We need to make sure that if we are searching index patterns for a colon, we update the search to target a single colon.
In SLO, we assume an index pattern contains a remote cluster if the string contains a ":" character at all, then we search for that pattern by splitting on the ":" character. Both of these assumptions are wrong now, because at some future point, indices can follow a pattern like this: {remote_name}:{index_name}::{suffix}. There is a regex suggested in this issue's parent issue that could be one solution to this, but so long as we can avoid false positive matching on the above pattern, we shoudl be fine.
Acceptance criteria
Make sure the SLO plugin no longer assumes the existence of the ":" character means that an index pattern contains a remote_cluster prefix
Make sure the SLO plugin no longer assumes splitting on ":" will result in the remote cluster prefix being the first item in the split array
More information here: https://github.com/elastic/kibana/issues/193906
We need to make sure that if we are searching index patterns for a colon, we update the search to target a single colon.
In SLO, we assume an index pattern contains a remote cluster if the string contains a ":" character at all, then we search for that pattern by splitting on the ":" character. Both of these assumptions are wrong now, because at some future point, indices can follow a pattern like this:
{remote_name}:{index_name}::{suffix}
. There is a regex suggested in this issue's parent issue that could be one solution to this, but so long as we can avoid false positive matching on the above pattern, we shoudl be fine.Acceptance criteria
Known area where this is occurring:
https://github.com/elastic/kibana/blob/ac96a4ca6d9168b9d22b2e92514f6761131e8fea/x-pack/plugins/observability_solution/slo/server/services/summary_search_client.ts#L228-L230