From c0e0bca84cba46198a36dc0d98c294d928aad794 Mon Sep 17 00:00:00 2001 From: Andrei Stefan Date: Thu, 9 Jul 2020 12:34:01 +0300 Subject: [PATCH] Remove search_after and implicit_join_key_field (#59232) (#59280) (cherry picked from commit 6ede6c59eff321b9fedad30e19508b9e4f788b54) --- .../client/eql/EqlSearchRequest.java | 44 --------------- .../client/eql/EqlSearchRequestTests.java | 8 --- docs/reference/eql/eql-search-api.asciidoc | 8 --- .../test/eql/CommonEqlRestTestCase.java | 3 - .../xpack/eql/action/EqlSearchRequest.java | 55 ------------------- .../eql/action/EqlSearchRequestBuilder.java | 12 +--- .../xpack/eql/action/RequestDefaults.java | 1 - .../xpack/eql/parser/ParserParams.java | 11 ---- .../eql/plugin/TransportEqlSearchAction.java | 1 - .../eql/action/EqlRequestParserTests.java | 9 --- .../eql/action/EqlSearchRequestTests.java | 26 --------- 11 files changed, 1 insertion(+), 177 deletions(-) diff --git a/client/rest-high-level/src/main/java/org/elasticsearch/client/eql/EqlSearchRequest.java b/client/rest-high-level/src/main/java/org/elasticsearch/client/eql/EqlSearchRequest.java index 7416803b834..10cda684ae2 100644 --- a/client/rest-high-level/src/main/java/org/elasticsearch/client/eql/EqlSearchRequest.java +++ b/client/rest-high-level/src/main/java/org/elasticsearch/client/eql/EqlSearchRequest.java @@ -26,7 +26,6 @@ import org.elasticsearch.common.xcontent.ToXContent; import org.elasticsearch.common.xcontent.ToXContentObject; import org.elasticsearch.common.xcontent.XContentBuilder; import org.elasticsearch.index.query.QueryBuilder; -import org.elasticsearch.search.searchafter.SearchAfterBuilder; import java.io.IOException; import java.util.Arrays; @@ -40,12 +39,10 @@ public class EqlSearchRequest implements Validatable, ToXContentObject { private QueryBuilder filter = null; private String timestampField = "@timestamp"; private String eventCategoryField = "event.category"; - private String implicitJoinKeyField = "agent.id"; private boolean isCaseSensitive = true; private int size = 10; private int fetchSize = 1000; - private SearchAfterBuilder searchAfterBuilder; private String query; private String tiebreakerField; @@ -58,11 +55,9 @@ public class EqlSearchRequest implements Validatable, ToXContentObject { static final String KEY_TIMESTAMP_FIELD = "timestamp_field"; static final String KEY_TIEBREAKER_FIELD = "tiebreaker_field"; static final String KEY_EVENT_CATEGORY_FIELD = "event_category_field"; - static final String KEY_IMPLICIT_JOIN_KEY_FIELD = "implicit_join_key_field"; static final String KEY_CASE_SENSITIVE = "case_sensitive"; static final String KEY_SIZE = "size"; static final String KEY_FETCH_SIZE = "fetch_size"; - static final String KEY_SEARCH_AFTER = "search_after"; static final String KEY_QUERY = "query"; static final String KEY_WAIT_FOR_COMPLETION_TIMEOUT = "wait_for_completion_timeout"; static final String KEY_KEEP_ALIVE = "keep_alive"; @@ -84,16 +79,8 @@ public class EqlSearchRequest implements Validatable, ToXContentObject { builder.field(KEY_TIEBREAKER_FIELD, tiebreakerField()); } builder.field(KEY_EVENT_CATEGORY_FIELD, eventCategoryField()); - if (implicitJoinKeyField != null) { - builder.field(KEY_IMPLICIT_JOIN_KEY_FIELD, implicitJoinKeyField()); - } builder.field(KEY_SIZE, size()); builder.field(KEY_FETCH_SIZE, fetchSize()); - - if (searchAfterBuilder != null) { - builder.array(KEY_SEARCH_AFTER, searchAfterBuilder.getSortValues()); - } - builder.field(KEY_CASE_SENSITIVE, isCaseSensitive()); builder.field(KEY_QUERY, query); @@ -156,10 +143,6 @@ public class EqlSearchRequest implements Validatable, ToXContentObject { return this; } - public String implicitJoinKeyField() { - return this.implicitJoinKeyField; - } - public boolean isCaseSensitive() { return this.isCaseSensitive; } @@ -169,12 +152,6 @@ public class EqlSearchRequest implements Validatable, ToXContentObject { return this; } - public EqlSearchRequest implicitJoinKeyField(String implicitJoinKeyField) { - Objects.requireNonNull(implicitJoinKeyField, "implicit join key must not be null"); - this.implicitJoinKeyField = implicitJoinKeyField; - return this; - } - public int size() { return this.size; } @@ -199,23 +176,6 @@ public class EqlSearchRequest implements Validatable, ToXContentObject { return this; } - public Object[] searchAfter() { - if (searchAfterBuilder == null) { - return null; - } - return searchAfterBuilder.getSortValues(); - } - - public EqlSearchRequest searchAfter(Object[] values) { - this.searchAfterBuilder = new SearchAfterBuilder().setSortValues(values); - return this; - } - - private EqlSearchRequest setSearchAfter(SearchAfterBuilder builder) { - this.searchAfterBuilder = builder; - return this; - } - public String query() { return this.query; } @@ -269,8 +229,6 @@ public class EqlSearchRequest implements Validatable, ToXContentObject { Objects.equals(timestampField, that.timestampField) && Objects.equals(tiebreakerField, that.tiebreakerField) && Objects.equals(eventCategoryField, that.eventCategoryField) && - Objects.equals(implicitJoinKeyField, that.implicitJoinKeyField) && - Objects.equals(searchAfterBuilder, that.searchAfterBuilder) && Objects.equals(query, that.query) && Objects.equals(isCaseSensitive, that.isCaseSensitive) && Objects.equals(waitForCompletionTimeout, that.waitForCompletionTimeout) && @@ -289,8 +247,6 @@ public class EqlSearchRequest implements Validatable, ToXContentObject { timestampField, tiebreakerField, eventCategoryField, - implicitJoinKeyField, - searchAfterBuilder, query, isCaseSensitive, waitForCompletionTimeout, diff --git a/client/rest-high-level/src/test/java/org/elasticsearch/client/eql/EqlSearchRequestTests.java b/client/rest-high-level/src/test/java/org/elasticsearch/client/eql/EqlSearchRequestTests.java index db378b6d8e6..9764fbc1973 100644 --- a/client/rest-high-level/src/test/java/org/elasticsearch/client/eql/EqlSearchRequestTests.java +++ b/client/rest-high-level/src/test/java/org/elasticsearch/client/eql/EqlSearchRequestTests.java @@ -39,9 +39,6 @@ public class EqlSearchRequestTests extends AbstractRequestTestCase randomAlphaOfLength(3))); - } if (randomBoolean()) { if (randomBoolean()) { EqlSearchRequest.filter(QueryBuilders.matchAllQuery()); @@ -76,12 +70,10 @@ public class EqlSearchRequestTests extends AbstractRequestTestCase>. -`search_after`:: -(Optional, string) -Reserved for future use. - `size`:: (Optional, integer or float) For <>, the maximum number of matching events to diff --git a/x-pack/plugin/eql/qa/common/src/main/java/org/elasticsearch/test/eql/CommonEqlRestTestCase.java b/x-pack/plugin/eql/qa/common/src/main/java/org/elasticsearch/test/eql/CommonEqlRestTestCase.java index 1b6306fcb2a..fc851a9f4fe 100644 --- a/x-pack/plugin/eql/qa/common/src/main/java/org/elasticsearch/test/eql/CommonEqlRestTestCase.java +++ b/x-pack/plugin/eql/qa/common/src/main/java/org/elasticsearch/test/eql/CommonEqlRestTestCase.java @@ -30,11 +30,8 @@ public abstract class CommonEqlRestTestCase extends ESRestTestCase { {"{\"query\": \"\"}", "query is null or empty"}, {"{\"query\": \"" + validQuery + "\", \"timestamp_field\": \"\"}", "timestamp field is null or empty"}, {"{\"query\": \"" + validQuery + "\", \"event_category_field\": \"\"}", "event category field is null or empty"}, - {"{\"query\": \"" + validQuery + "\", \"implicit_join_key_field\": \"\"}", "implicit join key field is null or empty"}, {"{\"query\": \"" + validQuery + "\", \"size\": 0}", "size must be greater than 0"}, {"{\"query\": \"" + validQuery + "\", \"size\": -1}", "size must be greater than 0"}, - {"{\"query\": \"" + validQuery + "\", \"search_after\": null}", "search_after doesn't support values of type: VALUE_NULL"}, - {"{\"query\": \"" + validQuery + "\", \"search_after\": []}", "must contains at least one value"}, {"{\"query\": \"" + validQuery + "\", \"filter\": null}", "filter doesn't support values of type: VALUE_NULL"}, {"{\"query\": \"" + validQuery + "\", \"filter\": {}}", "query malformed, empty clause found"} }; diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequest.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequest.java index 0fc6ab43b67..dc4f0f96bb4 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequest.