From e3f16a971fe05a59fdd5b7b3bd2fbdda4307c6f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez?=
 <alejandro.fernandez@elastic.co>
Date: Mon, 30 Mar 2020 15:10:28 +0200
Subject: [PATCH] =?UTF-8?q?[7.x]=20[Logs=20UI]=20Add=20`context`=20fields?=
 =?UTF-8?q?=20to=20`/log=5Fentries/entries`=E2=80=A6=20(#61784)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../common/http_api/log_entries/entries.ts    |  5 ++++
 .../log_entries_domain/log_entries_domain.ts  | 14 +++++++++-
 .../api_integration/apis/infra/log_entries.ts | 26 +++++++++++++++++++
 3 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/infra/common/http_api/log_entries/entries.ts b/x-pack/plugins/infra/common/http_api/log_entries/entries.ts
index 419ee021a9189..d532c079e3e9c 100644
--- a/x-pack/plugins/infra/common/http_api/log_entries/entries.ts
+++ b/x-pack/plugins/infra/common/http_api/log_entries/entries.ts
@@ -78,6 +78,11 @@ export const logEntryRT = rt.type({
   id: rt.string,
   cursor: logEntriesCursorRT,
   columns: rt.array(logColumnRT),
+  context: rt.partial({
+    'log.file.path': rt.string,
+    'host.name': rt.string,
+    'container.id': rt.string,
+  }),
 });
 
 export type LogMessageConstantPart = rt.TypeOf<typeof logMessageConstantPartRT>;
diff --git a/x-pack/plugins/infra/server/lib/domains/log_entries_domain/log_entries_domain.ts b/x-pack/plugins/infra/server/lib/domains/log_entries_domain/log_entries_domain.ts
index a88b1d9049c76..528b9a69327fa 100644
--- a/x-pack/plugins/infra/server/lib/domains/log_entries_domain/log_entries_domain.ts
+++ b/x-pack/plugins/infra/server/lib/domains/log_entries_domain/log_entries_domain.ts
@@ -49,6 +49,8 @@ export interface LogEntriesAroundParams {
 
 export const LOG_ENTRIES_PAGE_SIZE = 200;
 
+const FIELDS_FROM_CONTEXT = ['log.file.path', 'host.name', 'container.id'] as const;
+
 export class InfraLogEntriesDomain {
   constructor(
     private readonly adapter: LogEntriesAdapter,
@@ -154,6 +156,14 @@ export class InfraLogEntriesDomain {
             }
           }
         ),
+        context: FIELDS_FROM_CONTEXT.reduce<LogEntry['context']>((ctx, field) => {
+          // Users might have different types here in their mappings.
+          const value = doc.fields[field];
+          if (typeof value === 'string') {
+            ctx[field] = value;
+          }
+          return ctx;
+        }, {}),
       };
     });
 
@@ -329,7 +339,9 @@ const getRequiredFields = (
   );
   const fieldsFromFormattingRules = messageFormattingRules.requiredFields;
 
-  return Array.from(new Set([...fieldsFromCustomColumns, ...fieldsFromFormattingRules]));
+  return Array.from(
+    new Set([...fieldsFromCustomColumns, ...fieldsFromFormattingRules, ...FIELDS_FROM_CONTEXT])
+  );
 };
 
 const createHighlightQueryDsl = (phrase: string, fields: string[]) => ({
diff --git a/x-pack/test/api_integration/apis/infra/log_entries.ts b/x-pack/test/api_integration/apis/infra/log_entries.ts
index 4f447d518a751..3c12f5e4dc789 100644
--- a/x-pack/test/api_integration/apis/infra/log_entries.ts
+++ b/x-pack/test/api_integration/apis/infra/log_entries.ts
@@ -126,6 +126,32 @@ export default function({ getService }: FtrProviderContext) {
           expect(messageColumn.message.length).to.be.greaterThan(0);
         });
 
+        it('Returns the context fields', async () => {
+          const { body } = await supertest
+            .post(LOG_ENTRIES_PATH)
+            .set(COMMON_HEADERS)
+            .send(
+              logEntriesRequestRT.encode({
+                sourceId: 'default',
+                startTimestamp: EARLIEST_KEY_WITH_DATA.time,
+                endTimestamp: LATEST_KEY_WITH_DATA.time,
+                center: KEY_WITHIN_DATA_RANGE,
+              })
+            )
+            .expect(200);
+
+          const logEntriesResponse = pipe(
+            logEntriesResponseRT.decode(body),
+            fold(throwErrors(createPlainError), identity)
+          );
+
+          const entries = logEntriesResponse.data.entries;
+          const entry = entries[0];
+
+          expect(entry.context).to.have.property('host.name');
+          expect(entry.context['host.name']).to.be('demo-stack-nginx-01');
+        });
+
         it('Paginates correctly with `after`', async () => {
           const { body: firstPageBody } = await supertest
             .post(LOG_ENTRIES_PATH)