[Detection Engine] Rule Data View select uses Data View name for display#214495
Merged
rylnd merged 6 commits intoelastic:mainfrom Mar 20, 2025
Merged
Conversation
This ports Yara's code from elastic#190936 to a new branch based on the latest upstream. Conflicts: x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/schema.tsx
rylnd
added
release_note:enhancement
Team:Detection Engine
Contributor
|
Pinging @elastic/security-detection-engine (Team:Detection Engine) |
rylnd
changed the title
rylnd
added
Feature:Rule Creation
9 tasks
nkhristinin
approved these changes
Mar 17, 2025
rylnd
added
backport:all-open
Contributor
Author
|
@nastasha-solomon pinging you here for review on the copy; I don't think @ARWNightingale's review is needed now, as only copy has changed. |
rylnd
requested review from
nastasha-solomon
and removed request for
ARWNightingale
| 'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.dataViewSelector.helpText', | ||
| { | ||
| defaultMessage: | ||
| 'Data views are displayed by name. To see their full definitions, visit Stack Management > Data Views.', |
Contributor
There was a problem hiding this comment.
Is there any way to link to the Data Views page in ESS and Serverless? The paths to the page are slightly different:
- ESS: Management > Stack Management > Kibana > Data Views
- Serverless: Project Settings > Management > Data > Data Views
Contributor
Author
There was a problem hiding this comment.
@nastasha-solomon given that we link to the Data Views documentation at the top of the component:
Perhaps we should just state the fact? In Discover, for example, "display by name" is the default with no explanation, and the fact of this issue/PR sort of implies that this is the de facto representation moving forward. Should we simply remove this help text entirely? We have opportunity to note the change in release notes, for any users that might be confused.
Contributor
There was a problem hiding this comment.
I think it makes sense to move closer towards a unified UX - sourcerer is also moving towards utilizing the same component as Discover.
I think the link to data view or index patterns also links to the wrong page. I think I remember there being a ticket about that.
Contributor
There was a problem hiding this comment.
Yeah, that's a good point @rylnd. If Discover changes the way it displays data view options (for example, it reverts back to displaying the definition instead of the name), we'd likely need to change the text again. I'm good with removing the help text entirely.
Contributor
There was a problem hiding this comment.
@yctercero looks like it currently links to these Kibana docs. Would you prefer that it link to this Security page instead?
Contributor
Author
There was a problem hiding this comment.
I removed the help text in 912e75a. Please approve/deny based on your agreement.
Since the default (and expected, as per this PR) behavior is to display Data Views by name, additional UI text indicating this behavior is noisy and arguably unnecessary. Instead, we will have the release not accompanying this enhancement to assuage any confused users.
nastasha-solomon
approved these changes
Mar 18, 2025
Contributor
nastasha-solomon
left a comment
nastasha-solomon
left a comment
There was a problem hiding this comment.
👍🏼 to removing the help text.
Contributor
💛 Build succeeded, but was flaky
Failed CI StepsTest Failures
Metrics [docs]Async chunks
History
cc @rylnd |
kibanamachine
added a commit
that referenced
this pull request
Mar 20, 2025
…or display (#214495) (#215351) # Backport This will backport the following commits from `main` to `8.17`: - [[Detection Engine] Rule Data View select uses Data View name for display (#214495)](#214495) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Ryland Herrick","email":"ryalnd@gmail.com"},"sourceCommit":{"committedDate":"2025-03-20T15:01:26Z","message":"[Detection Engine] Rule Data View select uses Data View name for display (#214495)\n\n## Summary\n\nSupersedes #190936, and also addresses\nhttps://github.com//issues/137823. This mainly just\nrebases the changes introduced there to the latest `main`. I also\nnoticed that it originally had some unit tests, so I resurrected those\nas well. ~~I modified the copy as well, so nota bene @ARWNightingale~~\nAfter some discussion, we determined that an explicit UI note about this\nbehavior was unnecessary.