Merge branch 'feat/14552-effective-query-backend' of github.com:Graylog2/graylog2-server into feat/14552-effective-query-backend

Author: zeeklop

changelog/unreleased/issue-14552.toml

@@ -0,0 +1,4 @@
+type = "added"
+message = "Add an extension point to display a read-only query preview beneath the Search Query on the event definition condition screen."
+
+issues = ["14552"]

graylog2-web-interface/src/components/event-definitions/event-definition-types/FilterForm.tsx

@@ -40,6 +40,7 @@ import type { RelativeTimeRangeWithEnd } from 'views/logic/queries/Query';
 import Search from 'views/logic/search/Search';
 import { extractDurationAndUnit } from 'components/common/TimeUnitInput';
 import { Alert, ButtonToolbar, ControlLabel, FormGroup, HelpBlock, Input } from 'components/bootstrap';
+import usePluginEntities from 'hooks/usePluginEntities';
 import RelativeTime from 'components/common/RelativeTime';
 import type { LookupTableParameterJson } from 'views/logic/parameters/LookupTableParameter';
 import LookupTableParameter from 'views/logic/parameters/LookupTableParameter';
@@ -179,6 +180,7 @@ const QueryParameters = ({ eventDefinition, onChange, userCanViewLookupTables, v
 const FilterForm = ({ currentUser, eventDefinition, onChange, streams, validation }: Props) => {
   const { execute_every_ms: executeEveryMs, search_within_ms: searchWithinMs } = eventDefinition.config;
   const [currentConfig, setCurrentConfig] = useState(eventDefinition.config);
+  const searchQueryPreviews = usePluginEntities('eventDefinitions.components.searchQueryPreview') ?? [];
   const searchWithin = extractDurationAndUnit(searchWithinMs, TIME_UNITS);
   const executeEvery = extractDurationAndUnit(executeEveryMs, TIME_UNITS);
   const { userTimezone } = useUserDateTime();
@@ -553,6 +555,14 @@ const FilterForm = ({ currentUser, eventDefinition, onChange, streams, validatio
         </FormGroup>
       )}
 
+      {/* Extension point (filled by the enterprise search-filters plugin) for a read-only preview of the
+          effective query beneath the Search Query. Scoped (Illuminate) definitions hide the base query, so
+          the preview is not rendered for them. */}
+      {onlyFilters ||
+        searchQueryPreviews.map(({ component: SearchQueryPreview, key }) => (
+          <SearchQueryPreview key={key} queryString={currentConfig.query ?? ''} filters={currentConfig.filters ?? []} />
+        ))}
+
       {onlyFilters || (
         <QueryParameters
           eventDefinition={eventDefinition}

graylog2-web-interface/src/components/event-definitions/types.ts

@@ -19,7 +19,7 @@ import type React from 'react';
 
 import type { SearchBarControl } from 'views/types';
 import type User from 'logic/users/User';
-import type { EventDefinition } from 'components/event-definitions/event-definitions-types';
+import type { EventDefinition, SearchFilter } from 'components/event-definitions/event-definitions-types';
 import type { Attribute } from 'stores/PaginationTypes';
 
 export type AlertType = 'alert' | 'event' | 'event_definition';
@@ -105,5 +105,9 @@ declare module 'graylog-web-plugin/plugin' {
     'eventDefinitions.components.sigmaGitImport'?: Array<{ component: React.FC; key: string }>;
     'eventDefinitions.components.sigmaFileUpload'?: Array<{ component: React.FC; key: string }>;
     'eventDefinitions.components.sigmaOptions'?: Array<{ component: React.FC; key: string }>;
+    'eventDefinitions.components.searchQueryPreview'?: Array<{
+      component: React.ComponentType<{ queryString: string; filters: SearchFilter[] }>;
+      key: string;
+    }>;
   }
 }