[Security Solution] Fix initial data view flash#225675
Merged
lgestc merged 40 commits intoelastic:mainfrom Jul 2, 2025
Merged
Conversation
lgestc
added
backport:version
Contributor
|
Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations) |
...solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts
Show resolved
Hide resolved
kibanamachine
added a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 2, 2025
## Summary Solves the initial UI "flash" when new data view picker is enabled and the application is starting. Compared to previous approach, we are not doing default data view provider and just check the loading state before telling the user no indices are matched. ## Testing Head to timelines page or explore pages... should not see the data flash with this feature flag on. Brief blank page could occur, as the proper loading screens would be required. ``` xpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled'] ``` ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 209c298)
Contributor
💔 Some backports could not be created
Note: Successful backport PRs will be merged automatically after passing CI. Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation |
lgestc
added a commit
to lgestc/kibana
that referenced
this pull request
Jul 2, 2025
## Summary Solves the initial UI "flash" when new data view picker is enabled and the application is starting. Compared to previous approach, we are not doing default data view provider and just check the loading state before telling the user no indices are matched. ## Testing Head to timelines page or explore pages... should not see the data flash with this feature flag on. Brief blank page could occur, as the proper loading screens would be required. ``` xpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled'] ``` ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 209c298) # Conflicts: # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/pages/entity_analytics_dashboard.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/pages/entity_analytics_privileged_user_monitoring_page.tsx # x-pack/solutions/security/plugins/security_solution/public/explore/network/pages/network.tsx
Contributor
Author
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
lgestc
added a commit
that referenced
this pull request
Jul 2, 2025
…6230) # Backport This will backport the following commits from `main` to `8.19`: - [[Security Solution] Fix initial data view flash (#225675)](#225675) <!--- Backport version: 10.0.1 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Luke Gmys","email":"11671118+lgestc@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-07-02T13:23:53Z","message":"[Security Solution] Fix initial data view flash (#225675)\n\n## Summary\n\nSolves the initial UI \"flash\" when new data view picker is enabled and\nthe application is starting.\n\nCompared to previous approach, we are not doing default data view\nprovider and just check the loading state before telling the user no\nindices are matched.\n\n## Testing\nHead to timelines page or explore pages... should not see the data flash\nwith this feature flag on.\nBrief blank page could occur, as the proper loading screens would be\nrequired.\n\n```\nxpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled']\n```\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"209c2988b5fa3b62addfdca081114956af77fcb5","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Threat Hunting:Investigations","backport:version","v9.1.0","v8.19.0","v9.2.0"],"title":"[Security Solution] Fix initial data view flash","number":225675,"url":"https://github.com/elastic/kibana/pull/225675","mergeCommit":{"message":"[Security Solution] Fix initial data view flash (#225675)\n\n## Summary\n\nSolves the initial UI \"flash\" when new data view picker is enabled and\nthe application is starting.\n\nCompared to previous approach, we are not doing default data view\nprovider and just check the loading state before telling the user no\nindices are matched.\n\n## Testing\nHead to timelines page or explore pages... should not see the data flash\nwith this feature flag on.\nBrief blank page could occur, as the proper loading screens would be\nrequired.\n\n```\nxpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled']\n```\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"209c2988b5fa3b62addfdca081114956af77fcb5"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/226207","number":226207,"state":"OPEN"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/225675","number":225675,"mergeCommit":{"message":"[Security Solution] Fix initial data view flash (#225675)\n\n## Summary\n\nSolves the initial UI \"flash\" when new data view picker is enabled and\nthe application is starting.\n\nCompared to previous approach, we are not doing default data view\nprovider and just check the loading state before telling the user no\nindices are matched.\n\n## Testing\nHead to timelines page or explore pages... should not see the data flash\nwith this feature flag on.\nBrief blank page could occur, as the proper loading screens would be\nrequired.\n\n```\nxpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled']\n```\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"209c2988b5fa3b62addfdca081114956af77fcb5"}}]}] BACKPORT-->