\n\n\n## Screenshots\n\n<kbd>\n<img width=\"979\" alt=\"Screenshot 2025-03-13 at 5 24 42 PM\"\nsrc=\"https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59\"\n/></kbd>\n\n<kbd><img width=\"1052\" alt=\"Screenshot 2025-03-18 at 4 37 58 PM\"\nsrc=\"https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1\"\n/></kbd>\n\n\n\n\n### Checklist\n\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: Yara Tercero <yara.tercero@elastic.co>","sha":"07acd2480aea52d22a5c5454740cd2a1fa7a70e8","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Feature:Rule Creation","backport:all-open","Team:Detection Engine","Feature:Rule Edit","v9.1.0"],"title":"[Detection Engine] Rule Data View select uses Data View name for display","number":214495,"url":"https://github.com/elastic/kibana/pull/214495","mergeCommit":{"message":"[Detection Engine] Rule Data View select uses Data View name for display (#214495)\n\n## Summary\n\nSupersedes #190936, and also addresses\nhttps://github.com//issues/137823. This mainly just\nrebases the changes introduced there to the latest `main`. I also\nnoticed that it originally had some unit tests, so I resurrected those\nas well. ~~I modified the copy as well, so nota bene @ARWNightingale~~\nAfter some discussion, we determined that an explicit UI note about this\nbehavior was unnecessary.\n\n\n## Screenshots\n\n<kbd>\n<img width=\"979\" alt=\"Screenshot 2025-03-13 at 5 24 42 PM\"\nsrc=\"https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59\"\n/></kbd>\n\n<kbd><img width=\"1052\" alt=\"Screenshot 2025-03-18 at 4 37 58 PM\"\nsrc=\"https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1\"\n/></kbd>\n\n\n\n\n### Checklist\n\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: Yara Tercero <yara.tercero@elastic.co>","sha":"07acd2480aea52d22a5c5454740cd2a1fa7a70e8"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214495","number":214495,"mergeCommit":{"message":"[Detection Engine] Rule Data View select uses Data View name for display (#214495)\n\n## Summary\n\nSupersedes #190936, and also addresses\nhttps://github.com//issues/137823. This mainly just\nrebases the changes introduced there to the latest `main`. I also\nnoticed that it originally had some unit tests, so I resurrected those\nas well. ~~I modified the copy as well, so nota bene @ARWNightingale~~\nAfter some discussion, we determined that an explicit UI note about this\nbehavior was unnecessary.\n\n\n## Screenshots\n\n<kbd>\n<img width=\"979\" alt=\"Screenshot 2025-03-13 at 5 24 42 PM\"\nsrc=\"https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59\"\n/></kbd>\n\n<kbd><img width=\"1052\" alt=\"Screenshot 2025-03-18 at 4 37 58 PM\"\nsrc=\"https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1\"\n/></kbd>\n\n\n\n\n### Checklist\n\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: Yara Tercero <yara.tercero@elastic.co>","sha":"07acd2480aea52d22a5c5454740cd2a1fa7a70e8"}}]}] BACKPORT--> Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
kibanamachine
added a commit
that referenced
this pull request
Mar 20, 2025
…r display (#214495) (#215354) # Backport This will backport the following commits from `main` to `8.x`: - [[Detection Engine] Rule Data View select uses Data View name for display (#214495)](#214495) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Ryland Herrick","email":"ryalnd@gmail.com"},"sourceCommit":{"committedDate":"2025-03-20T15:01:26Z","message":"[Detection Engine] Rule Data View select uses Data View name for display (#214495)\n\n## Summary\n\nSupersedes #190936, and also addresses\nhttps://github.com//issues/137823. This mainly just\nrebases the changes introduced there to the latest `main`. I also\nnoticed that it originally had some unit tests, so I resurrected those\nas well. ~~I modified the copy as well, so nota bene @ARWNightingale~~\nAfter some discussion, we determined that an explicit UI note about this\nbehavior was unnecessary.\n\n\n## Screenshots\n\n<kbd>\n<img width=\"979\" alt=\"Screenshot 2025-03-13 at 5 24 42 PM\"\nsrc=\"https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59\"\n/></kbd>\n\n<kbd><img width=\"1052\" alt=\"Screenshot 2025-03-18 at 4 37 58 PM\"\nsrc=\"https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1\"\n/></kbd>\n\n\n\n\n### Checklist\n\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: Yara Tercero <yara.tercero@elastic.co>","sha":"07acd2480aea52d22a5c5454740cd2a1fa7a70e8","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Feature:Rule Creation","backport:all-open","Team:Detection Engine","Feature:Rule Edit","v9.1.0"],"title":"[Detection Engine] Rule Data View select uses Data View name for display","number":214495,"url":"https://github.com/elastic/kibana/pull/214495","mergeCommit":{"message":"[Detection Engine] Rule Data View select uses Data View name for display (#214495)\n\n## Summary\n\nSupersedes #190936, and also addresses\nhttps://github.com//issues/137823. This mainly just\nrebases the changes introduced there to the latest `main`. I also\nnoticed that it originally had some unit tests, so I resurrected those\nas well. ~~I modified the copy as well, so nota bene @ARWNightingale~~\nAfter some discussion, we determined that an explicit UI note about this\nbehavior was unnecessary.