[Observability] Fix KQL autocomplete in custom threshold rule creation

src/platform/packages/shared/response-ops/rule_form/moon.yml

@@ -49,6 +49,7 @@ dependsOn:
   - '@kbn/actions-plugin'
   - '@kbn/react-hooks'
   - '@kbn/response-ops-rules-apis'
+  - '@kbn/kql'
 tags:
   - shared-browser
   - package

src/platform/packages/shared/response-ops/rule_form/src/rule_form.tsx

@@ -86,6 +86,7 @@ export const RuleForm = <MetaData extends RuleTypeMetaData = RuleTypeMetaData>(
     dataViews,
     unifiedSearch,
     docLinks,
+    kql,
     ruleTypeRegistry,
     actionTypeRegistry,
     fieldsMetadata,
@@ -107,6 +108,7 @@ export const RuleForm = <MetaData extends RuleTypeMetaData = RuleTypeMetaData>(
       dataViews,
       unifiedSearch,
       docLinks,
+      kql,
       ruleTypeRegistry,
       actionTypeRegistry,
       fieldsMetadata,
@@ -189,6 +191,7 @@ export const RuleForm = <MetaData extends RuleTypeMetaData = RuleTypeMetaData>(
     fieldsMetadata,
     contentManagement,
     uiActions,
+    kql,
     onChangeMetaData,
     id,
     ruleTypeId,

src/platform/packages/shared/response-ops/rule_form/src/types.ts

@@ -26,6 +26,7 @@ import type { ActionConnector, ActionTypeRegistryContract } from '@kbn/alerts-ui
 import type { FieldsMetadataPublicStart } from '@kbn/fields-metadata-plugin/public';
 import type { ContentManagementPublicStart } from '@kbn/content-management-plugin/public';
 import type { UiActionsStart } from '@kbn/ui-actions-plugin/public';
+import type { KqlPluginStart } from '@kbn/kql/public';
 import type {
   MinimumScheduleInterval,
   Rule,
@@ -70,6 +71,7 @@ export interface RuleFormPlugins {
   dataViews: DataViewsPublicPluginStart;
   unifiedSearch: UnifiedSearchPublicPluginStart;
   docLinks: DocLinksStart;
+  kql?: KqlPluginStart;
   ruleTypeRegistry: RuleTypeRegistryContract;
   actionTypeRegistry: ActionTypeRegistryContract;
   fieldsMetadata: FieldsMetadataPublicStart;

src/platform/packages/shared/response-ops/rule_form/tsconfig.json

@@ -38,5 +38,6 @@
     "@kbn/actions-plugin",
     "@kbn/react-hooks",
     "@kbn/response-ops-rules-apis",
+    "@kbn/kql",
   ]
 }

x-pack/platform/plugins/shared/triggers_actions_ui/kibana.jsonc

@@ -16,6 +16,7 @@
       "kibanaReact",
       "kibanaUtils",
       "unifiedSearch",
+      "kql",
       "fieldFormats",
       "dataViews",
       "dataViewEditor",

x-pack/platform/plugins/shared/triggers_actions_ui/public/application/rules_app.tsx

@@ -43,6 +43,7 @@ import type { FieldsMetadataPublicStart } from '@kbn/fields-metadata-plugin/publ
 import type { SharePluginStart } from '@kbn/share-plugin/public';
 import type { ContentManagementPublicStart } from '@kbn/content-management-plugin/public';
 import type { UiActionsStart } from '@kbn/ui-actions-plugin/public';
+import type { KqlPluginStart } from '@kbn/kql/public';
 import { suspendedComponentWithProps } from './lib/suspended_component_with_props';
 import type { ActionTypeRegistryContract, RuleTypeRegistryContract } from '../types';
 import type { Section } from './constants';
@@ -78,6 +79,7 @@ export interface TriggersAndActionsUiServices extends CoreStart {
   kibanaFeatures: KibanaFeature[];
   element: HTMLElement;
   i18n: I18nStart;
+  kql: KqlPluginStart;
   theme: ThemeServiceStart;
   unifiedSearch: UnifiedSearchPublicPluginStart;
   licensing: LicensingPluginStart;

x-pack/platform/plugins/shared/triggers_actions_ui/public/common/lib/kibana/kibana_react.mock.ts

