@oneuptime/common 12.0.25 → 12.0.26

package/Tests/Types/Log/LogQueryToFilter.test.ts

@@ -1,8 +1,14 @@
 import GreaterThan from "../../../Types/BaseDatabase/GreaterThan";
 import GreaterThanOrEqual from "../../../Types/BaseDatabase/GreaterThanOrEqual";
+import Includes from "../../../Types/BaseDatabase/Includes";
+import IsNull from "../../../Types/BaseDatabase/IsNull";
 import LessThan from "../../../Types/BaseDatabase/LessThan";
+import NotContains from "../../../Types/BaseDatabase/NotContains";
 import NotEqual from "../../../Types/BaseDatabase/NotEqual";
+import NotNull from "../../../Types/BaseDatabase/NotNull";
+import NotWildcard from "../../../Types/BaseDatabase/NotWildcard";
 import Search from "../../../Types/BaseDatabase/Search";
+import Wildcard from "../../../Types/BaseDatabase/Wildcard";
 import {
   LogFilter,
   queryStringToFilter,
@@ -10,67 +16,90 @@ import {
 import { describe, expect, test } from "@jest/globals";
 
 /*
- * queryStringToFilter turns the log search bar's query string into a
- * Query<Log>-shaped filter. It sits on top of the (separately tested)
- * LogQueryParser, so these tests focus on the mapping layer: operator ->
- * BaseDatabase value type, top-level vs @attribute routing, severity casing
- * normalization, and free-text accumulation into body Search.
+ * The log-specific half of the search pipeline: which names are columns,
+ * which alias to what, how severity is spelled in ClickHouse. The grammar
+ * itself is pinned by Tests/Types/Telemetry/TelemetrySearchQuery.test.ts and
+ * the SQL by Tests/Server/Utils/AnalyticsDatabase/StatementGeneratorWildcard.
+ *
+ * The wildcard cases are the customer-reported bug: `@platform.team:a*`
+ * against a stored `platform.team = abc` returned "no logs found", because
+ * this file used to compile a glob by DELETING the asterisks and searching
+ * for the remaining substring.
  */
 
-describe("queryStringToFilter - free text", () => {
-  test("empty query yields an empty filter", () => {
-    expect(queryStringToFilter("")).toEqual({});
+describe("queryStringToFilter - attribute wildcards", () => {
+  test("a prefix glob compiles to a Wildcard, not a substring Search", () => {
+    const filter: LogFilter = queryStringToFilter("@platform.team:a*");
+    const value: unknown = filter.attributes!["platform.team"];
+
+    expect(value).toBeInstanceOf(Wildcard);
+    expect((value as Wildcard<string>).toPatterns()).toEqual(["a%"]);
   });
 
-  test("bare words become a body Search", () => {
-    const filter: LogFilter = queryStringToFilter("connection refused");
-    expect(filter.body).toBeInstanceOf(Search);
-    expect((filter.body as Search<string>).toString()).toBe(
-      "connection refused",
+  test.each([
+    ["@k:*a", ["%a"]],
+    ["@k:a*b", ["a%b"]],
+    ["@k:a?c", ["a_c"]],
+  ])("%p compiles to %p", (query: string, patterns: Array<string>) => {
+    const filter: LogFilter = queryStringToFilter(query);
+
+    expect((filter.attributes!["k"] as Wildcard<string>).toPatterns()).toEqual(
+      patterns,
     );
   });
-});
 
-describe("queryStringToFilter - top-level fields", () => {
-  test("severity:error normalizes to title-case Error as an equals match", () => {
-    const filter: LogFilter = queryStringToFilter("severity:error");
-    expect(filter.severityText).toBe("Error");
-  });
+  test("a bare star asks whether the attribute is present", () => {
+    const filter: LogFilter = queryStringToFilter("@user.id:*");
 
-  test("level:warn aliases to severityText and normalizes warn -> Warning", () => {
-    const filter: LogFilter = queryStringToFilter("level:warn");
-    expect(filter.severityText).toBe("Warning");
+    expect(filter.attributes!["user.id"]).toBeInstanceOf(NotNull);
   });
 
-  test("service:api maps to primaryEntityId", () => {
-    const filter: LogFilter = queryStringToFilter("service:api");
-    expect(filter.primaryEntityId).toBe("api");
+  test("a negated bare star asks whether it is absent", () => {
+    const filter: LogFilter = queryStringToFilter("-@user.id:*");
+
+    expect(filter.attributes!["user.id"]).toBeInstanceOf(IsNull);
   });
 
