elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.72k stars 8.14k forks source link

[Security Solution] Not able to see all the indexes on a data view when creating a rule #137823

Open MadameSheema opened 2 years ago

MadameSheema commented 2 years ago

Describe the bug:

Kibana/Elasticsearch Stack version:

Initial setup:

Steps to reproduce:

  1. Navigate to Rule management
  2. Star the process of creating a new rule
  3. Click on Data View
  4. Click on the Dropdown

Current behavior:

Screenshot 2022-08-02 at 12 31 08

Expected behavior:

elasticmachine commented 2 years ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine commented 2 years ago

Pinging @elastic/security-solution (Team: SecuritySolution)

yctercero commented 2 years ago

@dhurley14 I think switching to the super select here will solve this.

dhurley14 commented 2 years ago

While the super select would provide the ability to display the name field along with the full title of the data view, I am afraid to migrate away from the standard EUI combo box at the moment.

If we use the super select we would display the new "name" field with the "title" field of the data view in the description section of the super select. Doing so would display the title in full and would resolve this issue more-so than relying on the hover text like below

hover_over_combo_box

I feel that moving to the super select at this current BC could be a more extensive change that anticipated. It would require updates to the rule details page to display the "name" and the "title" of the data view as well as updates to the data view selector component which relies on somewhat complicated logic to maintain the state of the selected data view on the form. I think this would be a welcome improvement in 8.5 (provided we do not replace the data view selector component with something else entirely) but to try to push through these changes now could lead to instability elsewhere, especially considering I haven't gotten around to completing cypress tests for all the relevant pages.

yctercero commented 2 years ago

Will revisit use of name for data views in 8.5.

yctercero commented 1 month ago

@ARWNightingale could you confirm if the following looks ok?

Screenshot 2024-08-20 at 6 36 59 PM

It displays the data view name and underneath it, the pattern. If there is no name then it just renders the title (equivalent of the pattern).