kibanamachine
added
the
backport missing
Contributor
|
Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync. |
2 similar comments
Contributor
|
Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync. |
Contributor
|
Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync. |
This was referenced Jul 8, 2025
Contributor
|
Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync. |
3 similar comments
Contributor
|
Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync. |
Contributor
|
Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync. |
Contributor
|
Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync. |
2 tasks
kibanamachine
added a commit
that referenced
this pull request
Jul 15, 2025
) # Backport This will backport the following commits from `main` to `9.1`: - [[Security Solution] Fix initial data view flash (#225675)](#225675) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Luke Gmys","email":"11671118+lgestc@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-07-02T13:23:53Z","message":"[Security Solution] Fix initial data view flash (#225675)\n\n## Summary\n\nSolves the initial UI \"flash\" when new data view picker is enabled and\nthe application is starting.\n\nCompared to previous approach, we are not doing default data view\nprovider and just check the loading state before telling the user no\nindices are matched.\n\n## Testing\nHead to timelines page or explore pages... should not see the data flash\nwith this feature flag on.\nBrief blank page could occur, as the proper loading screens would be\nrequired.\n\n```\nxpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled']\n```\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"209c2988b5fa3b62addfdca081114956af77fcb5","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Threat Hunting:Investigations","backport:version","v9.1.0","v8.19.0","v9.2.0"],"title":"[Security Solution] Fix initial data view flash","number":225675,"url":"https://github.com/elastic/kibana/pull/225675","mergeCommit":{"message":"[Security Solution] Fix initial data view flash (#225675)\n\n## Summary\n\nSolves the initial UI \"flash\" when new data view picker is enabled and\nthe application is starting.\n\nCompared to previous approach, we are not doing default data view\nprovider and just check the loading state before telling the user no\nindices are matched.\n\n## Testing\nHead to timelines page or explore pages... should not see the data flash\nwith this feature flag on.\nBrief blank page could occur, as the proper loading screens would be\nrequired.\n\n```\nxpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled']\n```\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"209c2988b5fa3b62addfdca081114956af77fcb5"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/225675","number":225675,"mergeCommit":{"message":"[Security Solution] Fix initial data view flash (#225675)\n\n## Summary\n\nSolves the initial UI \"flash\" when new data view picker is enabled and\nthe application is starting.\n\nCompared to previous approach, we are not doing default data view\nprovider and just check the loading state before telling the user no\nindices are matched.\n\n## Testing\nHead to timelines page or explore pages... should not see the data flash\nwith this feature flag on.\nBrief blank page could occur, as the proper loading screens would be\nrequired.\n\n```\nxpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled']\n```\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"209c2988b5fa3b62addfdca081114956af77fcb5"}}]}] BACKPORT--> Co-authored-by: Luke Gmys <11671118+lgestc@users.noreply.github.com>
kibanamachine
removed
the
backport missing
kertal
pushed a commit
to kertal/kibana
that referenced
this pull request
Jul 25, 2025
## Summary Solves the initial UI "flash" when new data view picker is enabled and the application is starting. Compared to previous approach, we are not doing default data view provider and just check the loading state before telling the user no indices are matched. ## Testing Head to timelines page or explore pages... should not see the data flash with this feature flag on. Brief blank page could occur, as the proper loading screens would be required. ``` xpack.securitySolution.enableExperimental: ['newDataViewPickerEnabled'] ``` ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
1 task
michaelolo24
added a commit
that referenced
this pull request
Sep 16, 2025