-  test("negation produces a NotEqual with normalized severity", () => {
-    const filter: LogFilter = queryStringToFilter("-severity:debug");
-    expect(filter.severityText).toBeInstanceOf(NotEqual);
-    expect((filter.severityText as unknown as NotEqual<string>).value).toBe(
-      "Debug",
-    );
+  test("a negated glob keeps the negation AND the glob", () => {
+    /*
+     * The old parser only flipped the operator for bare equality, so
+     * `-@k:a*` compiled to a positive contains — the exact complement of the
+     * filter, returning the rows the user asked to hide.
+     */
+    const filter: LogFilter = queryStringToFilter("-@platform.team:a*");
+    const value: unknown = filter.attributes!["platform.team"];
+
+    expect(value).toBeInstanceOf(NotWildcard);
+    expect((value as NotWildcard<string>).toPatterns()).toEqual(["a%"]);
   });
 
-  test("wildcard produces a Search with the asterisks stripped", () => {
-    const filter: LogFilter = queryStringToFilter("service:api-*");
-    expect(filter.primaryEntityId).toBeInstanceOf(Search);
-    expect(
-      (filter.primaryEntityId as unknown as Search<string>).toString(),
-    ).toBe("api-");
+  test("an escaped star is a literal, so equality is used", () => {
+    const filter: LogFilter = queryStringToFilter("@k:a\\*b");
+
+    expect(filter.attributes!["k"]).toBe("a*b");
   });
 });
 
-describe("queryStringToFilter - attribute fields", () => {
-  test("@http.status_code:500 lands under attributes as an equals string", () => {
+describe("queryStringToFilter - the rest of the attribute grammar", () => {
+  test("a plain value stays a bare string, keeping the fast map-subscript path", () => {
     const filter: LogFilter = queryStringToFilter("@http.status_code:500");
+
     expect(filter.attributes).toEqual({ "http.status_code": "500" });
   });
 
-  test("numeric comparison operators parse the value as a number", () => {
+  test("~ is an explicit contains", () => {
+    const filter: LogFilter = queryStringToFilter("@url.host:~internal");
+
+    expect(filter.attributes!["url.host"]).toBeInstanceOf(Search);
+  });
+
+  test("a negated contains is a NotContains", () => {
+    const filter: LogFilter = queryStringToFilter("-@url.host:~internal");
+
+    expect(filter.attributes!["url.host"]).toBeInstanceOf(NotContains);
+  });
+
+  test("numeric comparisons parse their value as a number", () => {
     const gt: LogFilter = queryStringToFilter("@duration:>1000");
     expect(gt.attributes!["duration"]).toBeInstanceOf(GreaterThan);
     expect((gt.attributes!["duration"] as GreaterThan<number>).value).toBe(
@@ -81,31 +110,177 @@ describe("queryStringToFilter - attribute fields", () => {
     expect(gte.attributes!["duration"]).toBeInstanceOf(GreaterThanOrEqual);
 
     const lt: LogFilter = queryStringToFilter("@duration:<50");
-    expect(lt.attributes!["duration"]).toBeInstanceOf(LessThan);
     expect((lt.attributes!["duration"] as LessThan<number>).value).toBe(50);
   });
 
   test("a non-numeric comparison value stays a string", () => {
     const filter: LogFilter = queryStringToFilter("@version:>abc");
+
     expect((filter.attributes!["version"] as GreaterThan<string>).value).toBe(
       "abc",
     );
   });
 
