[Security solution][Alerts] Fix custom field grouping #229956
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
NicholasPeretti
added
bug
Contributor
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
Contributor
|
Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations) |
Contributor
💛 Build succeeded, but was flaky
Failed CI StepsTest Failures
Metrics [docs]Async chunks
|
PhilippeOberti
approved these changes
Jul 31, 2025
Contributor
PhilippeOberti
left a comment
PhilippeOberti
left a comment
There was a problem hiding this comment.
I love those types of fixes, thanks!
PhilippeOberti
added
backport:version
Contributor
|
Starting backport for target branches: 8.19, 9.1 https://github.com/elastic/kibana/actions/runs/16649133924 |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 31, 2025
## Summary Fixes elastic#229844 ### 🛑 The problem As shown in elastic#229844, the "custom field" grouping option was not properly working for users. Here's a video of the bug: https://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc ### 💡 The solution As @christineweng suggested in the mentioned issue, the problem occurred because the code was not checking if the new data view was actually enabled via feature flag before using it. All we had to do was to add the feature flag check and everything is back to normal now. Here's a video of the UI after the fix: https://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c (cherry picked from commit 22890e6)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 31, 2025
## Summary Fixes elastic#229844 ### 🛑 The problem As shown in elastic#229844, the "custom field" grouping option was not properly working for users. Here's a video of the bug: https://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc ### 💡 The solution As @christineweng suggested in the mentioned issue, the problem occurred because the code was not checking if the new data view was actually enabled via feature flag before using it. All we had to do was to add the feature flag check and everything is back to normal now. Here's a video of the UI after the fix: https://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c (cherry picked from commit 22890e6)
Contributor
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
kibanamachine
added a commit
that referenced
this pull request
Jul 31, 2025
#230070) # Backport This will backport the following commits from `main` to `8.19`: - [[Security solution][Alerts] Fix custom field grouping (#229956)](#229956) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Nicholas Peretti","email":"nicholas.peretti@elastic.co"},"sourceCommit":{"committedDate":"2025-07-31T12:35:23Z","message":"[Security solution][Alerts] Fix custom field grouping (#229956)\n\n## Summary\n\nFixes #229844\n\n### 🛑 The problem\n\nAs shown in #229844, the \"custom field\" grouping option was not properly\nworking for users. Here's a video of the bug:\n\n\nhttps://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc\n\n### 💡 The solution\n\nAs @christineweng suggested in the mentioned issue, the problem occurred\nbecause the code was not checking if the new data view was actually\nenabled via feature flag before using it.\n\nAll we had to do was to add the feature flag check and everything is\nback to normal now. Here's a video of the UI after the fix:\n\n\n\nhttps://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c","sha":"22890e612f295301bd3808121b58031db36c21e6","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","Team: SecuritySolution","Team:Threat Hunting:Investigations","backport:version","v9.2.0","v9.1.1","v8.19.1"],"title":"[Security solution][Alerts] Fix custom field grouping","number":229956,"url":"https://github.com/elastic/kibana/pull/229956","mergeCommit":{"message":"[Security solution][Alerts] Fix custom field grouping (#229956)\n\n## Summary\n\nFixes #229844\n\n### 🛑 The problem\n\nAs shown in #229844, the \"custom field\" grouping option was not properly\nworking for users. Here's a video of the bug:\n\n\nhttps://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc\n\n### 💡 The solution\n\nAs @christineweng suggested in the mentioned issue, the problem occurred\nbecause the code was not checking if the new data view was actually\nenabled via feature flag before using it.\n\nAll we had to do was to add the feature flag check and everything is\nback to normal now. Here's a video of the UI after the fix:\n\n\n\nhttps://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c","sha":"22890e612f295301bd3808121b58031db36c21e6"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/229956","number":229956,"mergeCommit":{"message":"[Security solution][Alerts] Fix custom field grouping (#229956)\n\n## Summary\n\nFixes #229844\n\n### 🛑 The problem\n\nAs shown in #229844, the \"custom field\" grouping option was not properly\nworking for users. Here's a video of the bug:\n\n\nhttps://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc\n\n### 💡 The solution\n\nAs @christineweng suggested in the mentioned issue, the problem occurred\nbecause the code was not checking if the new data view was actually\nenabled via feature flag before using it.\n\nAll we had to do was to add the feature flag check and everything is\nback to normal now. Here's a video of the UI after the fix:\n\n\n\nhttps://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c","sha":"22890e612f295301bd3808121b58031db36c21e6"}},{"branch":"9.1","label":"v9.1.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Nicholas Peretti <nicholas.peretti@elastic.co>
