[Alerting v2] Dispatcher grouping modes, throttle strategies, and matcher autosuggestion

packages/kbn-check-saved-objects-cli/current_fields.json

@@ -109,8 +109,11 @@
     "destinations.type",
     "enabled",
     "groupBy",
+    "groupingMode",
     "name",
     "snoozedUntil",
+    "throttle",
+    "throttle.strategy",
     "updatedAt",
     "updatedBy",
     "updatedByUsername"

packages/kbn-check-saved-objects-cli/current_mappings.json

@@ -367,6 +367,17 @@
       "groupBy": {
         "type": "keyword"
       },
+      "groupingMode": {
+        "type": "keyword"
+      },
+      "throttle": {
+        "type": "object",
+        "properties": {
+          "strategy": {
+            "type": "keyword"
+          }
+        }
+      },
       "name": {
         "fields": {
           "keyword": {

src/platform/packages/shared/kbn-eval-kql/src/eval_kql.test.ts

@@ -35,6 +35,22 @@ describe('evaluateKql', () => {
       expect(evaluateKql(kql, { user: { info: { name: 'Jane Doe' } } })).toBe(false);
     });
 
+    it('should correctly evaluate a quoted value with dots in nested field path', () => {
+      const kql = 'data.host.name: "admin-console.prod.001"';
+      expect(
+        evaluateKql(kql, {
+          episode_status: 'recovering',
+          data: { count: 2, host: { name: 'admin-console.prod.001' } },
+        })
+      ).toBe(true);
+      expect(
+        evaluateKql(kql, {
+          episode_status: 'recovering',
+          data: { count: 2, host: { name: 'other-host' } },
+        })
+      ).toBe(false);
+    });
+
     it('should correctly evaluate a simple "is" KQL expression with boolean', () => {
       const kql = 'isActive: true';
       expect(evaluateKql(kql, { isActive: true })).toBe(true);
@@ -257,6 +273,29 @@ describe('evaluateKql', () => {
         expect(evaluateKql(kql, { timestamp: resolved })).toBe(true);
         expect(evaluateKql(kql, { timestamp: '2025-01-01T00:00:00.000Z' })).toBe(false);
       });
+
+      it('should match "now+1h" against the resolved date', () => {
+        const kql = 'timestamp: now+1h';
+        const resolved = dateMath.parse('now+1h')!.toISOString();
+        expect(evaluateKql(kql, { timestamp: resolved })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2020-01-01T00:00:00.000Z' })).toBe(false);
+      });
+
+      it('should match "now/d" with rounding', () => {
+        const kql = 'timestamp: now/d';
+        const resolved = dateMath.parse('now/d')!.toISOString();
+        expect(evaluateKql(kql, { timestamp: resolved })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2020-01-01T00:00:00.000Z' })).toBe(false);
+      });
+
+      it('should match datemath against any element in an array field', () => {
+        const kql = 'timestamps: now-1d';
+        const resolved = dateMath.parse('now-1d')!.toISOString();
+        expect(evaluateKql(kql, { timestamps: ['2020-01-01T00:00:00.000Z', resolved] })).toBe(true);
+        expect(
+          evaluateKql(kql, { timestamps: ['2020-01-01T00:00:00.000Z', '2021-06-01T00:00:00.000Z'] })
+        ).toBe(false);
+      });
     });
 
     describe('range expressions with datemath', () => {
@@ -293,6 +332,34 @@ describe('evaluateKql', () => {
           true
         );
       });
+
+      it('should evaluate > with datemath on the right side', () => {
+        const kql = 'timestamp > now-7d';
+        // now-7d is 2025-01-08T12:00:00Z
+        expect(evaluateKql(kql, { timestamp: '2025-01-09T00:00:00.000Z' })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: dateMath.parse('now-7d')!.toISOString() })).toBe(
+          false
+        );
+      });
+
+      it('should evaluate <= with datemath on the right side', () => {
+        const kql = 'timestamp <= now';
+        const nowIso = dateMath.parse('now')!.toISOString();
+        expect(evaluateKql(kql, { timestamp: nowIso })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2025-01-14T00:00:00.000Z' })).toBe(true);
+        expect(evaluateKql(kql, { timestamp: '2025-01-16T00:00:00.000Z' })).toBe(false);
+      });
+
+      it('should match range with datemath against any element in an array field', () => {
+        const kql = 'timestamps >= now-7d';
+        // now-7d is 2025-01-08T12:00:00Z
+        expect(
+          evaluateKql(kql, { timestamps: ['2025-01-01T00:00:00.000Z', '2025-01-10T00:00:00.000Z'] })
+        ).toBe(true);
+        expect(
+          evaluateKql(kql, { timestamps: ['2025-01-01T00:00:00.000Z', '2025-01-02T00:00:00.000Z'] })
+        ).toBe(false);
+      });
     });
 
     describe('fallback for non-datemath strings', () => {

src/platform/packages/shared/kbn-eval-kql/src/eval_kql.ts

@@ -174,17 +174,22 @@ function readContextPath(
   return { pathExists: true, value: result };
 }
 