## Summary This PR fixes an issue with the alert page filtering when the below config is enabled: <img width="627" height="181" alt="image" src="https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535" /> When enabled, the config looks to make sure that searches are only done against index patterns that are mapped to the given dataView. When introducing the code to migrate to our new dataView picker [here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231) in the following PR #225726, a check was done to only apply the new DataView when it was provided. To fix a separate issue regarding flashing of the alerts page, this following [initial dataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45) was introduced with this pr: #225675 In short, the dataView object was always defined, even if it was just an initial dataView leading to the fields being queried against not being mapped. The necessary checks are added in this PR ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Sep 16, 2025
## Summary This PR fixes an issue with the alert page filtering when the below config is enabled: <img width="627" height="181" alt="image" src="https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535" /> When enabled, the config looks to make sure that searches are only done against index patterns that are mapped to the given dataView. When introducing the code to migrate to our new dataView picker [here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231) in the following PR elastic#225726, a check was done to only apply the new DataView when it was provided. To fix a separate issue regarding flashing of the alerts page, this following [initial dataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45) was introduced with this pr: elastic#225675 In short, the dataView object was always defined, even if it was just an initial dataView leading to the fields being queried against not being mapped. The necessary checks are added in this PR ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 128528c)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Sep 16, 2025
## Summary This PR fixes an issue with the alert page filtering when the below config is enabled: <img width="627" height="181" alt="image" src="https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535" /> When enabled, the config looks to make sure that searches are only done against index patterns that are mapped to the given dataView. When introducing the code to migrate to our new dataView picker [here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231) in the following PR elastic#225726, a check was done to only apply the new DataView when it was provided. To fix a separate issue regarding flashing of the alerts page, this following [initial dataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45) was introduced with this pr: elastic#225675 In short, the dataView object was always defined, even if it was just an initial dataView leading to the fields being queried against not being mapped. The necessary checks are added in this PR ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 128528c)
kibanamachine
added a commit
that referenced
this pull request
Sep 16, 2025
…35214) # Backport This will backport the following commits from `main` to `8.19`: - [[Investigations][Bug] - Check for empty dataView (#235144)](#235144) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Michael Olorunnisola","email":"michael.olorunnisola@elastic.co"},"sourceCommit":{"committedDate":"2025-09-16T14:09:44Z","message":"[Investigations][Bug] - Check for empty dataView (#235144)\n\n## Summary\n\nThis PR fixes an issue with the alert page filtering when the below\nconfig is enabled:\n\n<img width=\"627\" height=\"181\" alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535\"\n/>\n\nWhen enabled, the config looks to make sure that searches are only done\nagainst index patterns that are mapped to the given dataView. When\nintroducing the code to migrate to our new dataView picker\n[here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231)\nin the following PR #225726, a\ncheck was done to only apply the new DataView when it was provided. To\nfix a separate issue regarding flashing of the alerts page, this\nfollowing [initial\ndataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45)\nwas introduced with this pr:\nhttps://github.com//pull/225675\n\nIn short, the dataView object was always defined, even if it was just an\ninitial dataView leading to the fields being queried against not being\nmapped.\n\nThe necessary checks are added in this PR\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"128528cbfe123c5f0234824e5834755cab58b0c4","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","Team:Threat Hunting:Investigations","backport:version","v9.2.0","v9.1.4","v8.19.4","v8.19.5","v9.1.5"],"title":"[Investigations][Bug] - Check for empty dataView","number":235144,"url":"https://github.com/elastic/kibana/pull/235144","mergeCommit":{"message":"[Investigations][Bug] - Check for empty dataView (#235144)\n\n## Summary\n\nThis PR fixes an issue with the alert page filtering when the below\nconfig is enabled:\n\n<img width=\"627\" height=\"181\" alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535\"\n/>\n\nWhen enabled, the config looks to make sure that searches are only done\nagainst index patterns that are mapped to the given dataView. When\nintroducing the code to migrate to our new dataView picker\n[here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231)\nin the following PR #225726, a\ncheck was done to only apply the new DataView when it was provided. To\nfix a separate issue regarding flashing of the alerts page, this\nfollowing [initial\ndataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45)\nwas introduced with this pr:\nhttps://github.com//pull/225675\n\nIn short, the dataView object was always defined, even if it was just an\ninitial dataView leading to the fields being queried against not being\nmapped.