[OneWorkflow] Add datemath support to KQL evaluator

src/platform/plugins/shared/workflows_execution_engine/moon.extend.yml

@@ -0,0 +1,17 @@
+dependsOn:
+  - '@kbn/core'
+  - '@kbn/config-schema'
+  - '@kbn/actions-plugin'
+  - '@kbn/workflows'
+  - '@kbn/task-manager-plugin'
+  - '@kbn/es-query'
+  - '@kbn/core-elasticsearch-server'
+  - '@kbn/cloud-plugin'
+  - '@kbn/datemath'
+  - '@kbn/utility-types'
+  - '@kbn/zod'
+  - '@kbn/core-data-streams-server'
+  - '@kbn/data-streams'
+  - '@kbn/es-mappings'
+  - '@kbn/workflows-extensions'
+  - '@kbn/licensing-plugin'

src/platform/plugins/shared/workflows_execution_engine/moon.yml

@@ -26,6 +26,7 @@ dependsOn:
   - '@kbn/es-query'
   - '@kbn/core-elasticsearch-server'
   - '@kbn/cloud-plugin'
+  - '@kbn/datemath'
   - '@kbn/utility-types'
   - '@kbn/zod'
   - '@kbn/core-data-streams-server'

src/platform/plugins/shared/workflows_execution_engine/server/utils/eval_kql/eval_kql.test.ts

@@ -7,8 +7,11 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
+import dateMath from '@kbn/datemath';
 import { evaluateKql } from './eval_kql';
 
+const FAKE_NOW = new Date('2025-01-15T12:00:00.000Z');
+
 describe('evaluateKql', () => {
   it('should throw an error for invalid KQL', () => {
     expect(() => evaluateKql('invalid "kql', {})).toThrowError();
@@ -156,6 +159,97 @@ describe('evaluateKql', () => {
     });
   });
 
