Skip to content

Commit d49a9aa

Browse files
aleksmausaleksmaus
authored
EQL: Change request parameter query to filter and rule to query (#52971)
* EQL: Change request parameter query to filter and rule to query Related to #52911 * Adjust doc test
1 parent 996ec0d commit d49a9aa

File tree

11 files changed

+103
-105
lines changed

11 files changed

+103
-105
lines changed

‎client/rest-high-level/src/main/java/org/elasticsearch/client/eql/EqlSearchRequest.java

+23-24
Original file line numberDiff line numberDiff line change
@@ -36,32 +36,32 @@ public class EqlSearchRequest implements Validatable, ToXContentObject {
3636
private String[] indices;
3737
private IndicesOptions indicesOptions = IndicesOptions.fromOptions(false, false, true, false);
3838

39-
private QueryBuilder query = null;
39+
private QueryBuilder filter = null;
4040
private String timestampField = "@timestamp";
4141
private String eventTypeField = "event_type";
4242
private String implicitJoinKeyField = "agent.id";
4343
private int fetchSize = 50;
4444
private SearchAfterBuilder searchAfterBuilder;
45-
private String rule;
45+
private String query;
4646

47-
static final String KEY_QUERY = "query";
47+
static final String KEY_FILTER = "filter";
4848
static final String KEY_TIMESTAMP_FIELD = "timestamp_field";
4949
static final String KEY_EVENT_TYPE_FIELD = "event_type_field";
5050
static final String KEY_IMPLICIT_JOIN_KEY_FIELD = "implicit_join_key_field";
5151
static final String KEY_SIZE = "size";
5252
static final String KEY_SEARCH_AFTER = "search_after";
53-
static final String KEY_RULE = "rule";
53+
static final String KEY_QUERY = "query";
5454

55-
public EqlSearchRequest(String indices, String rule) {
55+
public EqlSearchRequest(String indices, String query) {
5656
indices(indices);
57-
rule(rule);
57+
query(query);
5858
}
5959

6060
@Override
6161
public XContentBuilder toXContent(XContentBuilder builder, ToXContent.Params params) throws IOException {
6262
builder.startObject();
63-
if (query != null) {
64-
builder.field(KEY_QUERY, query);
63+
if (filter != null) {
64+
builder.field(KEY_FILTER, filter);
6565
}
6666
builder.field(KEY_TIMESTAMP_FIELD, timestampField());
6767
builder.field(KEY_EVENT_TYPE_FIELD, eventTypeField());
@@ -74,7 +74,7 @@ public XContentBuilder toXContent(XContentBuilder builder, ToXContent.Params par
7474
builder.array(KEY_SEARCH_AFTER, searchAfterBuilder.getSortValues());
7575
}
7676

77-
builder.field(KEY_RULE, rule);
77+
builder.field(KEY_QUERY, query);
7878
builder.endObject();
7979
return builder;
8080
}
@@ -88,12 +88,12 @@ public EqlSearchRequest indices(String... indices) {
8888
return this;
8989
}
9090

91-
public QueryBuilder query() {
92-
return this.query;
91+
public QueryBuilder filter() {
92+
return this.filter;
9393
}
9494

95-
public EqlSearchRequest query(QueryBuilder query) {
96-
this.query = query;
95+
public EqlSearchRequest filter(QueryBuilder filter) {
96+
this.filter = filter;
9797
return this;
9898
}
9999

@@ -156,13 +156,13 @@ private EqlSearchRequest setSearchAfter(SearchAfterBuilder builder) {
156156
return this;
157157
}
158158

159-
public String rule() {
160-
return this.rule;
159+
public String query() {
160+
return this.query;
161161
}
162162

163-
public EqlSearchRequest rule(String rule) {
164-
Objects.requireNonNull(rule, "rule must not be null");
165-
this.rule = rule;
163+
public EqlSearchRequest query(String query) {
164+
Objects.requireNonNull(query, "query must not be null");
165+
this.query = query;
166166
return this;
167167
}
168168

@@ -175,30 +175,29 @@ public boolean equals(Object o) {
175175
return false;
176176
}
177177
EqlSearchRequest that = (EqlSearchRequest) o;
178-
return
179-
fetchSize == that.fetchSize &&
178+
return fetchSize == that.fetchSize &&
180179
Arrays.equals(indices, that.indices) &&
181180
Objects.equals(indicesOptions, that.indicesOptions) &&
182-
Objects.equals(query, that.query) &&
181+
Objects.equals(filter, that.filter) &&
183182
Objects.equals(timestampField, that.timestampField) &&
184183
Objects.equals(eventTypeField, that.eventTypeField) &&
185184
Objects.equals(implicitJoinKeyField, that.implicitJoinKeyField) &&
186185
Objects.equals(searchAfterBuilder, that.searchAfterBuilder) &&
187-
Objects.equals(rule, that.rule);
186+
Objects.equals(query, that.query);
188187
}
189188

190189
@Override
191190
public int hashCode() {
192191
return Objects.hash(
193192
Arrays.hashCode(indices),
194193
indicesOptions,
195-
query,
194+
filter,
196195
fetchSize,
197196
timestampField,
198197
eventTypeField,
199198
implicitJoinKeyField,
200199
searchAfterBuilder,
201-
rule);
200+
query);
202201
}
203202