\n\nThe necessary checks are added in this PR\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"128528cbfe123c5f0234824e5834755cab58b0c4"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/235144","number":235144,"mergeCommit":{"message":"[Investigations][Bug] - Check for empty dataView (#235144)\n\n## Summary\n\nThis PR fixes an issue with the alert page filtering when the below\nconfig is enabled:\n\n<img width=\"627\" height=\"181\" alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535\"\n/>\n\nWhen enabled, the config looks to make sure that searches are only done\nagainst index patterns that are mapped to the given dataView. When\nintroducing the code to migrate to our new dataView picker\n[here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231)\nin the following PR #225726, a\ncheck was done to only apply the new DataView when it was provided. To\nfix a separate issue regarding flashing of the alerts page, this\nfollowing [initial\ndataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45)\nwas introduced with this pr:\nhttps://github.com//pull/225675\n\nIn short, the dataView object was always defined, even if it was just an\ninitial dataView leading to the fields being queried against not being\nmapped.\n\nThe necessary checks are added in this PR\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"128528cbfe123c5f0234824e5834755cab58b0c4"}},{"branch":"9.1","label":"v9.1.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co>
kibanamachine
added a commit
that referenced
this pull request
Sep 16, 2025
…5215) # Backport This will backport the following commits from `main` to `9.1`: - [[Investigations][Bug] - Check for empty dataView (#235144)](#235144) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Michael Olorunnisola","email":"michael.olorunnisola@elastic.co"},"sourceCommit":{"committedDate":"2025-09-16T14:09:44Z","message":"[Investigations][Bug] - Check for empty dataView (#235144)\n\n## Summary\n\nThis PR fixes an issue with the alert page filtering when the below\nconfig is enabled:\n\n<img width=\"627\" height=\"181\" alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535\"\n/>\n\nWhen enabled, the config looks to make sure that searches are only done\nagainst index patterns that are mapped to the given dataView. When\nintroducing the code to migrate to our new dataView picker\n[here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231)\nin the following PR #225726, a\ncheck was done to only apply the new DataView when it was provided. To\nfix a separate issue regarding flashing of the alerts page, this\nfollowing [initial\ndataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45)\nwas introduced with this pr:\nhttps://github.com//pull/225675\n\nIn short, the dataView object was always defined, even if it was just an\ninitial dataView leading to the fields being queried against not being\nmapped.\n\nThe necessary checks are added in this PR\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"128528cbfe123c5f0234824e5834755cab58b0c4","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","Team:Threat Hunting:Investigations","backport:version","v9.2.0","v9.1.4","v8.19.4","v8.19.5","v9.1.5"],"title":"[Investigations][Bug] - Check for empty dataView","number":235144,"url":"https://github.com/elastic/kibana/pull/235144","mergeCommit":{"message":"[Investigations][Bug] - Check for empty dataView (#235144)\n\n## Summary\n\nThis PR fixes an issue with the alert page filtering when the below\nconfig is enabled:\n\n<img width=\"627\" height=\"181\" alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535\"\n/>\n\nWhen enabled, the config looks to make sure that searches are only done\nagainst index patterns that are mapped to the given dataView. When\nintroducing the code to migrate to our new dataView picker\n[here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231)\nin the following PR #225726, a\ncheck was done to only apply the new DataView when it was provided. To\nfix a separate issue regarding flashing of the alerts page, this\nfollowing [initial\ndataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45)\nwas introduced with this pr:\nhttps://github.com//pull/225675\n\nIn short, the dataView object was always defined, even if it was just an\ninitial dataView leading to the fields being queried against not being\nmapped.