-  test("negated attribute filter produces a NotEqual", () => {
+  test("an any-of list compiles to Includes", () => {
+    const filter: LogFilter = queryStringToFilter("@http.method:(GET OR POST)");
+    const value: unknown = filter.attributes!["http.method"];
+
+    expect(value).toBeInstanceOf(Includes);
+    expect((value as Includes).values).toEqual(["GET", "POST"]);
+  });
+
+  test("negation produces a NotEqual", () => {
     const filter: LogFilter = queryStringToFilter("-@http.method:GET");
+
     expect(filter.attributes!["http.method"]).toBeInstanceOf(NotEqual);
     expect((filter.attributes!["http.method"] as NotEqual<string>).value).toBe(
       "GET",
     );
   });
+
+  test("two filters on one key AND rather than the second winning", () => {
+    const filter: LogFilter = queryStringToFilter("@k:a* @k:*b");
+    const value: unknown = filter.attributes!["k"];
+
+    expect(Array.isArray(value)).toBe(true);
+    expect((value as Array<Wildcard<string>>)[0]!.toPatterns()).toEqual(["a%"]);
+    expect((value as Array<Wildcard<string>>)[1]!.toPatterns()).toEqual(["%b"]);
+  });
+});
+
+describe("queryStringToFilter - top-level fields", () => {
+  test("severity:error normalizes to the title case stored in ClickHouse", () => {
+    expect(queryStringToFilter("severity:error").severityText).toBe("Error");
+  });
+
+  test("level:warn aliases to severityText and normalizes warn to Warning", () => {
+    expect(queryStringToFilter("level:warn").severityText).toBe("Warning");
+  });
+
+  test("the alias lookup is case-insensitive", () => {
+    expect(queryStringToFilter("SEVERITY:error").severityText).toBe("Error");
+  });
+
+  test("severity normalization applies to every operator, not just equality", () => {
+    const filter: LogFilter = queryStringToFilter("severity:(error OR warn)");
+
+    expect((filter.severityText as unknown as Includes).values).toEqual([
+      "Error",
+      "Warning",
+    ]);
+  });
+
+  test("service:api maps to primaryEntityId", () => {
+    expect(queryStringToFilter("service:api").primaryEntityId).toBe("api");
+  });
+
+  test("negation produces a NotEqual with the normalized severity", () => {
+    const filter: LogFilter = queryStringToFilter("-severity:debug");
+
+    expect(filter.severityText).toBeInstanceOf(NotEqual);
+    expect((filter.severityText as unknown as NotEqual<string>).value).toBe(
+      "Debug",
+    );
+  });
+
+  test("a glob on a top-level field is anchored, not a substring", () => {
+    const filter: LogFilter = queryStringToFilter("service:api-*");
+    const value: unknown = filter.primaryEntityId;
+
+    expect(value).toBeInstanceOf(Wildcard);
+    expect((value as Wildcard<string>).toPatterns()).toEqual(["api-%"]);
+  });
+
+  test("message / msg / log all alias to the body column", () => {
+    for (const alias of ["message", "msg", "log"]) {
+      expect(queryStringToFilter(`${alias}:timeout`).body).toBe("timeout");
+    }
+  });
+
+  test("an unknown bare key is treated as an attribute", () => {
+    const filter: LogFilter = queryStringToFilter("k8s.pod:api-0");
+
+    expect(filter.attributes).toEqual({ "k8s.pod": "api-0" });
+  });
+});
+
+describe("queryStringToFilter - @ always means attribute", () => {
+  test.each(["body", "traceId", "spanId", "severityText"])(
+    "@%s filters the attribute, not the column of the same name",
+    (key: string) => {
+      const filter: LogFilter = queryStringToFilter(`@${key}:x`);
+
+      expect(filter.attributes).toEqual({ [key]: "x" });
+      expect(filter[key]).toBeUndefined();
+    },
+  );
+});
+
+describe("queryStringToFilter - free text", () => {
+  test("an empty query yields an empty filter", () => {
+    expect(queryStringToFilter("")).toEqual({});
+  });
+
+  test("bare words become a body Search", () => {
+    const filter: LogFilter = queryStringToFilter("connection refused");
+
+    expect(filter.body).toBeInstanceOf(Search);
+    expect((filter.body as Search<string>).toString()).toBe(
+      "connection refused",
+    );
+  });
+
+  test("phrases split by a field filter stay separate predicates", () => {
+    /*
+     * `foo severity:error bar` used to compile to `body ILIKE '%foo bar%'` —
+     * a phrase that never occurred in any log line, so the search returned
+     * nothing and looked like a data problem.
+     */
+    const filter: LogFilter = queryStringToFilter("foo severity:error bar");
+    const body: unknown = filter.body;
+
+    expect(Array.isArray(body)).toBe(true);
+    expect(
+      (body as Array<Search<string>>).map((s: Search<string>) => {
+        return s.toString();
+      }),
+    ).toEqual(["foo", "bar"]);
+  });
+
+  test("a quoted phrase keeps its spaces", () => {
+    const filter: LogFilter = queryStringToFilter('"out of memory"');
+
+    expect((filter.body as Search<string>).toString()).toBe("out of memory");
+  });
+
+  test("a URL is free text, not a filter on a field called https", () => {
+    const filter: LogFilter = queryStringToFilter("https://example.com/x");
+
+    expect(filter.attributes).toBeUndefined();
+    expect((filter.body as Search<string>).toString()).toBe(
+      "https://example.com/x",
+    );
+  });
 });
 
