From c3cead5cd0848216f190df78ebfeff54366d793e Mon Sep 17 00:00:00 2001
From: Ihor Panasiuk <igorskynet13@gmail.com>
Date: Wed, 15 Jan 2025 11:36:08 +0200
Subject: [PATCH] feat: remove unused json_merge method and add coalesce method
 to SQLite provider; update incident field mapping to include alert_event

---
 keep/api/core/cel_to_sql/sql_providers/mysql.py  | 3 ---
 keep/api/core/cel_to_sql/sql_providers/sqlite.py | 6 +++---
 keep/api/core/incidents.py                       | 7 +++----
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/keep/api/core/cel_to_sql/sql_providers/mysql.py b/keep/api/core/cel_to_sql/sql_providers/mysql.py
index 45b976b6b..b5b64c30d 100644
--- a/keep/api/core/cel_to_sql/sql_providers/mysql.py
+++ b/keep/api/core/cel_to_sql/sql_providers/mysql.py
@@ -2,9 +2,6 @@
 from keep.api.core.cel_to_sql.sql_providers.base import BaseCelToSqlProvider
 
 class CelToMySqlProvider(BaseCelToSqlProvider):
-    def _json_merge(self, columns: List[str]) -> str:
-        return f"json_patch({', '.join(columns)})"
-
     def json_extract(self, column: str, path: str) -> str:
         return f"JSON_UNQUOTE(JSON_EXTRACT({column}, \"$.{path}\"))"
     
diff --git a/keep/api/core/cel_to_sql/sql_providers/sqlite.py b/keep/api/core/cel_to_sql/sql_providers/sqlite.py
index 7f8aa2fd5..425378c4b 100644
--- a/keep/api/core/cel_to_sql/sql_providers/sqlite.py
+++ b/keep/api/core/cel_to_sql/sql_providers/sqlite.py
@@ -2,12 +2,12 @@
 from keep.api.core.cel_to_sql.sql_providers.base import BaseCelToSqlProvider
 
 class CelToSqliteProvider(BaseCelToSqlProvider):
-    def _json_merge(self, columns: List[str]) -> str:
-        return f"json_patch({', '.join(columns)})"
-
     def json_extract(self, column: str, path: str) -> str:
         return f"json_extract({column}, \"$.{path}\")"
     
+    def coalesce(self, args):
+        return f"COALESCE({', '.join(args)})"
+    
     def _visit_contains_method_calling(self, property_path: str, method_args: List[str]) -> str:
         return f"{property_path} LIKE \"%{method_args[0]}%\""
     
diff --git a/keep/api/core/incidents.py b/keep/api/core/incidents.py
index b06011122..93f06ae41 100644
--- a/keep/api/core/incidents.py
+++ b/keep/api/core/incidents.py
@@ -24,10 +24,7 @@
 )
 from keep.api.models.db.facet import FacetType
 from keep.api.models.facet import FacetDto, FacetOptionDto
-from sqlalchemy.dialects import mysql
-import uuid
 
-# from keep.api.models.db.facet import Facet, FacetEntityType
 
 incident_field_configurations = [
     FieldMappingConfiguration("user_generated_name", "user_generated_name"),
@@ -54,7 +51,7 @@
     FieldMappingConfiguration("merged_at", "merged_at"),
     FieldMappingConfiguration("merged_by", "merged_by"),
     FieldMappingConfiguration("alert.provider_type", "incident_alert_provider_type"),
-    FieldMappingConfiguration(map_from_pattern = "alert.*", map_to=["alert_enrichments"], is_json=True),
+    FieldMappingConfiguration(map_from_pattern = "alert.*", map_to=["alert_enrichments", "alert_event"], is_json=True),
 ]
 
 properties_metadata = PropertiesMetadata(incident_field_configurations)
@@ -270,6 +267,8 @@ def __build_facets_data_query(
             elif isinstance(metadata[0], SimpleMapping):
                 group_by_exp.append(item.map_to)
 
+        group_by_exp += ['NULL']
+
         union_queries.append(
             select(
                 literal(facet_name).label("facet_name"),