Merge pull request #1408 from jertel/jertel/fix1193

fix collision of  rule option

CHANGELOG.md

@@ -1,7 +1,7 @@
 # 2.TBD.TBD
 
 ## Breaking changes
-- None
+- Renamed PR #1193's `fields` common rule option to `include_fields` due to collision with `new_term` rule type's existing `field` parameter - [#1408](https://github.com/jertel/elastalert2/pull/1408) - @jertel
 
 ## New features
 - None

docs/source/ruletypes.rst

@@ -118,7 +118,7 @@ Rule Configuration Cheat Sheet
 +--------------------------------------------------------------+           |
 | ``include`` (list of strs, default ["*"])                    |           |
 +--------------------------------------------------------------+           |
-| ``fields`` (list of strs, no default)                        |           |
+| ``include_fields`` (list of strs, no default)                |           |
 +--------------------------------------------------------------+           |
 | ``filter`` (ES filter DSL, no default)                       |           |
 +--------------------------------------------------------------+           |
@@ -605,10 +605,10 @@ include
 fields, along with '@timestamp', ``query_key``, ``compare_key``, and ``top_count_keys``  are included, if present.
 (Optional, list of strings, default all fields)
 
-fields
-^^^^^^
+include_fields
+^^^^^^^^^^^^^^
 
-``fields``: A list of fields that should be included in query results and passed to rule types and alerts. If ``_source_enabled`` is False,
+``include_fields``: A list of fields that should be included in query results and passed to rule types and alerts. If ``_source_enabled`` is False,
 only these fields and those from ``include`` are included.  When ``_source_enabled`` is True, these are in addition to source.  This is used
 for runtime fields, script fields, etc.  This only works with Elasticsearch version 7.11 and newer.  (Optional, list of strings, no default)
 

elastalert/elastalert.py

@@ -366,8 +366,8 @@ def get_hits(self, rule, starttime, endtime, index, scroll=False):
             query['stored_fields'] = rule['include']
             extra_args = {}
 
-        if rule.get('fields', None) is not None:
-            query['fields'] = rule['fields']
+        if rule.get('include_fields', None) is not None:
+            query['fields'] = rule['include_fields']
 
         try:
             if scroll:

elastalert/loaders.py

@@ -361,7 +361,7 @@ def load_options(self, rule, conf, filename, args=None):
         rule.setdefault('description', "")
         rule.setdefault('jinja_root_name', "_data")
         rule.setdefault('query_timezone', "")
-        rule.setdefault('fields', None)
+        rule.setdefault('include_fields', None)
 
         # Set timestamp_type conversion function, used when generating queries and processing hits
         rule['timestamp_type'] = rule['timestamp_type'].strip().lower()
@@ -408,8 +408,8 @@ def _dt_to_ts_with_format(dt):
         if 'include' in rule and type(rule['include']) != list:
             raise EAException('include option must be a list')
 
-        if 'fields' in rule and rule['fields'] is not None and type(rule['fields']) != list:
-            raise EAException('fields option must be a list')
+        if 'include_fields' in rule and rule['include_fields'] is not None and type(rule['include_fields']) != list:
+            raise EAException('include_fields option must be a list')
 
         raw_query_key = rule.get('query_key')
         if isinstance(raw_query_key, list):

elastalert/schema.yaml

@@ -270,7 +270,7 @@ properties:
     items: *filter
 
   include: {type: array, items: {type: string}}
-  fields: {type: array, item: {type: string}}
+  include_fields: {type: array, item: {type: string}}
   top_count_keys: {type: array, items: {type: string}}
   top_count_number: {type: integer}
   raw_count_keys: {type: boolean}

tests/base_test.py

@@ -112,8 +112,8 @@ def test_query_with_stored_fields(ea):
         size=ea.rules[0]['max_query_size'], scroll=ea.conf['scroll_keepalive'])
 
 
-def test_query_with_fields(ea):
-    ea.rules[0]['fields'] = ['test_runtime_field']
+def test_query_with_include_fields(ea):
+    ea.rules[0]['include_fields'] = ['test_runtime_field']
     ea.thread_data.current_es.search.return_value = {'hits': {'total': {'value': 0}, 'hits': []}}
     ea.run_query(ea.rules[0], START, END)
     ea.thread_data.current_es.search.assert_called_with(body={

tests/loaders_test.py

@@ -46,7 +46,7 @@
              'email': '[email protected]',
              'aggregation': {'hours': 2},
              'include': ['comparekey', '@timestamp'],
-             'fields': ['test_runtime_field']}
+             'include_fields': ['test_runtime_field']}
 
 test_args = mock.Mock()
 test_args.config = 'test_config'
@@ -276,8 +276,8 @@ def test_load_rules():
                 assert isinstance(rules['rules'][0]['alert'][0], elastalert.alerts.Alerter)
                 assert isinstance(rules['rules'][0]['timeframe'], datetime.timedelta)
                 assert isinstance(rules['run_every'], datetime.timedelta)
-                assert isinstance(rules['rules'][0]['fields'], list)
-                assert 'test_runtime_field' in rules['rules'][0]['fields']
+                assert isinstance(rules['rules'][0]['include_fields'], list)
+                assert 'test_runtime_field' in rules['rules'][0]['include_fields']
                 for included_key in ['comparekey', 'testkey', '@timestamp']:
                     assert included_key in rules['rules'][0]['include']
 
@@ -368,7 +368,7 @@ def test_load_disabled_rules():
 def test_raises_on_missing_config():
     optional_keys = (
         'aggregation', 'use_count_query', 'query_key', 'compare_key', 'filter', 'include', 'es_host', 'es_port',
-        'name', 'fields'
+        'name', 'include_fields'
     )
     test_rule_copy = copy.deepcopy(test_rule)
     for key in list(test_rule_copy.keys()):