\n\n\n## Screenshots\n\n<kbd>\n<img width=\"979\" alt=\"Screenshot 2025-03-13 at 5 24 42 PM\"\nsrc=\"https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59\"\n/></kbd>\n\n<kbd><img width=\"1052\" alt=\"Screenshot 2025-03-18 at 4 37 58 PM\"\nsrc=\"https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1\"\n/></kbd>\n\n\n\n\n### Checklist\n\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: Yara Tercero <yara.tercero@elastic.co>","sha":"07acd2480aea52d22a5c5454740cd2a1fa7a70e8"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/214495","number":214495,"mergeCommit":{"message":"[Detection Engine] Rule Data View select uses Data View name for display (#214495)\n\n## Summary\n\nSupersedes #190936, and also addresses\nhttps://github.com//issues/137823. This mainly just\nrebases the changes introduced there to the latest `main`. I also\nnoticed that it originally had some unit tests, so I resurrected those\nas well. ~~I modified the copy as well, so nota bene @ARWNightingale~~\nAfter some discussion, we determined that an explicit UI note about this\nbehavior was unnecessary.\n\n\n## Screenshots\n\n<kbd>\n<img width=\"979\" alt=\"Screenshot 2025-03-13 at 5 24 42 PM\"\nsrc=\"https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59\"\n/></kbd>\n\n<kbd><img width=\"1052\" alt=\"Screenshot 2025-03-18 at 4 37 58 PM\"\nsrc=\"https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1\"\n/></kbd>\n\n\n\n\n### Checklist\n\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n---------\n\nCo-authored-by: Yara Tercero <yara.tercero@elastic.co>","sha":"07acd2480aea52d22a5c5454740cd2a1fa7a70e8"}}]}] BACKPORT--> Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
clintandrewhall
pushed a commit
to clintandrewhall/kibana
that referenced
this pull request
Mar 20, 2025
…lay (elastic#214495) ## Summary Supersedes elastic#190936, and also addresses elastic#137823. This mainly just rebases the changes introduced there to the latest `main`. I also noticed that it originally had some unit tests, so I resurrected those as well. ~~I modified the copy as well, so nota bene @ARWNightingale~~ After some discussion, we determined that an explicit UI note about this behavior was unnecessary. ## Screenshots <kbd> <img width="979" alt="Screenshot 2025-03-13 at 5 24 42 PM" src="https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59" /></kbd> <kbd><img width="1052" alt="Screenshot 2025-03-18 at 4 37 58 PM" src="https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1" /></kbd> ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Yara Tercero <yara.tercero@elastic.co>
JoseLuisGJ
pushed a commit
to JoseLuisGJ/kibana
that referenced
this pull request
Mar 24, 2025
…lay (elastic#214495) ## Summary Supersedes elastic#190936, and also addresses elastic#137823. This mainly just rebases the changes introduced there to the latest `main`. I also noticed that it originally had some unit tests, so I resurrected those as well. ~~I modified the copy as well, so nota bene @ARWNightingale~~ After some discussion, we determined that an explicit UI note about this behavior was unnecessary. ## Screenshots <kbd> <img width="979" alt="Screenshot 2025-03-13 at 5 24 42 PM" src="https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59" /></kbd> <kbd><img width="1052" alt="Screenshot 2025-03-18 at 4 37 58 PM" src="https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1" /></kbd> ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Yara Tercero <yara.tercero@elastic.co>
Contributor
|
This PR didn't land on time for the latest 8.17.4 BC. Updating the labels. |
|
Related : #168909 |
cqliu1
pushed a commit
to cqliu1/kibana
that referenced
this pull request
Mar 31, 2025
…lay (elastic#214495) ## Summary Supersedes elastic#190936, and also addresses elastic#137823. This mainly just rebases the changes introduced there to the latest `main`. I also noticed that it originally had some unit tests, so I resurrected those as well. ~~I modified the copy as well, so nota bene @ARWNightingale~~ After some discussion, we determined that an explicit UI note about this behavior was unnecessary. ## Screenshots <kbd> <img width="979" alt="Screenshot 2025-03-13 at 5 24 42 PM" src="https://github.com/user-attachments/assets/69da29bf-5504-461e-b797-d016adcd4b59" /></kbd> <kbd><img width="1052" alt="Screenshot 2025-03-18 at 4 37 58 PM" src="https://github.com/user-attachments/assets/8ee5e55e-2413-4936-aa87-7dadb3d7cbb1" /></kbd> ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Yara Tercero <yara.tercero@elastic.co>
1 task
rylnd
added a commit
that referenced
this pull request
Jul 11, 2025
…eation (#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](#137823) was about the full dataview index pattern being truncated, and the [first attempt](#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 11, 2025