\n\nThe necessary checks are added in this PR\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"128528cbfe123c5f0234824e5834755cab58b0c4"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/235144","number":235144,"mergeCommit":{"message":"[Investigations][Bug] - Check for empty dataView (#235144)\n\n## Summary\n\nThis PR fixes an issue with the alert page filtering when the below\nconfig is enabled:\n\n<img width=\"627\" height=\"181\" alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535\"\n/>\n\nWhen enabled, the config looks to make sure that searches are only done\nagainst index patterns that are mapped to the given dataView. When\nintroducing the code to migrate to our new dataView picker\n[here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231)\nin the following PR #225726, a\ncheck was done to only apply the new DataView when it was provided. To\nfix a separate issue regarding flashing of the alerts page, this\nfollowing [initial\ndataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45)\nwas introduced with this pr:\nhttps://github.com//pull/225675\n\nIn short, the dataView object was always defined, even if it was just an\ninitial dataView leading to the fields being queried against not being\nmapped.\n\nThe necessary checks are added in this PR\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios","sha":"128528cbfe123c5f0234824e5834755cab58b0c4"}},{"branch":"9.1","label":"v9.1.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co>
CAWilson94
pushed a commit
to CAWilson94/kibana
that referenced
this pull request
Sep 24, 2025
## Summary This PR fixes an issue with the alert page filtering when the below config is enabled: <img width="627" height="181" alt="image" src="https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535" /> When enabled, the config looks to make sure that searches are only done against index patterns that are mapped to the given dataView. When introducing the code to migrate to our new dataView picker [here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231) in the following PR elastic#225726, a check was done to only apply the new DataView when it was provided. To fix a separate issue regarding flashing of the alerts page, this following [initial dataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45) was introduced with this pr: elastic#225675 In short, the dataView object was always defined, even if it was just an initial dataView leading to the fields being queried against not being mapped. The necessary checks are added in this PR ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
niros1
pushed a commit
that referenced
this pull request
Sep 30, 2025
## Summary This PR fixes an issue with the alert page filtering when the below config is enabled: <img width="627" height="181" alt="image" src="https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535" /> When enabled, the config looks to make sure that searches are only done against index patterns that are mapped to the given dataView. When introducing the code to migrate to our new dataView picker [here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231) in the following PR #225726, a check was done to only apply the new DataView when it was provided. To fix a separate issue regarding flashing of the alerts page, this following [initial dataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45) was introduced with this pr: #225675 In short, the dataView object was always defined, even if it was just an initial dataView leading to the fields being queried against not being mapped. The necessary checks are added in this PR ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
rylnd
pushed a commit
to rylnd/kibana
that referenced
this pull request
Oct 17, 2025
## Summary This PR fixes an issue with the alert page filtering when the below config is enabled: <img width="627" height="181" alt="image" src="https://github.com/user-attachments/assets/39fc9a61-d794-407d-bea9-16792c9a6535" /> When enabled, the config looks to make sure that searches are only done against index patterns that are mapped to the given dataView. When introducing the code to migrate to our new dataView picker [here](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/common/lib/kuery/index.ts#L231) in the following PR elastic#225726, a check was done to only apply the new DataView when it was provided. To fix a separate issue regarding flashing of the alerts page, this following [initial dataView](https://github.com/elastic/kibana/blob/9659a525327b2e46478f45d03ce39103848361cc/x-pack/solutions/security/plugins/security_solution/public/data_view_manager/hooks/use_data_view.ts#L45) was introduced with this pr: elastic#225675 In short, the dataView object was always defined, even if it was just an initial dataView leading to the fields being queried against not being mapped. The necessary checks are added in this PR ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Solves the initial UI "flash" when new data view picker is enabled and the application is starting.
Compared to previous approach, we are not doing default data view provider and just check the loading state before telling the user no indices are matched.
Testing
Head to timelines page or explore pages... should not see the data flash with this feature flag on.
Brief blank page could occur, as the proper loading screens would be required.
Checklist
Check the PR satisfies following conditions.
Reviewers should verify this PR satisfies this list as well.