 describe("queryStringToFilter - combinations", () => {
   test("a field filter plus trailing free text populate distinct slots", () => {
     const filter: LogFilter = queryStringToFilter("severity:error timeout");
+
     expect(filter.severityText).toBe("Error");
-    expect(filter.body).toBeInstanceOf(Search);
+    expect((filter.body as Search<string>).toString()).toBe("timeout");
+  });
+
+  test("the customer's whole query", () => {
+    const filter: LogFilter = queryStringToFilter(
+      "severity:error @platform.team:a* -@http.method:GET timeout",
+    );
+
+    expect(filter.severityText).toBe("Error");
+    expect(
+      (filter.attributes!["platform.team"] as Wildcard<string>).toPatterns(),
+    ).toEqual(["a%"]);
+    expect(filter.attributes!["http.method"]).toBeInstanceOf(NotEqual);
     expect((filter.body as Search<string>).toString()).toBe("timeout");
   });
 });

package/Tests/Types/Monitor/KubernetesTemplateGroupByKeys.test.ts

@@ -0,0 +1,225 @@
+import {
+  KubernetesAlertTemplate,
+  KubernetesAlertTemplateArgs,
+  getAllKubernetesAlertTemplates,
+} from "../../../Types/Monitor/KubernetesAlertTemplates";
+import MonitorStep from "../../../Types/Monitor/MonitorStep";
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * Guard test for per-series alerting on the SHIPPED Kubernetes templates.
+ *
+ * A monitor is treated as per-series purely from configuration —
+ * MonitorStep.getGroupByAttributeKeys(step).length > 0, the same answer
+ * the telemetry worker uses to build the series breakdown. So a template
+ * that forgets its group-by key is not a cosmetic miss: the monitor
+ * created from it raises ONE alert for the whole cluster, and every other
+ * unhealthy node/pod/deployment after the first dedupes silently behind
+ * that alert for as long as it stays open.
+ *
+ * The expectation below is therefore an explicit, per-template decision
+ * rather than a rule, and both directions matter:
+ *
+ *   - Grouped templates must carry the RIGHT key. It is the
+ *     ClickHouse-stored attribute name, so it carries the `resource.`
+ *     prefix that OtelMetricsIngestService stamps on OTel resource
+ *     attributes. A bare `k8s.node.name` matches nothing and collapses
+ *     the fleet into one mislabeled series that still renders and still
+ *     alerts — a silent failure, not a loud one.
+ *
+ *   - Cluster-scalar templates must stay UNGROUPED. etcd leadership, API
+ *     server throttling and scheduler queue depth are one value for the
+ *     cluster; splitting them invents series that do not exist.
+ */
+
+interface TemplateGroupByCase {
+  id: string;
+  // [] means "deliberately whole-cluster".
+  groupByKeys: Array<string>;
+  why: string;
+}
+
+const EXPECTED_GROUP_BY: Array<TemplateGroupByCase> = [
+  {
+    id: "k8s-crashloopbackoff",
+    groupByKeys: ["resource.k8s.pod.name"],
+    why: "restarts belong to one pod's containers",
+  },
+  {
+    id: "k8s-pod-pending",
+    groupByKeys: [],
+    why: "cluster-wide count of unschedulable pods; pending pod names are ephemeral",
+  },
+  {
+    id: "k8s-node-not-ready",
+    groupByKeys: ["resource.k8s.node.name"],
+    why: "one incident per NotReady node",
+  },
+  {
+    id: "k8s-high-cpu",
+    groupByKeys: ["resource.k8s.node.name"],
+    why: "per-node CPU utilization ratio",
+  },
+  {
+    id: "k8s-high-memory",
+    groupByKeys: ["resource.k8s.node.name"],
+    why: "per-node memory utilization ratio",
+  },
+  {
+    id: "k8s-deployment-replica-mismatch",
+    groupByKeys: ["resource.k8s.deployment.name"],
+    why: "a stuck rollout belongs to one Deployment object",
+  },
+  {
+    id: "k8s-job-failures",
+    groupByKeys: ["resource.k8s.job.name"],
+    why: "one failing Job must not hide the next",
+  },
+  {
+    id: "k8s-etcd-no-leader",
+    groupByKeys: [],
+    why: "etcd leadership is a cluster-scalar fact",
+  },
+  {
+    id: "k8s-apiserver-throttling",
+    groupByKeys: [],
+    why: "control-plane aggregate; no per-instance identity on this metric",
+  },
+  {
+    id: "k8s-scheduler-backlog",
+    groupByKeys: [],
+    why: "scheduler queue depth is one number for the cluster",
+  },
+  {
+    id: "k8s-high-disk-usage",
+    groupByKeys: ["resource.k8s.node.name"],
+    why: "disk fills one node at a time; the fleet Avg would dilute it away",