204203
public String[] indices() {

‎client/rest-high-level/src/test/java/org/elasticsearch/client/eql/EqlSearchRequestTests.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ protected EqlSearchRequest createClientTestInstance() {
4646
EqlSearchRequest.eventTypeField(randomAlphaOfLength(10));
4747
}
4848
if (randomBoolean()) {
49-
EqlSearchRequest.rule(randomAlphaOfLength(10));
49+
EqlSearchRequest.query(randomAlphaOfLength(10));
5050
}
5151
if (randomBoolean()) {
5252
EqlSearchRequest.timestampField(randomAlphaOfLength(10));
@@ -56,9 +56,9 @@ protected EqlSearchRequest createClientTestInstance() {
5656
}
5757
if (randomBoolean()) {
5858
if (randomBoolean()) {
59-
EqlSearchRequest.query(QueryBuilders.matchAllQuery());
59+
EqlSearchRequest.filter(QueryBuilders.matchAllQuery());
6060
} else {
61-
EqlSearchRequest.query(QueryBuilders.termQuery(randomAlphaOfLength(10), randomInt(100)));
61+
EqlSearchRequest.filter(QueryBuilders.termQuery(randomAlphaOfLength(10), randomInt(100)));
6262
}
6363
}
6464
return EqlSearchRequest;
@@ -75,8 +75,8 @@ protected void assertInstances(org.elasticsearch.xpack.eql.action.EqlSearchReque
7575
assertThat(serverInstance.eventTypeField(), equalTo(clientTestInstance.eventTypeField()));
7676
assertThat(serverInstance.implicitJoinKeyField(), equalTo(clientTestInstance.implicitJoinKeyField()));
7777
assertThat(serverInstance.timestampField(), equalTo(clientTestInstance.timestampField()));
78+
assertThat(serverInstance.filter(), equalTo(clientTestInstance.filter()));
7879
assertThat(serverInstance.query(), equalTo(clientTestInstance.query()));
79-
assertThat(serverInstance.rule(), equalTo(clientTestInstance.rule()));
8080
assertThat(serverInstance.searchAfter(), equalTo(clientTestInstance.searchAfter()));
8181
assertThat(serverInstance.indicesOptions(), equalTo(clientTestInstance.indicesOptions()));
8282
assertThat(serverInstance.indices(), equalTo(clientTestInstance.indices()));

‎docs/reference/eql/search.asciidoc

+2-2
Original file line numberDiff line numberDiff line change
@@ -27,15 +27,15 @@ PUT sec_logs/_bulk?refresh
2727
You can now use the EQL search API to search this index using an EQL query.
2828

2929
The following request searches the `sec_logs` index using the EQL query
30-
specified in the `rule` parameter. The EQL query matches events with an
30+
specified in the `query` parameter. The EQL query matches events with an
3131
`event.category` of `process` that have a `process.name` of `cmd.exe`.
3232

3333
[source,console]
3434
----
3535
GET sec_logs/_eql/search
3636
{
3737
"event_type_field": "event.category",
38-
"rule": """
38+
"query": """
3939
process where process.name == "cmd.exe"
4040
"""
4141
}

‎x-pack/plugin/eql/qa/common/src/main/java/org/elasticsearch/test/eql/CommonEqlRestTestCase.java

+13-13
Original file line numberDiff line numberDiff line change
@@ -36,31 +36,31 @@ static class SearchTestConfiguration {
3636
}
3737

3838
public static final String defaultValidationIndexName = "eql_search_validation_test";
39-
private static final String validRule = "process where user = 'SYSTEM'";
39+
private static final String validQuery = "process where user = 'SYSTEM'";
4040

4141
public static final ArrayList<SearchTestConfiguration> searchValidationTests;
4242
static {
4343
searchValidationTests = new ArrayList<>();
4444
searchValidationTests.add(new SearchTestConfiguration(null, 400, "request body or source parameter is required"));
45-
searchValidationTests.add(new SearchTestConfiguration("{}", 400, "rule is null or empty"));
46-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"\"}", 400, "rule is null or empty"));
47-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"timestamp_field\": \"\"}",
45+
searchValidationTests.add(new SearchTestConfiguration("{}", 400, "query is null or empty"));
46+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"\"}", 400, "query is null or empty"));
47+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"timestamp_field\": \"\"}",
4848
400, "timestamp field is null or empty"));
49-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"event_type_field\": \"\"}",
49+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"event_type_field\": \"\"}",
5050
400, "event type field is null or empty"));
51-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"implicit_join_key_field\": \"\"}",
51+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"implicit_join_key_field\": \"\"}",
5252
400, "implicit join key field is null or empty"));
53-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"size\": 0}",
53+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"size\": 0}",
5454
400, "size must be greater than 0"));
55-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"size\": -1}",
55+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"size\": -1}",
5656
400, "size must be greater than 0"));
57-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"search_after\": null}",
57+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"search_after\": null}",
5858
400, "search_after doesn't support values of type: VALUE_NULL"));
59-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"search_after\": []}",
59+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"search_after\": []}",
6060
400, "must contains at least one value"));
61-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"query\": null}",
62-
400, "query doesn't support values of type: VALUE_NULL"));
63-
searchValidationTests.add(new SearchTestConfiguration("{\"rule\": \"" + validRule + "\", \"query\": {}}",
61+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"filter\": null}",
62+
400, "filter doesn't support values of type: VALUE_NULL"));
63+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"filter\": {}}",
6464
400, "query malformed, empty clause found"));
6565
}
6666

‎x-pack/plugin/eql/qa/rest/src/test/resources/rest-api-spec/test/eql/10_basic.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ setup:
1717
eql.search:
1818
index: eql_test
1919
body:
20-
rule: "process where user = 'SYSTEM'"
20+
query: "process where user = 'SYSTEM'"
2121

2222
- match: {timed_out: false}
2323
- match: {hits.total.value: 1}

0 commit comments

Comments
 (0)