* Adding filter chip & query support for special character only strin…

…gs. (#3168) * Removing the filter chip icons for fields that are known not to behave as expected.
google · Aug 28, 2024 · 7e91aef · 7e91aef
1 parent 29ef31f
commit 7e91aef
Show file tree

Hide file tree

Showing 2 changed files with 42 additions and 7 deletions.
diff --git a/timesketch/frontend-ng/src/components/Explore/EventDetail.vue b/timesketch/frontend-ng/src/components/Explore/EventDetail.vue
@@ -41,12 +41,18 @@ limitations under the License.
                     </v-btn>
 
                     <!-- Include field:value as filter chip -->
-                    <v-btn @click.stop="applyFilterChip(key, value, 'must')" icon x-small class="mr-1">
+                    <v-btn
+                      v-if="!ignoreFilterChips.has(key)"
+                      @click.stop="applyFilterChip(key, value, 'must')"
+                      icon
+                      x-small
+                      class="mr-1">
                       <v-icon title="Filter for value">mdi-filter-plus-outline</v-icon>
                     </v-btn>
 
                     <!-- Exclude field:value as filter chip -->
                     <v-btn
+                      v-if="!ignoreFilterChips.has(key)"
                       @click.stop="applyFilterChip(key, value, 'must_not')"
                       icon
                       x-small
@@ -197,9 +203,12 @@ export default {
         'path_spec',
         'strings',
         'timestamp',
-        'timestamp_desc',
         'xml_string',
       ]),
+      ignoreFilterChips: new Set([
+        'datetime',
+        'tag',
+      ]),
       eventKey: '',
       eventValue: '',
       eventTimestamp: 0,

diff --git a/timesketch/lib/datastores/opensearch.py b/timesketch/lib/datastores/opensearch.py
@@ -351,11 +351,28 @@ def build_query(
 
         query_dsl = {"query": {"bool": {"must": [], "must_not": [], "filter": []}}}
 
+        special_char_query = None
+        if query_string:
+            query_parts = query_string.split(":", 1)
+            if len(query_parts) == 2:
+                field_name, query_value = query_parts
+
+                # Special Character Check
+                if set(query_value) <= set('.+-=_&|><!(){}[]^"~?:\\/'):
+                    # Construct the term query directly using the .keyword
+                    special_char_query = {
+                        "term": {f"{field_name}.keyword": query_value}
+                    }
+                    query_string = ""
+
         if query_string:
             query_dsl["query"]["bool"]["must"].append(
                 {"query_string": {"query": query_string, "default_operator": "AND"}}
             )
 
+        if special_char_query:
+            query_dsl["query"]["bool"]["must"].append(special_char_query)
+
         # New UI filters
         if query_filter.get("chips", None):
             labels = []
@@ -374,13 +391,22 @@ def build_query(
                     labels.append(chip["value"])
 
                 elif chip["type"] == "term":
-                    term_filter = {
-                        "match_phrase": {
-                            "{}".format(chip["field"]): {
-                                "query": "{}".format(chip["value"])
+                    if isinstance(chip["value"], str):
+                        term_filter = {
+                            "match_phrase": {
+                                "{}.keyword".format(chip["field"]): {
+                                    "query": "{}".format(chip["value"])
+                                }
+                            }
+                        }
+                    else:
+                        term_filter = {
+                            "match_phrase": {
+                                "{}".format(chip["field"]): {
+                                    "query": "{}".format(chip["value"])
+                                }
                             }
                         }
-                    }
 
                     if chip["operator"] == "must":
                         must_filters.append(term_filter)