293+ type : 'string' ,
294+ esTypes : [ 'keyword' ] ,
295+ aggregatable : true ,
296+ searchable : true ,
297+ scripted : false ,
298+ } ,
299+ } ;
300+ const emptyStubDataView = createStubDataView ( { spec : { id : '' , title : '' } } ) ;
301+ const [ converted ] = convertToBuildEsQuery ( {
302+ config : updatedConfig ,
303+ dataView : emptyStubDataView , // <-- empty dataView
304+ queries : queryWithNestedFields ,
305+ dataViewSpec : mockDataViewSpec , // <-- should be used instead of the empty dataView
306+ filters,
307+ } ) ;
308+
309+ expect ( JSON . parse ( converted ?? '' ) ) . to . eql ( expectedConverted ) ; // just verify that something was built
310+ } ) ;
311+
312+ it ( 'should not use the field if the filter is not mapped in the' , ( ) => {
313+ const updatedConvertedWithoutIdQuery = structuredClone ( expectedConverted ) ;
314+ updatedConvertedWithoutIdQuery . bool . filter = [ updatedConvertedWithoutIdQuery . bool . filter [ 0 ] ] ; // remove the search bar filter
315+ const dataViewWithoutIdMapped = createStubDataView ( {
316+ spec : {
317+ id : 'test-id' ,
318+ title : 'some-title' ,
319+ } ,
320+ } ) ;
321+ const [ converted ] = convertToBuildEsQuery ( {
322+ config : updatedConfig ,
323+ dataView : dataViewWithoutIdMapped ,
324+ queries : queryWithNestedFields ,
325+ dataViewSpec : mockDataViewSpec ,
326+ filters,
327+ } ) ;
328+
329+ expect ( JSON . parse ( converted ?? '' ) ) . to . eql ( updatedConvertedWithoutIdQuery ) ; // just verify that something was built
330+ } ) ;
331+
332+ it ( 'should use the filters when the field is mapped in the dataView' , ( ) => {
333+ const dataViewWithIdMapped = createStubDataView ( {
334+ spec : {
335+ id : 'test-id' ,
336+ title : 'some-title' ,
337+ fields : {
338+ _id : {
339+ name : '_id' ,
340+ type : 'string' ,
341+ esTypes : [ 'keyword' ] ,
342+ aggregatable : true ,
343+ searchable : true ,
344+ scripted : false ,
345+ } ,
346+ } ,
347+ } ,
348+ } ) ;
349+ const [ converted ] = convertToBuildEsQuery ( {
350+ config : updatedConfig ,
351+ dataView : dataViewWithIdMapped ,
352+ queries : queryWithNestedFields ,
353+ dataViewSpec : mockDataViewSpec ,
354+ filters,
355+ } ) ;
356+
357+ // This should have the id with the
358+ expect ( JSON . parse ( converted ?? '' ) ) . to . eql ( expectedConverted ) ;
359+ } ) ;
360+ } ) ;
283361} ) ;
284362
285363describe ( 'buildGlobalQuery' , ( ) => {
0 commit comments