+  describe('datemath expressions', () => {
+    beforeEach(() => {
+      jest.useFakeTimers();
+      jest.setSystemTime(FAKE_NOW);
+    });
+
+    afterEach(() => {
+      jest.useRealTimers();
+    });
+
+    describe('"is" expressions with datemath', () => {
+      it('should match when context value equals "now" resolved to ISO string', () => {
+        const kql = 'timestamp: now';
+        const nowIso = dateMath.parse('now')!.toISOString();
+        expect(evaluateKql(kql, { timestamp: nowIso })).toBe(true);
+      });
+
+      it('should match "now-1d" against the resolved date', () => {
+        const kql = 'timestamp: now-1d';
+        const resolved = dateMath.parse('now-1d')!.toISOString();
+        expect(evaluateKql(kql, { timestamp: resolved })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2020-01-01T00:00:00.000Z' })).toBe(false);
+      });
+
+      it('should match datemath with || anchor syntax', () => {
+        const kql = 'timestamp: "2025-01-01T00:00:00.000Z||+1d"';
+        const resolved = dateMath.parse('2025-01-01T00:00:00.000Z||+1d')!.toISOString();
+        expect(evaluateKql(kql, { timestamp: resolved })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2025-01-01T00:00:00.000Z' })).toBe(false);
+      });
+    });
+
+    describe('range expressions with datemath', () => {
+      it('should evaluate >= with datemath on the right side', () => {
+        const kql = 'timestamp >= now-7d';
+        // now is 2025-01-15T12:00:00Z, so now-7d is 2025-01-08T12:00:00Z
+        expect(evaluateKql(kql, { timestamp: '2025-01-10T00:00:00.000Z' })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2025-01-01T00:00:00.000Z' })).toBe(false);
+      });
+
+      it('should not evaluate >= with datemath on the left side', () => {
+        const kql = 'now-7d >= timestamp';
+        // now is 2025-01-15T12:00:00Z, so now-7d is 2025-01-08T12:00:00Z
+        expect(evaluateKql(kql, { timestamp: '2025-01-01T00:00:00.000Z' })).toBe(false);
+      });
+
+      it('should evaluate < with datemath on the right side', () => {
+        const kql = 'timestamp < now';
+        expect(evaluateKql(kql, { timestamp: '2025-01-14T00:00:00.000Z' })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2025-01-16T00:00:00.000Z' })).toBe(false);
+      });
+
+      it('should evaluate range between two datemath expressions', () => {
+        const kql = 'timestamp >= now-7d and timestamp <= now';
+        expect(evaluateKql(kql, { timestamp: '2025-01-10T00:00:00.000Z' })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2025-01-01T00:00:00.000Z' })).toBe(false);
+        expect(evaluateKql(kql, { timestamp: '2025-01-16T00:00:00.000Z' })).toBe(false);
+      });
+
+      it('should evaluate range with datemath expressions with rounding', () => {
+        const baseKql = 'timestamp >= now';
+        expect(evaluateKql(`${baseKql}/d`, { timestamp: '2025-01-20T00:00:00.000Z' })).toBe(true);
+        expect(evaluateKql(`${baseKql}-7d/d`, { timestamp: '2025-01-10T00:00:00.000Z' })).toBe(
+          true
+        );
+      });
+    });
+
+    describe('fallback for non-datemath strings', () => {
+      it('should still compare plain strings normally', () => {
+        const kql = 'status: active';
+        expect(evaluateKql(kql, { status: 'active' })).toBe(true);
+        expect(evaluateKql(kql, { status: 'inactive' })).toBe(false);
+      });
+
+      it('should treat invalid datemath starting with "now" as raw string', () => {
+        // "now-invalidunit" is not a valid datemath expression, should fall back to raw string
+        const kql = 'label: now-invalidunit';
+        expect(evaluateKql(kql, { label: 'now-invalidunit' })).toBe(true);
+        expect(evaluateKql(kql, { label: 'something-else' })).toBe(false);
+      });
+
+      it('should not parse ISO date strings as datemath', () => {
+        // Plain ISO strings without || should remain as raw strings
+        const kql = 'date: "2025-01-15T12:00:00.000Z"';
+        expect(evaluateKql(kql, { date: '2025-01-15T12:00:00.000Z' })).toBe(true);
+        expect(evaluateKql(kql, { date: '2025-01-16T00:00:00.000Z' })).toBe(false);
+      });
+    });
+  });
+
   describe('logical expressions', () => {
     it('should evaluate AND expressions correctly', () => {
       const kql = 'status: active and isActive: true';

src/platform/plugins/shared/workflows_execution_engine/server/utils/eval_kql/eval_kql.ts

@@ -10,6 +10,7 @@
 // TODO: Remove eslint exceptions comments and fix the issues
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
+import dateMath from '@kbn/datemath';
 import type { KueryNode } from '@kbn/es-query';
 import { fromKueryExpression } from '@kbn/es-query';
 import type {
@@ -133,8 +134,16 @@ function convertLiteralToValue(
   expectedType: 'string' | 'number' | 'boolean'
 ): any {
   switch (expectedType) {
-    case 'string':
-      return String(node.value);
+    case 'string': {
+      const strValue = String(node.value);
+      const parsed = dateMath.parse(strValue);
+      if (parsed?.isValid()) {
+        // it's a date math expression, return the resolved ISO string
+        return parsed.toISOString();
+      }
+
+      return strValue;
+    }
     case 'number':
       return parseFloat(node.value as string);
     case 'boolean':

src/platform/plugins/shared/workflows_execution_engine/tsconfig.json

@@ -19,6 +19,7 @@
     "@kbn/workflows",
     "@kbn/task-manager-plugin",
     "@kbn/es-query",
+    "@kbn/datemath",
     "@kbn/core-elasticsearch-server",
     "@kbn/cloud-plugin",
     "@kbn/utility-types",