Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ML] Search on job tags fails if field value contains the @ character #104706

Closed
peteharverson opened this issue Jul 7, 2021 · 3 comments
Closed
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Feature:Anomaly Detection ML anomaly detection :ml v7.15.0

Comments

@peteharverson
Copy link
Contributor

A search on the anomaly detection job management page using the job_tags field inside custom_settings, as added in #102099, fails if the field value used in the search contains an @ character.

For example, a search such as job_tags:(euid:8014 or author:@randomuserid) fails to match the expected one job which contains that tag in the following search, and instead an unfiltered list is displayed:

image

Tested using a job which contains the following inside custom_settings:

    "job_tags": {
      "euid": "8015",
      "name": "many-usernames-from-a-source-ip",
      "event.category": "authentication",
      "maturity": "experimental",
      "author": "@randomuserid",
      "version": "1",
      "updated_date": "5/12/2021"
    }
@peteharverson peteharverson added bug Fixes for quality problems that affect the customer experience :ml Feature:Anomaly Detection ML anomaly detection v7.15.0 labels Jul 7, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/ml-ui (:ml)

@jgowdyelastic
Copy link
Member

This is a query parsing issue in the EuiSearchBar. Our onChange function only receives an error. This is not something we can fix in our code.
There was a problem where the parsing error was not being displayed which is fixed in #104759

@peteharverson
Copy link
Contributor Author

Closing issue as a search can be done on a value containing the @ character, if the string is enclosed within double quotes - as made possible by elastic/eui#3432.

For example, the following correctly searches for jobs containing author:@randomuserid inside job_tags:

job_tags:("author:@randomuserid")

image

Or this more complex example using an or also works as expected

job_tags:(euid:8015 or "author:@randomuserid")

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Anomaly Detection ML anomaly detection :ml v7.15.0
Projects
None yet
Development

No branches or pull requests

3 participants