[Audit] CCS `:` index pattern delimiter parsing

[thomasneirynck]

To access failure store data, Elasticsearch is looking to introduce :: as a new delimiter (https://github.com/elastic/dev/issues/2698).

This introduction would break naive implementations of detecting whether an index pattern references a remote cluster, which uses a single colon (:).

A quick search (https://github.com/elastic/dev/issues/2698#issuecomment-2368745142) has shown that Kibana has many naive implementations. These just check for the presence of the :-character, rather than check that it is being used as a delimiter within a string.

e.g. String.prototype.includes(':') is often used. This is incorrect.

We need to do a full audit to get a better sense of what the blast radius of this change would be.

---

Where does Kibana detect if an index-pattern is a CCS-pattern?

• Platform:
  • [x] @kbn/esql-validation-autocomplete: https://github.com/elastic/kibana/blob/e404a3992e220735ae51918c532a1a032e7f7993/packages/kbn-esql-validation-autocomplete/src/shared/helpers.ts#L552
  • [x] data_view_editor: https://github.com/elastic/kibana/blob/b885d9381de779650cb24d7c8e5a43097adf99d9/src/plugins/data_view_editor/public/lib/get_matched_indices.ts#L17)
  • [x] data_frame_analytics: https://github.com/elastic/kibana/blob/304cb256cf60ba689a8e0399693228986a5aff7e/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.test.tsx#L110
  • [x] ml: https://github.com/elastic/kibana/blob/339e24ffe56c648cdaf71623b479986ff3b0ea34/x-pack/plugins/ml/public/application/util/index_utils.ts#L54
  • [x] transform: https://github.com/elastic/kibana/blob/7edaa6821ed0c916df91813da5fa7da1668cb13a/x-pack/plugins/transform/public/app/hooks/use_index_data.ts#L122
  • [x] transform: https://github.com/elastic/kibana/blob/7edaa6821ed0c916df91813da5fa7da1668cb13a/x-pack/plugins/transform/public/app/hooks/use_index_data.ts#L237
• Observability:
  • [x] monitoring: https://github.com/elastic/kibana/blob/747704544fcb61fce043100ad14376c6d0da6b3b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_health.ts#L90
  • [x] monitoring: https://github.com/elastic/kibana/blob/bebec37f0435f292f19834d49c8db0006f85fcbb/x-pack/plugins/monitoring/common/ccs_utils.ts#L70
  • [x] monitoring: https://github.com/elastic/kibana/blob/d1e5dbc5c9421297d44cd11cd60d3e96cff4f481/x-pack/plugins/monitoring/server/lib/alerts/fetch_ccr_read_exceptions.ts#L176 (and multiple similar instances in other files)
    • [x] apm: https://github.com/elastic/kibana/blob/d7ae4b6cf545093603e49e45eea54b33d36b6134/x-pack/plugins/observability_solution/apm/server/routes/correlations/queries/fetch_significant_correlations.ts#L174
    • [x] apm: https://github.com/elastic/kibana/blob/7b76160d68af1535c14343725c8280933ae0e937/x-pack/plugins/observability_solution/apm/public/components/app/diagnostics/summary_tab/index.tsx#L103
    • [x] apm: https://github.com/elastic/kibana/blob/7b76160d68af1535c14343725c8280933ae0e937/x-pack/plugins/observability_solution/apm/server/routes/correlations/queries/fetch_p_values.ts#L107
    • [x] apm: https://github.com/elastic/kibana/blob/7b76160d68af1535c14343725c8280933ae0e937/x-pack/plugins/observability_solution/apm/server/routes/correlations/queries/fetch_significant_correlations.ts#L174
    • [x] apm: https://github.com/elastic/kibana/blob/7b76160d68af1535c14343725c8280933ae0e937/x-pack/plugins/observability_solution/apm/server/routes/storage_explorer/is_cross_cluster_search.ts#L13
    • [ ] ...
• Security:
  • [x] detection_engine: https://github.com/elastic/kibana/blob/7b76160d68af1535c14343725c8280933ae0e937/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/utils.ts#L85
• Search-solution:
  • [ ] ...

Any other possible use-cases where the introduction of :: could cause failures?

Are there any other instances Kibana would be parsing an index-pattern string and where the introduction of :: could cause failures?

---

Introduce package with parsing functionality

There is an opportunity to align implementations here.

To fix this consistently across apps, Platform should provide some utility functions (e.g. along the lines of function isCCSPattern(pattern: string) : boolean) to perform this check.

Audit Partners

Please check the box when code under your control has been verified to be compatible.

Observability

• [ ] ObsUX Infra & Services @smith
• [ ] ObsUX Logs @gbamparop
• [ ] ObsUX Management @jasonrhodes
• [ ] ObsExp Knowledge @emma-raffenne

Search Solution

• [x] Kibana Enterprise Search & Search Plugins @joemcelroy

[jasonrhodes]

In our @elastic/obs-ux-management-team areas, which include Alerting, SLO, Synthetics, and Uptime, we've found at least one instance so far, in the SLO plugin.

https://github.com/elastic/kibana/blob/ac96a4ca6d9168b9d22b2e92514f6761131e8fea/x-pack/plugins/observability_solution/slo/server/services/summary_search_client.ts#L228-L230

I'll update this ticket if we find more, and we'll create an issue for the above ^

[gbamparop]

Updated the description with some usages in the apm plugin.

[thomasneirynck]

Updated platform side.

fyi @jgowdyelastic : there are some ML-plugins in here @davismcphee @stratoula others are ES|QL / data-view related

[stratoula]

Yes we have a CCS check in ES|QL autocomplete but I am not sure if we need this tbh. I need to check

[stratoula]

I checked our usage and I think we should remove this check. I am doing this here https://github.com/elastic/kibana/pull/194903

[thomasneirynck]

@YulNaumenko Could you provide an update from the Security side? thx!

@joemcelroy After our off-thread discussion, I think there were no usages in Search? Do you mind confirming and updating the description? thx!

[joemcelroy]

Yep I confirmed in the enterprise-search plugin there is no usage o CCS : index pattern. updated the description under search solution.

[thomasneirynck]

short update:

I will add a centralized utility function to a package to parse these index-patterns, and which we then can use to replace these includes and indexOf-usages. (similar to how ES isolated this into a utility https://github.com/elastic/elasticsearch/pull/113501/files#diff-54b4d10d02244bb6e2b3413b315759f96cc44c6344c59358dabd304dd8def30aR61).

I will do a first pass at resolving these usages that are listed here, but there may be some follow-up/review from the solutions teams on this.

Will ping when there's progress. Thx all.

[YulNaumenko]

@thomasneirynck I've listed the single usage we have at Security Solution, which is a part of the Detections Engine.