@@ -21,6 +21,7 @@ import type { DataViewEditorStart } from '@kbn/data-view-editor-plugin/public';
 import { expressionsPluginMock } from '@kbn/expressions-plugin/public/mocks';
 import { fieldsMetadataPluginPublicMock } from '@kbn/fields-metadata-plugin/public/mocks';
 import { uiActionsPluginMock } from '@kbn/ui-actions-plugin/public/mocks';
+import { kqlPluginMock } from '@kbn/kql/public/mocks';
 
 export const createStartServicesMock = (): TriggersAndActionsUiServices => {
   const core = coreMock.createStart();
@@ -68,6 +69,7 @@ export const createStartServicesMock = (): TriggersAndActionsUiServices => {
     expressions: expressionsPluginMock.createStartContract(),
     isServerless: false,
     fieldFormats: fieldFormatsServiceMock.createStartContract(),
+    kql: kqlPluginMock.createStartContract(),
     lens: lensPluginMock.createStartContract(),
     fieldsMetadata: fieldsMetadataPluginPublicMock.createStartContract(),
   } as TriggersAndActionsUiServices;

x-pack/platform/plugins/shared/triggers_actions_ui/public/plugin.ts

@@ -44,6 +44,7 @@ import type { UiActionsStart } from '@kbn/ui-actions-plugin/public';
 import { ALERT_RULE_TRIGGER } from '@kbn/ui-actions-browser/src/triggers';
 import { CONTEXT_MENU_TRIGGER } from '@kbn/embeddable-plugin/public';
 import type { SharePluginStart } from '@kbn/share-plugin/public';
+import type { KqlPluginStart } from '@kbn/kql/public';
 import type { Rule, RuleUiAction } from './types';
 import type { AlertsSearchBarProps } from './application/sections/alerts_search_bar';
 
@@ -175,6 +176,7 @@ interface PluginsStart {
   licensing: LicensingPluginStart;
   serverless?: ServerlessPluginStart;
   fieldFormats: FieldFormatsRegistry;
+  kql: KqlPluginStart;
   lens: LensPublicStart;
   fieldsMetadata: FieldsMetadataPublicStart;
   uiActions: UiActionsStart;
@@ -317,6 +319,7 @@ export class Plugin
             actionTypeRegistry,
             ruleTypeRegistry,
             kibanaFeatures,
+            kql: pluginsStart.kql,
             licensing: pluginsStart.licensing,
             expressions: pluginsStart.expressions,
             isServerless: !!pluginsStart.serverless,
@@ -419,6 +422,7 @@ export class Plugin
             actionTypeRegistry,
             ruleTypeRegistry,
             kibanaFeatures,
+            kql: pluginsStart.kql,
             licensing: pluginsStart.licensing,
             expressions: pluginsStart.expressions,
             isServerless,
@@ -491,6 +495,7 @@ export class Plugin
             actionTypeRegistry,
             ruleTypeRegistry,
             kibanaFeatures,
+            kql: pluginsStart.kql,
             licensing: pluginsStart.licensing,
             expressions: pluginsStart.expressions,
             isServerless,

x-pack/solutions/observability/plugins/observability/kibana.jsonc

@@ -24,6 +24,7 @@
       "features",
       "files",
       "inspector",
+      "kql",
       "lens",
       "observabilityShared",
       "ruleRegistry",
@@ -66,7 +67,6 @@
       "logsShared",
       "kibanaReact",
       "kibanaUtils",
-      "kql",
       "stackAlerts",
       "spaces",
       "observabilityAgentBuilder"

x-pack/solutions/observability/plugins/observability/test/scout/ui/fixtures/constants.ts

@@ -85,6 +85,14 @@ export const CUSTOM_THRESHOLD_RULE_TEST_SUBJECTS = {
   INDEX_PATTERN_INPUT: 'indexPattern-switcher--input',
   EXPLORE_MATCHING_INDICES_BUTTON: 'explore-matching-indices-button',
 