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequest.java @@ -21,7 +21,6 @@ import org.elasticsearch.common.xcontent.XContentBuilder; import org.elasticsearch.common.xcontent.XContentParser; import org.elasticsearch.index.query.AbstractQueryBuilder; import org.elasticsearch.index.query.QueryBuilder; -import org.elasticsearch.search.searchafter.SearchAfterBuilder; import org.elasticsearch.tasks.Task; import org.elasticsearch.tasks.TaskId; @@ -33,7 +32,6 @@ import java.util.function.Supplier; import static org.elasticsearch.action.ValidateActions.addValidationError; import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_EVENT_CATEGORY; -import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_IMPLICIT_JOIN_KEY; import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_TIMESTAMP; public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Replaceable, ToXContent { @@ -49,10 +47,8 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re private String timestampField = FIELD_TIMESTAMP; private String tiebreakerField = null; private String eventCategoryField = FIELD_EVENT_CATEGORY; - private String implicitJoinKeyField = FIELD_IMPLICIT_JOIN_KEY; private int size = RequestDefaults.SIZE; private int fetchSize = RequestDefaults.FETCH_SIZE; - private SearchAfterBuilder searchAfterBuilder; private String query; private boolean isCaseSensitive = false; @@ -65,10 +61,8 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re static final String KEY_TIMESTAMP_FIELD = "timestamp_field"; static final String KEY_TIEBREAKER_FIELD = "tiebreaker_field"; static final String KEY_EVENT_CATEGORY_FIELD = "event_category_field"; - static final String KEY_IMPLICIT_JOIN_KEY_FIELD = "implicit_join_key_field"; static final String KEY_SIZE = "size"; static final String KEY_FETCH_SIZE = "fetch_size"; - static final String KEY_SEARCH_AFTER = "search_after"; static final String KEY_QUERY = "query"; static final String KEY_WAIT_FOR_COMPLETION_TIMEOUT = "wait_for_completion_timeout"; static final String KEY_KEEP_ALIVE = "keep_alive"; @@ -79,10 +73,8 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re static final ParseField TIMESTAMP_FIELD = new ParseField(KEY_TIMESTAMP_FIELD); static final ParseField TIEBREAKER_FIELD = new ParseField(KEY_TIEBREAKER_FIELD); static final ParseField EVENT_CATEGORY_FIELD = new ParseField(KEY_EVENT_CATEGORY_FIELD); - static final ParseField IMPLICIT_JOIN_KEY_FIELD = new ParseField(KEY_IMPLICIT_JOIN_KEY_FIELD); static final ParseField SIZE = new ParseField(KEY_SIZE); static final ParseField FETCH_SIZE = new ParseField(KEY_FETCH_SIZE); - static final ParseField SEARCH_AFTER = new ParseField(KEY_SEARCH_AFTER); static final ParseField QUERY = new ParseField(KEY_QUERY); static final ParseField WAIT_FOR_COMPLETION_TIMEOUT = new ParseField(KEY_WAIT_FOR_COMPLETION_TIMEOUT); static final ParseField KEEP_ALIVE = new ParseField(KEY_KEEP_ALIVE); @@ -103,10 +95,8 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re timestampField = in.readString(); tiebreakerField = in.readOptionalString(); eventCategoryField = in.readString(); - implicitJoinKeyField = in.readString(); size = in.readVInt(); fetchSize = in.readVInt(); - searchAfterBuilder = in.readOptionalWriteable(SearchAfterBuilder::new); query = in.readString(); if (in.getVersion().onOrAfter(Version.V_7_9_0)) { this.waitForCompletionTimeout = in.readOptionalTimeValue(); @@ -147,10 +137,6 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re validationException = addValidationError("event category field is null or empty", validationException); } - if (implicitJoinKeyField == null || implicitJoinKeyField.isEmpty()) { - validationException = addValidationError("implicit join key field is null or empty", validationException); - } - if (size <= 0) { validationException = addValidationError("size must be greater than 0", validationException); } @@ -177,16 +163,8 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re builder.field(KEY_TIEBREAKER_FIELD, tiebreakerField()); } builder.field(KEY_EVENT_CATEGORY_FIELD, eventCategoryField()); - if (implicitJoinKeyField != null) { - builder.field(KEY_IMPLICIT_JOIN_KEY_FIELD, implicitJoinKeyField()); - } builder.field(KEY_SIZE, size()); builder.field(KEY_FETCH_SIZE, fetchSize()); - - if (searchAfterBuilder != null) { - builder.array(SEARCH_AFTER.getPreferredName(), searchAfterBuilder.getSortValues()); - } - builder.field(KEY_QUERY, query); if (waitForCompletionTimeout != null) { builder.field(KEY_WAIT_FOR_COMPLETION_TIMEOUT, waitForCompletionTimeout); @@ -211,11 +189,8 