…eation (elastic#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](elastic#137823) was about the full dataview index pattern being truncated, and the [first attempt](elastic#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 7086158)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 11, 2025
…eation (elastic#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](elastic#137823) was about the full dataview index pattern being truncated, and the [first attempt](elastic#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 7086158)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 11, 2025
…eation (elastic#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](elastic#137823) was about the full dataview index pattern being truncated, and the [first attempt](elastic#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 7086158)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 11, 2025
…eation (elastic#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](elastic#137823) was about the full dataview index pattern being truncated, and the [first attempt](elastic#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 7086158)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 11, 2025
…eation (elastic#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](elastic#137823) was about the full dataview index pattern being truncated, and the [first attempt](elastic#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 7086158)
kibanamachine
added a commit
that referenced
this pull request
Jul 11, 2025
…ule creation (#226909) (#227557) # Backport This will backport the following commits from `main` to `9.1`: - [[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)](#226909) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Ryland Herrick","email":"ryalnd@gmail.com"},"sourceCommit":{"committedDate":"2025-07-11T01:40:55Z","message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Feature:Data Views","Feature:Rule Creation","backport:all-open","Team:Detection Engine","v9.2.0"],"title":"[Detection Engine] Display dataview pattern as tooltip during rule creation","number":226909,"url":"https://github.com/elastic/kibana/pull/226909","mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/226909","number":226909,"mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}}]}] BACKPORT--> Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
kibanamachine
added a commit
that referenced
this pull request
Jul 11, 2025
…ule creation (#226909) (#227556) # Backport This will backport the following commits from `main` to `9.0`: - [[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)](#226909) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Ryland Herrick","email":"ryalnd@gmail.com"},"sourceCommit":{"committedDate":"2025-07-11T01:40:55Z","message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Feature:Data Views","Feature:Rule Creation","backport:all-open","Team:Detection Engine","v9.2.0"],"title":"[Detection Engine] Display dataview pattern as tooltip during rule creation","number":226909,"url":"https://github.com/elastic/kibana/pull/226909","mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/226909","number":226909,"mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}}]}] BACKPORT--> Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
kibanamachine
added a commit
that referenced
this pull request
Jul 11, 2025
…rule creation (#226909) (#227553) # Backport This will backport the following commits from `main` to `8.17`: - [[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)](#226909) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Ryland Herrick","email":"ryalnd@gmail.com"},"sourceCommit":{"committedDate":"2025-07-11T01:40:55Z","message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Feature:Data Views","Feature:Rule Creation","backport:all-open","Team:Detection Engine","v9.2.0"],"title":"[Detection Engine] Display dataview pattern as tooltip during rule creation","number":226909,"url":"https://github.com/elastic/kibana/pull/226909","mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/226909","number":226909,"mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}}]}] BACKPORT--> Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
kibanamachine
added a commit
that referenced
this pull request
Jul 11, 2025
…rule creation (#226909) (#227554) # Backport This will backport the following commits from `main` to `8.18`: - [[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)](#226909) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Ryland Herrick","email":"ryalnd@gmail.com"},"sourceCommit":{"committedDate":"2025-07-11T01:40:55Z","message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Feature:Data Views","Feature:Rule Creation","backport:all-open","Team:Detection Engine","v9.2.0"],"title":"[Detection Engine] Display dataview pattern as tooltip during rule creation","number":226909,"url":"https://github.com/elastic/kibana/pull/226909","mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/226909","number":226909,"mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}}]}] BACKPORT--> Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
