From ee1710cf395f9d9576c4db18dc9a9668bef1aaae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20St=C3=BCrmer?= <weltenwort@users.noreply.github.com>
Date: Fri, 18 Jun 2021 14:50:58 +0200
Subject: [PATCH] [Logs UI] Add `event.original` fallback to message
 reconstruction rules (#102236)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../message/builtin_rules/generic.test.ts     | 54 ++++++++++++++
 .../message/builtin_rules/generic.ts          | 73 ++++++++++---------
 2 files changed, 94 insertions(+), 33 deletions(-)

diff --git a/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.test.ts b/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.test.ts
index ae5a45c61d3b5e..ba8eab91e34566 100644
--- a/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.test.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.test.ts
@@ -186,4 +186,58 @@ describe('Generic Rules', () => {
       `);
     });
   });
+
+  describe('event.original fallback', () => {
+    test('includes the event.dataset if present', () => {
+      const flattenedDocument = {
+        '@timestamp': ['2016-12-26T16:22:13.000Z'],
+        'event.dataset': ['generic.test'],
+        'event.original': ['TEST_MESSAGE'],
+      };
+
+      expect(format(flattenedDocument, {})).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "constant": "[",
+          },
+          Object {
+            "field": "event.dataset",
+            "highlights": Array [],
+            "value": Array [
+              "generic.test",
+            ],
+          },
+          Object {
+            "constant": "] ",
+          },
+          Object {
+            "field": "event.original",
+            "highlights": Array [],
+            "value": Array [
+              "TEST_MESSAGE",
+            ],
+          },
+        ]
+      `);
+    });
+
+    test('includes the original message', () => {
+      const flattenedDocument = {
+        '@timestamp': ['2016-12-26T16:22:13.000Z'],
+        'event.original': ['TEST_MESSAGE'],
+      };
+
+      expect(format(flattenedDocument, {})).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "field": "event.original",
+            "highlights": Array [],
+            "value": Array [
+              "TEST_MESSAGE",
+            ],
+          },
+        ]
+      `);
+    });
+  });
 });
diff --git a/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.ts b/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.ts
index c16d65a75b3e05..07b6cf03e2c5db 100644
--- a/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.ts
@@ -8,40 +8,15 @@
 import { LogMessageFormattingRule } from '../rule_types';
 
 const BUILTIN_GENERIC_MESSAGE_FIELDS = ['message', '@message'];
+const BUILTIN_FALLBACK_MESSAGE_FIELDS = ['log.original', 'event.original'];
 
-export const getGenericRules = (genericMessageFields: string[]) => [
-  ...Array.from(new Set([...genericMessageFields, ...BUILTIN_GENERIC_MESSAGE_FIELDS])).reduce<
-    LogMessageFormattingRule[]
-  >((genericRules, fieldName) => [...genericRules, ...createGenericRulesForField(fieldName)], []),
-  {
-    when: {
-      exists: ['event.dataset', 'log.original'],
-    },
-    format: [
-      {
-        constant: '[',
-      },
-      {
-        field: 'event.dataset',
-      },
-      {
-        constant: '] ',
-      },
-      {
-        field: 'log.original',
-      },
-    ],
-  },
-  {
-    when: {
-      exists: ['log.original'],
-    },
-    format: [
-      {
-        field: 'log.original',
-      },
-    ],
-  },
+export const getGenericRules = (genericMessageFields: string[]): LogMessageFormattingRule[] => [
+  ...Array.from(new Set([...genericMessageFields, ...BUILTIN_GENERIC_MESSAGE_FIELDS])).flatMap(
+    createGenericRulesForField
+  ),
+  ...BUILTIN_FALLBACK_MESSAGE_FIELDS.filter(
+    (fieldName) => !genericMessageFields.includes(fieldName)
+  ).flatMap(createFallbackRulesForField),
 ];
 
 const createGenericRulesForField = (fieldName: string) => [
@@ -172,3 +147,35 @@ const createGenericRulesForField = (fieldName: string) => [
     ],
   },
 ];
+
+const createFallbackRulesForField = (fieldName: string) => [
+  {
+    when: {
+      exists: ['event.dataset', fieldName],
+    },
+    format: [
+      {
+        constant: '[',
+      },
+      {
+        field: 'event.dataset',
+      },
+      {
+        constant: '] ',
+      },
+      {
+        field: fieldName,
+      },
+    ],
+  },
+  {
+    when: {
+      exists: [fieldName],
+    },
+    format: [
+      {
+        field: fieldName,
+      },
+    ],
+  },
+];