EQL: better error message for sequences with only one clause plus UNTIL#132638
Conversation
elasticsearchmachine
added
v9.2.0
Team:Analytics
|
Pinging @elastic/es-analytical-engine (Team:Analytics) |
|
Hi @luigidellaquila, I've created a changelog YAML for you. |
luigidellaquila
added
v8.19.2
v9.1.2
v9.0.6
auto-backport
|
Does this
have a previous report to link to or it's an observation while implementing the fix for |
No earlier reports, I just noticed the problem while fixing the main bug. |
I think this might have some BWC implications. Queries that used to work (incorrectly), will now fail. |
I tend not to consider it a BWC problem, but rather a bug fix, but treating it as a separate issue and discussing it won't hurt. |
| } | ||
| until = queries.remove(queries.size() - 1); | ||
| if (until.isMissingEventFilter()) { | ||
| throw new ParsingException(source, "UNTIL clause cannot be a negative clause (missing event)"); |
There was a problem hiding this comment.
The correct ParsingException would have been ParsingException(until.source(), "UNTIL clause cannot be a....
This reverts commit b63baef.
astefan
left a comment
astefan
left a comment
There was a problem hiding this comment.
LGTM with one test suggestion. Thank you!
| assertEquals("1:2: A sequence requires a minimum of 2 queries (excluding UNTIL clause), found [1]", s); | ||
| plan("sequence [any where true] [any where true] until [any where true]"); | ||
| } | ||
|
|
There was a problem hiding this comment.
Add this query as a test, as well: sequence with maxspan=1h ![process where true] until [process where true]
3 participants
EQL Sequences need at least two clauses in the query. Parsing time checks didn't take into consideration the fact that
UNTILclause doesn't have to account in this number.Here we add a specific error for this case.