From 5fb6fdc19a4a5ac553aa8bb4047ef4648f08b29a Mon Sep 17 00:00:00 2001
From: Jonathan Buttner <56361221+jonathan-buttner@users.noreply.github.com>
Date: Tue, 21 Jul 2020 10:56:06 -0400
Subject: [PATCH] Only check that the event ids are the same in arrays (#72624)

---
 x-pack/test/api_integration/apis/endpoint/resolver.ts | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/x-pack/test/api_integration/apis/endpoint/resolver.ts b/x-pack/test/api_integration/apis/endpoint/resolver.ts
index c8217f2b6872a3..fa980aed30502c 100644
--- a/x-pack/test/api_integration/apis/endpoint/resolver.ts
+++ b/x-pack/test/api_integration/apis/endpoint/resolver.ts
@@ -17,7 +17,10 @@ import {
   ResolverNodeStats,
   ResolverRelatedAlerts,
 } from '../../../../plugins/security_solution/common/endpoint/types';
-import { parentEntityId } from '../../../../plugins/security_solution/common/endpoint/models/event';
+import {
+  parentEntityId,
+  eventId,
+} from '../../../../plugins/security_solution/common/endpoint/models/event';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import {
   Event,
@@ -167,10 +170,14 @@ const compareArrays = (
   if (lengthCheck) {
     expect(expected.length).to.eql(toTest.length);
   }
+
   toTest.forEach((toTestEvent) => {
     expect(
       expected.find((arrEvent) => {
-        return JSON.stringify(arrEvent) === JSON.stringify(toTestEvent);
+        // we're only checking that the event ids are the same here. The reason we can't check the entire document
+        // is because ingest pipelines are used to add fields to the document when it is received by elasticsearch,
+        // therefore it will not be the same as the document created by the generator
+        return eventId(toTestEvent) === eventId(arrEvent);
       })
     ).to.be.ok();
   });