rylnd
added a commit
to rylnd/kibana
that referenced
this pull request
Jul 16, 2025
…eation (elastic#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](elastic#137823) was about the full dataview index pattern being truncated, and the [first attempt](elastic#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 7086158)
rylnd
added a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 16, 2025
…eation (elastic#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](elastic#137823) was about the full dataview index pattern being truncated, and the [first attempt](elastic#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 7086158)
kibanamachine
added a commit
that referenced
this pull request
Jul 16, 2025
…rule creation (#226909) (#227555) # Backport This will backport the following commits from `main` to `8.19`: - [[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)](#226909) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Ryland Herrick","email":"ryalnd@gmail.com"},"sourceCommit":{"committedDate":"2025-07-11T01:40:55Z","message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Feature:Data Views","Feature:Rule Creation","backport:all-open","Team:Detection Engine","v9.2.0"],"title":"[Detection Engine] Display dataview pattern as tooltip during rule creation","number":226909,"url":"https://github.com/elastic/kibana/pull/226909","mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/226909","number":226909,"mergeCommit":{"message":"[Detection Engine] Display dataview pattern as tooltip during rule creation (#226909)\n\n## Summary\n\nThe story behind this feature is a little circuitous: the [original\nissue](#137823) was about the\nfull dataview index pattern being truncated, and the [first\nattempt](#214495) to fix this did\nso by instead displaying the data view _name_ instead of its index\npattern. However, this meant that users were less likely to see _any_\nindex pattern associated to the dataview, rather than the full pattern.\n\nThis PR finishes the story by, in addition to preferring the data view's\n_name_ as the dropdown option, adds its full index pattern as the\n_tooltip_ for the corresponding option.\n\n## What this PR does\n* Adds the index pattern for the dataview as a tooltip on the Data View\ndropdown during rule creation\n\n## Screenshots\n\n<kbd>Before: \n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 13 34 PM\"\nsrc=\"https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64\"\n/>\n\n</kbd>\n\n<kbd>After:\n<img width=\"894\" alt=\"Screenshot 2025-07-07 at 5 14 26 PM\"\nsrc=\"https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1\"\n/>\n\n</kbd>\n\n### Checklist\n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"7086158afef2d5dfa67efdd76ba9962df1e1af95"}}]}] BACKPORT--> Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
kertal
pushed a commit
to kertal/kibana
that referenced
this pull request
Jul 25, 2025
…eation (elastic#226909) ## Summary The story behind this feature is a little circuitous: the [original issue](elastic#137823) was about the full dataview index pattern being truncated, and the [first attempt](elastic#214495) to fix this did so by instead displaying the data view _name_ instead of its index pattern. However, this meant that users were less likely to see _any_ index pattern associated to the dataview, rather than the full pattern. This PR finishes the story by, in addition to preferring the data view's _name_ as the dropdown option, adds its full index pattern as the _tooltip_ for the corresponding option. ## What this PR does * Adds the index pattern for the dataview as a tooltip on the Data View dropdown during rule creation ## Screenshots <kbd>Before: <img width="894" alt="Screenshot 2025-07-07 at 5 13 34 PM" src="https://github.com/user-attachments/assets/1079f8c0-148f-4b1f-9469-ab17fc408d64" /> </kbd> <kbd>After: <img width="894" alt="Screenshot 2025-07-07 at 5 14 26 PM" src="https://github.com/user-attachments/assets/335e54f9-9c6b-4833-8d1d-a254329ab7c1" /> </kbd> ### Checklist - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supersedes #190936, and also addresses #137823. This mainly just rebases the changes introduced there to the latest
main. I also noticed that it originally had some unit tests, so I resurrected those as well.I modified the copy as well, so nota bene @ARWNightingaleAfter some discussion, we determined that an explicit UI note about this behavior was unnecessary.Screenshots
Checklist