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re parser.declareString(EqlSearchRequest::timestampField, TIMESTAMP_FIELD); parser.declareString(EqlSearchRequest::tiebreakerField, TIEBREAKER_FIELD); parser.declareString(EqlSearchRequest::eventCategoryField, EVENT_CATEGORY_FIELD); - parser.declareString(EqlSearchRequest::implicitJoinKeyField, IMPLICIT_JOIN_KEY_FIELD); parser.declareInt(EqlSearchRequest::size, SIZE); parser.declareInt(EqlSearchRequest::fetchSize, FETCH_SIZE); - parser.declareField(EqlSearchRequest::setSearchAfter, SearchAfterBuilder::fromXContent, SEARCH_AFTER, - ObjectParser.ValueType.OBJECT_ARRAY); parser.declareString(EqlSearchRequest::query, QUERY); parser.declareField(EqlSearchRequest::waitForCompletionTimeout, (p, c) -> TimeValue.parseTimeValue(p.text(), KEY_WAIT_FOR_COMPLETION_TIMEOUT), WAIT_FOR_COMPLETION_TIMEOUT, @@ -261,13 +236,6 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re return this; } - public String implicitJoinKeyField() { return this.implicitJoinKeyField; } - - public EqlSearchRequest implicitJoinKeyField(String implicitJoinKeyField) { - this.implicitJoinKeyField = implicitJoinKeyField; - return this; - } - public int size() { return this.size; } @@ -286,23 +254,6 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re return this; } - public Object[] searchAfter() { - if (searchAfterBuilder == null) { - return null; - } - return searchAfterBuilder.getSortValues(); - } - - public EqlSearchRequest searchAfter(Object[] values) { - this.searchAfterBuilder = new SearchAfterBuilder().setSortValues(values); - return this; - } - - private EqlSearchRequest setSearchAfter(SearchAfterBuilder builder) { - this.searchAfterBuilder = builder; - return this; - } - public String query() { return this.query; } public EqlSearchRequest query(String query) { @@ -353,10 +304,8 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re out.writeString(timestampField); out.writeOptionalString(tiebreakerField); out.writeString(eventCategoryField); - out.writeString(implicitJoinKeyField); out.writeVInt(size); out.writeVInt(fetchSize); - out.writeOptionalWriteable(searchAfterBuilder); out.writeString(query); if (out.getVersion().onOrAfter(Version.V_7_9_0)) { out.writeOptionalTimeValue(waitForCompletionTimeout); @@ -383,8 +332,6 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re Objects.equals(timestampField, that.timestampField) && Objects.equals(tiebreakerField, that.tiebreakerField) && Objects.equals(eventCategoryField, that.eventCategoryField) && - Objects.equals(implicitJoinKeyField, that.implicitJoinKeyField) && - Objects.equals(searchAfterBuilder, that.searchAfterBuilder) && Objects.equals(query, that.query) && Objects.equals(waitForCompletionTimeout, that.waitForCompletionTimeout) && Objects.equals(keepAlive, that.keepAlive) && @@ -402,8 +349,6 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re timestampField, tiebreakerField, eventCategoryField, - implicitJoinKeyField, - searchAfterBuilder, query, waitForCompletionTimeout, keepAlive, diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequestBuilder.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequestBuilder.java index 340271bdc51..6e7d1326a39 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequestBuilder.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequestBuilder.java @@ -40,11 +40,6 @@ public class EqlSearchRequestBuilder extends ActionRequestBuilder queryParams = emptyList(); @@ -58,15 +56,6 @@ public class ParserParams { return this; } - public String implicitJoinKey() { - return implicitJoinKey; - } - - public ParserParams implicitJoinKey(String implicitJoinKey) { - this.implicitJoinKey = implicitJoinKey; - return this; - } - public int size() { return size; } diff --git a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/TransportEqlSearchAction.java b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/TransportEqlSearchAction.java index d428cbec5bd..3280652f47f 100644 --- a/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/TransportEqlSearchAction.java +++ b/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/TransportEqlSearchAction.java @@ -115,7 +115,6 @@ public class TransportEqlSearchAction extends HandledTransportAction instanceReader() { return EqlSearchRequest::new;