+  },
+  {
+    id: "k8s-daemonset-unavailable",
+    groupByKeys: ["resource.k8s.daemonset.name"],
+    why: "the incident names one DaemonSet",
+  },
+  {
+    id: "k8s-node-cpu-request-utilization",
+    groupByKeys: ["resource.k8s.node.name"],
+    why: "per-node scheduling commitment",
+  },
+  {
+    id: "k8s-node-memory-request-utilization",
+    groupByKeys: ["resource.k8s.node.name"],
+    why: "per-node scheduling commitment",
+  },
+  {
+    id: "k8s-hpa-at-max-replicas",
+    groupByKeys: ["resource.k8s.hpa.name"],
+    why: "saturation belongs to one HPA object",
+  },
+  {
+    id: "k8s-pod-memory-limit-saturation",
+    groupByKeys: ["resource.k8s.pod.name"],
+    why: "the pod about to be OOMKilled is the one to page on",
+  },
+  {
+    id: "k8s-pod-cpu-limit-saturation",
+    groupByKeys: ["resource.k8s.pod.name"],
+    why: "the throttled pod is the one to page on",
+  },
+];
+
+function buildArgs(): KubernetesAlertTemplateArgs {
+  return {
+    clusterIdentifier: "prod-cluster",
+    onlineMonitorStatusId: ObjectID.generate(),
+    offlineMonitorStatusId: ObjectID.generate(),
+    defaultIncidentSeverityId: ObjectID.generate(),
+    defaultAlertSeverityId: ObjectID.generate(),
+    monitorName: "Test Monitor",
+  };
+}
+
+describe("KubernetesAlertTemplates - per-series group-by keys", () => {
+  test("every shipped template has a declared group-by expectation", () => {
+    const shippedIds: Array<string> = getAllKubernetesAlertTemplates()
+      .map((t: KubernetesAlertTemplate) => {
+        return t.id;
+      })
+      .sort();
+
+    const expectedIds: Array<string> = EXPECTED_GROUP_BY.map(
+      (tc: TemplateGroupByCase) => {
+        return tc.id;
+      },
+    ).sort();
+
+    /*
+     * A new template added without a decision here would otherwise ship
+     * ungrouped by default and quietly alert once for a whole fleet.
+     */
+    expect(shippedIds).toEqual(expectedIds);
+  });
+
+  test.each(EXPECTED_GROUP_BY)(
+    "$id groups by $groupByKeys ($why)",
+    (tc: TemplateGroupByCase) => {
+      const template: KubernetesAlertTemplate | undefined =
+        getAllKubernetesAlertTemplates().find((t: KubernetesAlertTemplate) => {
+          return t.id === tc.id;
+        });
+      expect(template).toBeDefined();
+
+      const step: MonitorStep = template!.getMonitorStep(buildArgs());
+
+      expect(MonitorStep.getGroupByAttributeKeys(step)).toEqual(tc.groupByKeys);
+
+      /*
+       * getGroupByAttributeKeys unions across queryConfigs, so a ratio
+       * template whose two queries disagreed would still look grouped
+       * here while its formula series failed to join. Assert the key set
+       * on EVERY query instead.
+       */
+      for (const queryConfig of (step.data?.kubernetesMonitor?.metricViewConfig
+        ?.queryConfigs || []) as Array<any>) {
+        expect(queryConfig.metricQueryData.groupByAttributeKeys || []).toEqual(
+          tc.groupByKeys,
+        );
+      }
+    },
+  );
+
+  test.each(
+    EXPECTED_GROUP_BY.filter((tc: TemplateGroupByCase) => {
+      return tc.groupByKeys.length > 0;
+    }),
+  )(
+    "$id groups by a resource-prefixed attribute key",
+    (tc: TemplateGroupByCase) => {
+      for (const key of tc.groupByKeys) {
+        /*
+         * The `resource.` prefix is load-bearing: OTel resource
+         * attributes are stored prefixed, so a bare `k8s.pod.name` would
+         * match nothing and every pod would collapse into one series.
+         */
+        expect(key.startsWith("resource.k8s.")).toBe(true);
+      }
+    },
+  );
+
+  test("grouped templates are the majority of the shipped set", () => {
+    const grouped: number = EXPECTED_GROUP_BY.filter(
+      (tc: TemplateGroupByCase) => {
+        return tc.groupByKeys.length > 0;
+      },
+    ).length;
+
+    /*
+     * Not a style rule — a regression tripwire. This file shipped with
+     * only the four ratio templates grouped; if a refactor drops the
+     * group-by plumbing from buildKubernetesMonitorConfig, every
+     * single-query template silently reverts to whole-cluster alerting
+     * and this count falls back toward four.
+     */
+    expect(grouped).toBe(13);
+    expect(EXPECTED_GROUP_BY.length - grouped).toBe(4);
+  });
+});