increases unit-test code statement coverage to 100% for search_after …

…/ bulk index reindexer
elastic · Nov 11, 2019 · ac05ba8 · ac05ba8
1 parent c555d0f
commit ac05ba8
Show file tree

Hide file tree

Showing 6 changed files with 649 additions and 16 deletions.
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/__mocks__/es_results.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/__mocks__/es_results.ts
@@ -6,7 +6,7 @@
 
 import { SignalSourceHit, SignalSearchResponse, SignalAlertParams, BulkResponse } from '../types';
 
-export const sampleSignalAlertParams = (): SignalAlertParams => ({
+export const sampleSignalAlertParams = (maxSignals: number | undefined): SignalAlertParams => ({
   id: 'rule-1',
   description: 'Detecting root and admin users',
   index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
@@ -19,7 +19,7 @@ export const sampleSignalAlertParams = (): SignalAlertParams => ({
   query: 'user.name: root or user.name: admin',
   language: 'kuery',
   references: ['http://google.com'],
-  maxSignals: 100,
+  maxSignals,
   enabled: true,
   filter: undefined,
   filters: undefined,
@@ -52,6 +52,22 @@ export const sampleDocWithSortId: SignalSourceHit = {
   sort: ['1234567891111'],
 };
 
+export const sampleEmptyDocSearchResults: SignalSearchResponse = {
+  took: 10,
+  timed_out: false,
+  _shards: {
+    total: 10,
+    successful: 10,
+    failed: 0,
+    skipped: 0,
+  },
+  hits: {
+    total: 0,
+    max_score: 100,
+    hits: [],
+  },
+};
+
 export const sampleDocSearchResultsNoSortId: SignalSearchResponse = {
   took: 10,
   timed_out: false,
@@ -72,6 +88,44 @@ export const sampleDocSearchResultsNoSortId: SignalSearchResponse = {
   },
 };
 
+export const sampleDocSearchResultsNoSortIdNoHits: SignalSearchResponse = {
+  took: 10,
+  timed_out: false,
+  _shards: {
+    total: 10,
+    successful: 10,
+    failed: 0,
+    skipped: 0,
+  },
+  hits: {
+    total: 0,
+    max_score: 100,
+    hits: [
+      {
+        ...sampleDocNoSortId,
+      },
+    ],
+  },
+};
+
+export const repeatedSearchResultsWithSortId = (repeat: number) => ({
+  took: 10,
+  timed_out: false,
+  _shards: {
+    total: 10,
+    successful: 10,
+    failed: 0,
+    skipped: 0,
+  },
+  hits: {
+    total: 1,
+    max_score: 100,
+    hits: Array.from({ length: repeat }).map(x => ({
+      ...sampleDocWithSortId,
+    })),
+  },
+});
+
 export const sampleDocSearchResultsWithSortId: SignalSearchResponse = {
   took: 10,
   timed_out: false,

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.ts
@@ -10,6 +10,7 @@ interface BuildEventsSearchQuery {
   to: string;
   filter: unknown;
   size: number;
+  maxDocs: number | undefined;
   searchAfterSortId?: string | number;
 }
 
@@ -19,6 +20,7 @@ export const buildEventsSearchQuery = ({
   to,
   filter,
   size,
+  maxDocs,
   searchAfterSortId,
 }: BuildEventsSearchQuery) => {
   const filterWithTime = [
@@ -74,7 +76,8 @@ export const buildEventsSearchQuery = ({
           ],
         },
       },
-      track_total_hits: true,
+      // if we have maxDocs, don't utilize track total hits.
+      track_total_hits: maxDocs != null ? false : true,
       sort: [
         {
           '@timestamp': {

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/signals_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/signals_alert_type.ts
@@ -87,6 +87,7 @@ export const signalsAlertType = ({ logger }: { logger: Logger }): SignalAlertTyp
         to,
         filter: esFilter,
         size: searchAfterSize,
+        maxDocs: maxSignals,
       });
 
       try {

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/types.ts
@@ -31,7 +31,7 @@ export interface SignalAlertParams {
   interval: string;
   id: string;
   language: string | undefined;
-  maxSignals: number;
+  maxSignals: number | undefined;
   name: string;
   query: string | undefined;
   references: string[];