[9.2] [Security Solution] Re-validate EQL query when index pattern changes (#261027)#263505
Merged
dhurley14 merged 1 commit intoelastic:9.2from Apr 16, 2026
Merged
Conversation
…lastic#261027) ## Summary Fixes elastic#260991 When editing an EQL detection rule, switching the index pattern / data view (e.g. valid index → closed index → valid index) without changing the query text left stale validation errors on screen. The hook form library only re-runs validators when the **field value** changes, while the EQL validator already closes over the updated data view from `EqlQueryEdit`. ## Changes - **`eql_query_bar.tsx`**: Call `field.validate()` in an effect when `indexPattern.id` or `indexPattern.title` changes. Use a ref to hold the latest `validate` so we do not depend on `validate` in the effect deps (which would re-run on every keystroke and duplicate debounced EQL validation). - **`eql_query_bar.test.tsx`**: Unit test that `validate` runs on mount and again when the index pattern title changes. ## Release note Fixes EQL rule creation so the query field re-validates after changing the index pattern, clearing errors when the query is valid for the newly selected data view. Made with [Cursor](https://cursor.com) (cherry picked from commit bce427a)
rylnd
approved these changes
Apr 16, 2026
Contributor
rylnd
left a comment
rylnd
left a comment
There was a problem hiding this comment.
LGTM (with approval this time)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport
This will backport the following commits from
mainto9.2:Questions ?
Please refer to the Backport tool documentation