diff --git a/src/platform/packages/shared/kbn-es-query/src/utils.test.ts b/src/platform/packages/shared/kbn-es-query/src/utils.test.ts index b7ac39e4c7eec..e250286c9a1ee 100644 --- a/src/platform/packages/shared/kbn-es-query/src/utils.test.ts +++ b/src/platform/packages/shared/kbn-es-query/src/utils.test.ts @@ -30,5 +30,17 @@ describe('util tests', () => { it('should validate CCS pattern', () => { expect(isCCSRemoteIndexName('*:logstash-{now/d-2d}')).toBe(true); }); + + it('should not validate selector with wildcard', () => { + expect(isCCSRemoteIndexName('my-data-stream::*')).toBe(false); + }); + + it('should not validate index name with selector', () => { + expect(isCCSRemoteIndexName('my-data-stream::failures')).toBe(false); + }); + + it('should not validate wildcard with selector', () => { + expect(isCCSRemoteIndexName('-logs-*::data')).toBe(false); + }); }); }); diff --git a/src/platform/packages/shared/kbn-es-query/src/utils.ts b/src/platform/packages/shared/kbn-es-query/src/utils.ts index 7ac29bd085da8..905a15e4efab2 100644 --- a/src/platform/packages/shared/kbn-es-query/src/utils.ts +++ b/src/platform/packages/shared/kbn-es-query/src/utils.ts @@ -42,7 +42,7 @@ export function getDataViewFieldSubtypeMulti(field: HasSubtype) { * The index name is assumed to be individual index (no commas) but can contain `-`, wildcards, * datemath, remote cluster name and any other syntax permissible in index expression component. * - * 2024/10/11 Implementation taken from https://github.com/smalyshev/elasticsearch/blob/main/server/src/main/java/org/elasticsearch/transport/RemoteClusterAware.java + * 2025/01/21 Implementation taken from https://github.com/smalyshev/elasticsearch/blob/main/server/src/main/java/org/elasticsearch/transport/RemoteClusterAware.java * * @param indexExpression */ @@ -52,6 +52,11 @@ export function isCCSRemoteIndexName(indexExpression: string): boolean { // Thus, whatever it is, this is definitely not a remote index. return false; } + + const idx = indexExpression.indexOf(':'); + // Check to make sure the remote cluster separator ':' isn't actually a selector separator '::' + const isSelector = indexExpression.startsWith('::', idx); + // Note remote index name also can not start with ':' - return indexExpression.indexOf(':') > 0; + return idx > 0 && !isSelector; }