From 1669a1044108a11b44b4ee998d55beb84e4e942f Mon Sep 17 00:00:00 2001
From: Zacqary Adam Xeper <Zacqary@users.noreply.github.com>
Date: Wed, 29 Apr 2020 15:36:37 -0500
Subject: [PATCH] [Metrics UI] Fix alerting when a filter query is present
 (#64575)

---
 .../metric_threshold_executor.ts              | 23 ++++++++++++-------
 .../apis/infra/metrics_alerting.ts            | 18 +++++++++++++++
 2 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index 946f1c14bf593..cf691f73bdc2c 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -51,17 +51,19 @@ const getCurrentValueFromAggregations = (
 
 const getParsedFilterQuery: (
   filterQuery: string | undefined
-) => Record<string, any> = filterQuery => {
+) => Record<string, any> | Array<Record<string, any>> = filterQuery => {
   if (!filterQuery) return {};
   try {
     return JSON.parse(filterQuery).bool;
   } catch (e) {
-    return {
-      query_string: {
-        query: filterQuery,
-        analyze_wildcard: true,
+    return [
+      {
+        query_string: {
+          query: filterQuery,
+          analyze_wildcard: true,
+        },
       },
-    };
+    ];
   }
 };
 
@@ -159,8 +161,12 @@ export const getElasticsearchMetricQuery = (
   return {
     query: {
       bool: {
-        filter: [...rangeFilters, ...metricFieldFilters],
-        ...parsedFilterQuery,
+        filter: [
+          ...rangeFilters,
+          ...metricFieldFilters,
+          ...(Array.isArray(parsedFilterQuery) ? parsedFilterQuery : []),
+        ],
+        ...(!Array.isArray(parsedFilterQuery) ? parsedFilterQuery : {}),
       },
     },
     size: 0,
@@ -233,6 +239,7 @@ const getMetric: (
       body: searchBody,
       index,
     });
+
     return { '*': getCurrentValueFromAggregations(result.aggregations, aggType) };
   } catch (e) {
     return { '*': undefined }; // Trigger an Error state
diff --git a/x-pack/test/api_integration/apis/infra/metrics_alerting.ts b/x-pack/test/api_integration/apis/infra/metrics_alerting.ts
index 4f17f9db67483..19879f5761ab2 100644
--- a/x-pack/test/api_integration/apis/infra/metrics_alerting.ts
+++ b/x-pack/test/api_integration/apis/infra/metrics_alerting.ts
@@ -39,6 +39,7 @@ export default function({ getService }: FtrProviderContext) {
           });
           expect(result.error).to.not.be.ok();
           expect(result.hits).to.be.ok();
+          expect(result.aggregations).to.be.ok();
         });
       }
       it('should work with a filterQuery', async () => {
@@ -53,6 +54,21 @@ export default function({ getService }: FtrProviderContext) {
         });
         expect(result.error).to.not.be.ok();
         expect(result.hits).to.be.ok();
+        expect(result.aggregations).to.be.ok();
+      });
+      it('should work with a filterQuery in KQL format', async () => {
+        const searchBody = getElasticsearchMetricQuery(
+          getSearchParams('avg'),
+          undefined,
+          '"agent.hostname":"foo"'
+        );
+        const result = await client.search({
+          index,
+          body: searchBody,
+        });
+        expect(result.error).to.not.be.ok();
+        expect(result.hits).to.be.ok();
+        expect(result.aggregations).to.be.ok();
       });
     });
     describe('querying with a groupBy parameter', () => {
@@ -65,6 +81,7 @@ export default function({ getService }: FtrProviderContext) {
           });
           expect(result.error).to.not.be.ok();
           expect(result.hits).to.be.ok();
+          expect(result.aggregations).to.be.ok();
         });
       }
       it('should work with a filterQuery', async () => {
@@ -79,6 +96,7 @@ export default function({ getService }: FtrProviderContext) {
         });
         expect(result.error).to.not.be.ok();
         expect(result.hits).to.be.ok();
+        expect(result.aggregations).to.be.ok();
       });
     });
   });