kibanamachine
added a commit
that referenced
this pull request
Jul 31, 2025
…#230072) # Backport This will backport the following commits from `main` to `9.1`: - [[Security solution][Alerts] Fix custom field grouping (#229956)](#229956) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Nicholas Peretti","email":"nicholas.peretti@elastic.co"},"sourceCommit":{"committedDate":"2025-07-31T12:35:23Z","message":"[Security solution][Alerts] Fix custom field grouping (#229956)\n\n## Summary\n\nFixes #229844\n\n### 🛑 The problem\n\nAs shown in #229844, the \"custom field\" grouping option was not properly\nworking for users. Here's a video of the bug:\n\n\nhttps://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc\n\n### 💡 The solution\n\nAs @christineweng suggested in the mentioned issue, the problem occurred\nbecause the code was not checking if the new data view was actually\nenabled via feature flag before using it.\n\nAll we had to do was to add the feature flag check and everything is\nback to normal now. Here's a video of the UI after the fix:\n\n\n\nhttps://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c","sha":"22890e612f295301bd3808121b58031db36c21e6","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","Team: SecuritySolution","Team:Threat Hunting:Investigations","backport:version","v9.2.0","v9.1.1","v8.19.1"],"title":"[Security solution][Alerts] Fix custom field grouping","number":229956,"url":"https://github.com/elastic/kibana/pull/229956","mergeCommit":{"message":"[Security solution][Alerts] Fix custom field grouping (#229956)\n\n## Summary\n\nFixes #229844\n\n### 🛑 The problem\n\nAs shown in #229844, the \"custom field\" grouping option was not properly\nworking for users. Here's a video of the bug:\n\n\nhttps://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc\n\n### 💡 The solution\n\nAs @christineweng suggested in the mentioned issue, the problem occurred\nbecause the code was not checking if the new data view was actually\nenabled via feature flag before using it.\n\nAll we had to do was to add the feature flag check and everything is\nback to normal now. Here's a video of the UI after the fix:\n\n\n\nhttps://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c","sha":"22890e612f295301bd3808121b58031db36c21e6"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/229956","number":229956,"mergeCommit":{"message":"[Security solution][Alerts] Fix custom field grouping (#229956)\n\n## Summary\n\nFixes #229844\n\n### 🛑 The problem\n\nAs shown in #229844, the \"custom field\" grouping option was not properly\nworking for users. Here's a video of the bug:\n\n\nhttps://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc\n\n### 💡 The solution\n\nAs @christineweng suggested in the mentioned issue, the problem occurred\nbecause the code was not checking if the new data view was actually\nenabled via feature flag before using it.\n\nAll we had to do was to add the feature flag check and everything is\nback to normal now. Here's a video of the UI after the fix:\n\n\n\nhttps://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c","sha":"22890e612f295301bd3808121b58031db36c21e6"}},{"branch":"9.1","label":"v9.1.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Nicholas Peretti <nicholas.peretti@elastic.co>
delanni
pushed a commit
to delanni/kibana
that referenced
this pull request
Aug 5, 2025
## Summary Fixes elastic#229844 ### 🛑 The problem As shown in elastic#229844, the "custom field" grouping option was not properly working for users. Here's a video of the bug: https://github.com/user-attachments/assets/93da6835-8fba-4c1e-adcf-06c05080b5dc ### 💡 The solution As @christineweng suggested in the mentioned issue, the problem occurred because the code was not checking if the new data view was actually enabled via feature flag before using it. All we had to do was to add the feature flag check and everything is back to normal now. Here's a video of the UI after the fix: https://github.com/user-attachments/assets/14453957-0c00-430e-b572-cb2666ab774c
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #229844
🛑 The problem
As shown in #229844, the "custom field" grouping option was not properly working for users. Here's a video of the bug:
Screen.Recording.2025-07-29.at.16.44.42.mov
💡 The solution
As @christineweng suggested in the mentioned issue, the problem occurred because the code was not checking if the new data view was actually enabled via feature flag before using it.
All we had to do was to add the feature flag check and everything is back to normal now. Here's a video of the UI after the fix:
Screen.Recording.2025-07-30.at.13.39.50.mov