+function isDateMathExpression(value: string): boolean {
+  return value.startsWith('now') || value.includes('||');
+}
+
 function convertLiteralToValue(
   node: KqlLiteralNode,
   expectedType: 'string' | 'number' | 'boolean'
 ): any {
   switch (expectedType) {
     case 'string': {
       const strValue = String(node.value);
-      const parsed = dateMath.parse(strValue);
-      if (parsed?.isValid()) {
-        // it's a date math expression, return the resolved ISO string
-        return parsed.toISOString();
+      if (isDateMathExpression(strValue)) {
+        const parsed = dateMath.parse(strValue);
+        if (parsed?.isValid()) {
+          return parsed.toISOString();
+        }
       }
 
       return strValue;

src/platform/plugins/shared/kql/public/autocomplete/providers/value_suggestion_provider.ts

@@ -27,7 +27,7 @@ interface ValueSuggestionsGetFnArgs {
   boolFilter?: any[];
   signal?: AbortSignal;
   method?: ValueSuggestionsMethod;
-  querySuggestionKey?: 'rules' | 'cases' | 'alerts' | 'endpoints';
+  querySuggestionKey?: 'rules' | 'cases' | 'alerts' | 'endpoints' | 'notification_policies';
 }
 
 const getAutocompleteTimefilter = ({ timefilter }: TimefilterSetup, indexPattern: DataView) => {

src/platform/plugins/shared/kql/public/components/query_string_input/query_string_input.tsx

@@ -151,6 +151,11 @@ export interface QueryStringInputProps {
    * Add additional filters used for suggestions
    */
   filtersForSuggestions?: Filter[];
+
+  /**
+   * Debounce delay in ms for fetching suggestions. Defaults to 100.
+   */
+  suggestionsDebounceMs?: number;
 }
 
 interface State {
@@ -333,7 +338,7 @@ export class QueryStringInput extends PureComponent<QueryStringInputProps, State
     if (!this.componentIsUnmounting) {
       this.setState({ suggestions });
     }
-  }, 100);
+  }, this.props.suggestionsDebounceMs ?? 100);
 
   private onSubmit = (query: Query) => {
     if (this.props.onSubmit) {

src/platform/plugins/shared/kql/public/components/typeahead/suggestions_component.tsx

@@ -39,7 +39,7 @@ interface SuggestionsComponentProps {
 }
 
 export interface SuggestionsAbstraction {
-  type: 'alerts' | 'rules' | 'cases' | 'endpoints';
+  type: 'alerts' | 'rules' | 'cases' | 'endpoints' | 'notification_policies';
   fields: Record<
     string,
     {

x-pack/platform/packages/shared/response-ops/alerting-v2-constants/index.ts

@@ -9,3 +9,6 @@ export const ALERTING_V2_RULE_API_PATH = '/api/alerting/v2/rules' as const;
 export const ALERTING_V2_ALERT_API_PATH = '/api/alerting/v2/alerts' as const;
 export const ALERTING_V2_NOTIFICATION_POLICY_API_PATH =
   '/api/alerting/v2/notification_policies' as const;
+// KQL private API path for data fields suggestions
+export const INTERNAL_ALERTING_V2_SUGGESTIONS_API_PATH =
+  '/internal/notification_policies/suggestions/values' as const;

x-pack/platform/packages/shared/response-ops/alerting-v2-schemas/src/matcher_context.ts

@@ -21,11 +21,12 @@ export interface MatcherContext {
   episode_id: string;
   episode_status: 'inactive' | 'pending' | 'active' | 'recovering';
   rule: MatcherContextRule;
+  data?: Record<string, unknown>;
 }
 
 export interface MatcherContextFieldDescriptor {
   path: string;
-  type: 'string' | 'boolean' | 'string[]';
+  type: 'string' | 'boolean' | 'string[]' | 'object';
 }
 
 export const MATCHER_CONTEXT_FIELDS: MatcherContextFieldDescriptor[] = [
@@ -40,4 +41,5 @@ export const MATCHER_CONTEXT_FIELDS: MatcherContextFieldDescriptor[] = [
   { path: 'rule.enabled', type: 'boolean' },
   { path: 'rule.createdAt', type: 'string' },
   { path: 'rule.updatedAt', type: 'string' },
+  { path: 'data', type: 'object' },
 ];