+  // Metric Row / Custom Equation
+  AGGREGATION_NAME_A: 'aggregationNameA',
+  AGGREGATION_TYPE_SELECT: 'aggregationTypeSelect',
+
+  // KQL Filter
+  KQL_SEARCH_FIELD: 'o11ySearchField',
+  KQL_SUGGESTIONS_PANEL: 'o11ySuggestionsPanel',
+
   // Rule Save
   RULE_SAVE_BUTTON: 'rulePageFooterSaveButton',
   CONFIRM_MODAL_BUTTON: 'confirmModalConfirmButton',

x-pack/solutions/observability/plugins/observability/test/scout/ui/fixtures/page_objects/rules_page.ts

@@ -466,6 +466,61 @@ export class RulesPage {
     return this.ruleTypeModal.locator('.euiFacetButton[title="Observability"]');
   }
 
+  // KQL Filter / Metric Row methods
+
+  /**
+   * Gets the aggregation expression for metric A
+   */
+  public get aggregationExpressionA() {
+    return this.page.testSubj.locator(CUSTOM_THRESHOLD_RULE_TEST_SUBJECTS.AGGREGATION_NAME_A);
+  }
+
+  /**
+   * Gets the aggregation type select dropdown
+   */
+  public get aggregationTypeSelect() {
+    return this.page.testSubj.locator(CUSTOM_THRESHOLD_RULE_TEST_SUBJECTS.AGGREGATION_TYPE_SELECT);
+  }
+
+  /**
+   * Gets the KQL search field
+   */
+  public get kqlSearchField() {
+    return this.page.testSubj.locator(CUSTOM_THRESHOLD_RULE_TEST_SUBJECTS.KQL_SEARCH_FIELD);
+  }
+
+  /**
+   * Gets the KQL suggestions panel
+   */
+  public get kqlSuggestionsPanel() {
+    return this.page.testSubj.locator(CUSTOM_THRESHOLD_RULE_TEST_SUBJECTS.KQL_SUGGESTIONS_PANEL);
+  }
+
+  /**
+   * Opens the metric row popover by clicking on the aggregation expression
+   */
+  async openMetricRowPopover() {
+    await expect(this.aggregationExpressionA).toBeVisible({ timeout: SHORTER_TIMEOUT });
+    await this.aggregationExpressionA.click();
+    await expect(this.aggregationTypeSelect).toBeVisible({ timeout: SHORTER_TIMEOUT });
+  }
+
+  /**
+   * Selects COUNT aggregation type to show the KQL filter
+   */
+  async selectCountAggregation() {
+    await this.aggregationTypeSelect.selectOption('count');
+    await expect(this.kqlSearchField).toBeVisible({ timeout: SHORTER_TIMEOUT });
+  }
+
+  /**
+   * Types in the KQL search field
+   */
+  async typeInKqlFilter(text: string) {
+    await this.kqlSearchField.click();
+    await this.kqlSearchField.fill(text);
+  }
+
   // Rule Status Dropdown methods
 
   /**

x-pack/solutions/observability/plugins/observability/test/scout/ui/parallel_tests/rules/custom_threshold_rule/kql_filter_autocomplete.spec.ts

@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { expect } from '@kbn/scout-oblt';
+import { test } from '../../../fixtures';
+
+test.describe(
+  'Custom Threshold Rule - KQL Filter Autocomplete',
+  { tag: ['@ess', '@svlOblt'] },
+  () => {
+    test.beforeEach(async ({ browserAuth, pageObjects }) => {
+      await browserAuth.loginAsAdmin();
+      await pageObjects.rulesPage.goto();
+
+      // Open rule type modal and select custom threshold
+      await pageObjects.rulesPage.openRuleTypeModal();
+      await pageObjects.rulesPage.clickCustomThresholdRuleType();
+    });
+
+    test('should show KQL autocomplete suggestions when typing in the filter field', async ({
+      pageObjects,
+    }) => {
+      // Open the metric row popover
+      await pageObjects.rulesPage.openMetricRowPopover();
+
+      // Select COUNT aggregation to show the KQL filter field
+      await pageObjects.rulesPage.selectCountAggregation();
+
+      // Verify the KQL search field is visible
+      await expect(pageObjects.rulesPage.kqlSearchField).toBeVisible();
+
+      // Type in the KQL filter to trigger autocomplete
+      await pageObjects.rulesPage.typeInKqlFilter('host');
+
+      // Verify that suggestions panel appears (autocomplete is working)
+      await expect(pageObjects.rulesPage.kqlSuggestionsPanel).toBeVisible({ timeout: 10000 });
+    });
+  }
+);