[ResponseOps][Maintenance Window] Maintenance Window does not apply when using wildcard via Query DSL by georgianaonoleata1904 · Pull Request #256622 · elastic/kibana

georgianaonoleata1904 · 2026-03-09T08:46:37Z

Closes #252656
Closes #253857

Summary

Fixed MW alert filtering when using wildcards.

buildEsQuery() was called with undefined for the index pattern param so the KQL compiler couldn't determine field types
fix: pass a DataViewBase with esTypes from alertFieldMap, enabling correct wildcard handling for keyword fields

coderabbitai · 2026-03-09T08:48:21Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (4)

reviewer:coderabbit
Team:Search
Team:Operations
Team:QA

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 364535f9-3155-4acc-994c-63a1e01a86c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

elasticmachine · 2026-03-10T08:45:10Z

Pinging @elastic/response-ops (Team:ResponseOps)

pmuellr

Left a few comments, haven't done a complete review yet ...

pmuellr · 2026-03-13T14:09:41Z

...ared/maintenance_windows/server/application/methods/create/create_maintenance_window.test.ts


+  it.each([
+    ['test*', 'test*'],
+    ['test rule*', 'test rule*'],


We also need to figure out, in the KQL prompter, what they return when you don't use the KQL controls, but click the "Use Query DSL" and enter in your own DSL. And then test that here as well.

It's not clear to me why using Query DSL in the KQL picker would need an index pattern, so I was wondering if there was something different about using the Use Query DSL option, that we weren't handling correctrly.

When the user clicks "Edit as Query DSL", the raw DSL is stored in filter.query and passed through scope.alerting.filters. On the server side, buildEsQuery() returns filter.query as is via translateToQuery(), this means no index pattern needed. You're right that Query DSL doesn't need one.

The getAlertsDataViewBase() only affects the KQL part, when the system needs field types to generate the wildcard queries. I'll add a test confirming Query DSL wildcards pass through unchanged.

pmuellr · 2026-03-13T14:17:29Z

x-pack/platform/plugins/shared/maintenance_windows/server/lib/get_alerts_data_view_base.ts

+ * 2.0.
+ */
+
+import { alertFieldMap } from '@kbn/alerts-as-data-utils';


We probably already have some code to generate mappings from the alertFieldMap, since someone has to create the mappings :-). We should find that and reuse it - exporting it or whatever to make it available here.

I'm not sure if different alert indices have different mappings, but I'm 98% sure they can, so I'm not sure this approach covers 100% of the cases. I feel like we may need to have the code that evaluates the MW get passed the mappings. So the alerting code would figure out what alerting indices were going to be queried over, and pass them into the evaluator.

There is mappingFromFieldMap() but looks like it generates es index mappings (nested) not a DataViewBase (flat field with esTypes). I don't think we can reuse it directly, but maybe I'm wrong.

However, looks like rule types can register custom fields using IRuleTypeAlerts.mappings.fieldMap. The fix adding getAlertsDataViewBase covers the base alertFieldMap.

I'll look into adding combined maps for this edge case.

Hey @pmuellr , I did a some investigation and for combined maps: we could aggregate all registered IRuleTypeAlerts.mappings.fieldMap entries and merge them with alertFieldMap, but a MW is saved once and can apply to many rule types. I THINK that the correct fix would be to apply your suggestion: generate DSL at evaluation time when the exact rule type is known, but I also think that this changes the scope.alerting contract and feels like a larger follow up.
For now, getAlertsDataViewBase() covers the standard alertFieldMap fields. Maybe we can ship the fix as is and open a follow up issue to track the mappings at evaluation time approach. WDYT?

Ya, even if we just handle all the standard fields, that should be a great first step. Assuming we do that, let's open an issue to later deal with the custom fields. I suspect the easiest thing to do will be to get the fields from ES based on the index pattern we use, which could be a little expensive, so will be tricky to get right :-)

Opened the follow up issue: #259076
Thanks!

pmuellr

LGTM, but would like a function test. If we're in a crunch for time, I thinking adding one in a followup PR would be fine, but hopefully we have some existing MW FT we can adapt easily ...

kibanamachine · 2026-03-24T08:59:26Z

Starting backport for target branches: 9.2, 9.3

https://github.com/elastic/kibana/actions/runs/23481192317

kibanamachine · 2026-03-24T09:07:34Z

💔 All backports failed

Status	Branch	Result
❌	9.2	Backport failed because of merge conflicts
❌	9.3	Backport failed because of merge conflicts You might need to backport the following PRs to 9.3: - Update dependency @moonrepo/cli to v2 (main) (#256118)

Manual backport

To create the backport manually run:

node scripts/backport --pr 256622

Questions ?

Please refer to the Backport tool documentation

…hen using wildcard via Query DSL (elastic#256622) Closes elastic#252656 Closes elastic#253857 ## Summary Fixed MW alert filtering when using wildcards. - `buildEsQuery()` was called with `undefined` for the index pattern param so the KQL compiler couldn't determine field types - fix: pass a `DataViewBase` with `esTypes` from `alertFieldMap`, enabling correct wildcard handling for keyword fields --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit f26f09a) # Conflicts: # x-pack/platform/plugins/shared/maintenance_windows/moon.yml # x-pack/platform/plugins/shared/maintenance_windows/server/application/methods/create/create_maintenance_window.test.ts # x-pack/platform/plugins/shared/maintenance_windows/server/application/methods/create/create_maintenance_window.ts # x-pack/platform/plugins/shared/maintenance_windows/server/application/methods/update/update_maintenance_window.test.ts # x-pack/platform/plugins/shared/maintenance_windows/server/application/methods/update/update_maintenance_window.ts # x-pack/platform/plugins/shared/maintenance_windows/tsconfig.json

georgianaonoleata1904 · 2026-03-24T11:01:30Z

💔 Some backports could not be created

Status	Branch	Result
✅	9.3
❌	9.2	An unhandled error occurred. Please see the logs for details

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 256622

Questions ?

Please refer to the Backport tool documentation

…hen using wildcard via Query DSL (elastic#256622) Closes elastic#252656 Closes elastic#253857 ## Summary Fixed MW alert filtering when using wildcards. - `buildEsQuery()` was called with `undefined` for the index pattern param so the KQL compiler couldn't determine field types - fix: pass a `DataViewBase` with `esTypes` from `alertFieldMap`, enabling correct wildcard handling for keyword fields --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit f26f09a) # Conflicts: # x-pack/platform/plugins/shared/alerting/server/application/maintenance_window/methods/create/create_maintenance_window.test.ts # x-pack/platform/plugins/shared/alerting/server/application/maintenance_window/methods/create/create_maintenance_window.ts # x-pack/platform/plugins/shared/alerting/server/application/maintenance_window/methods/update/update_maintenance_window.test.ts # x-pack/platform/plugins/shared/alerting/server/application/maintenance_window/methods/update/update_maintenance_window.ts # x-pack/platform/plugins/shared/maintenance_windows/moon.yml # x-pack/platform/plugins/shared/maintenance_windows/tsconfig.json

georgianaonoleata1904 · 2026-03-24T11:05:14Z

💚 All backports created successfully

Status	Branch	Result
✅	9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…hen using wildcard via Query DSL (elastic#256622) Closes elastic#252656 Closes elastic#253857 ## Summary Fixed MW alert filtering when using wildcards. - `buildEsQuery()` was called with `undefined` for the index pattern param so the KQL compiler couldn't determine field types - fix: pass a `DataViewBase` with `esTypes` from `alertFieldMap`, enabling correct wildcard handling for keyword fields --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2026-03-26T09:49:01Z