---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- requires:
    cluster_features:
    - "gte_v8.11.0"
    reason: "ESQL is available in 8.11+"
    test_runner_features: "allowed_warnings_regex"
- do:
    indices.create:
      index: "networks"
      body:
        settings:
          index.number_of_shards: 1
          index.routing.rebalance.enable: "none"
        mappings:
          properties:
            range:
              type: "ip_range"
            name:
              type: "keyword"
            department:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      index: "networks"
      refresh: true
      body:
      - index: {}
      - range: "10.100.0.0/16"
        name: "Production"
        department: "OPS"
      - index: {}
      - range: "10.101.0.0/16"
        name: "QA"
        department: "Engineering"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    cluster.health:
      wait_for_no_initializing_shards: true
      wait_for_events: "languid"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    enrich.put_policy:
      name: "networks-policy"
      body:
        range:
          indices:
          - "networks"
          match_field: "range"
          enrich_fields:
          - "name"
          - "department"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    enrich.execute_policy:
      name: "networks-policy"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "events"
      body:
        mappings:
          properties:
            '@timestamp':
              type: "date"
            ip:
              type: "ip"
            message:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      index: "events"
      refresh: true
      body:
      - index: {}
      - '@timestamp': "2023-06-20"
        ip: "10.100.0.21"
        message: "network connected"
      - index: {}
      - '@timestamp': "2023-06-21"
        ip:
        - "10.100.0.21"
        - "10.101.0.107"
        message: "sending messages"
      - index: {}
      - '@timestamp': "2023-06-22"
        ip: "10.101.0.107"
        message: "network disconnected"
      - index: {}
      - '@timestamp': "2023-06-24"
        ip: "13.101.0.114"
        message: "authentication failed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "events_text"
      body:
        mappings:
          properties:
            '@timestamp':
              type: "date"
            ip_text:
              type: "text"
            message:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      index: "events_text"
      refresh: true
      body:
      - index: {}
      - '@timestamp': "2023-06-20"
        ip_text: "10.100.0.21"
        message: "network connected"
      - index: {}
      - '@timestamp': "2023-06-21"
        ip_text:
        - "10.100.0.21"
        - "10.101.0.107"
        message: "sending messages"
      - index: {}
      - '@timestamp': "2023-06-22"
        ip_text: "10.101.0.107"
        message: "network disconnected"
      - index: {}
      - '@timestamp': "2023-06-24"
        ip_text: "13.101.0.114"
        message: "authentication failed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    enrich.delete_policy:
      name: "networks-policy"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
IP strings:
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events | eval ip_str = to_string(ip) | ENRICH networks-policy\
          \ ON ip_str | sort @timestamp | KEEP ip, name, department, message"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "ip"
- match:
    columns.0.type: "ip"
- match:
    columns.1.name: "name"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "department"
- match:
    columns.2.type: "keyword"
- match:
    columns.3.name: "message"
- match:
    columns.3.type: "keyword"
- length:
    values: 4
- match:
    values.0:
    - "10.100.0.21"
    - "Production"
    - "OPS"
    - "network connected"
- match:
    values.1:
    - - "10.100.0.21"
      - "10.101.0.107"
    - - "Production"
      - "QA"
    - - "OPS"
      - "Engineering"
    - "sending messages"
- match:
    values.2:
    - "10.101.0.107"
    - "QA"
    - "Engineering"
    - "network disconnected"
- match:
    values.3:
    - "13.101.0.114"
    - null
    - null
    - "authentication failed"
---
IP text fields:
- requires:
    cluster_features:
    - "gte_v8.14.0"
    reason: "ENRICH support for TEXT fields was added in 8.14.0"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events_text | ENRICH networks-policy ON ip_text | sort @timestamp\
          \ | KEEP ip_text, name, department, message"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "ip_text"
- match:
    columns.0.type: "text"
- match:
    columns.1.name: "name"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "department"
- match:
    columns.2.type: "keyword"
- match:
    columns.3.name: "message"
- match:
    columns.3.type: "keyword"
- length:
    values: 4
- match:
    values.0:
    - "10.100.0.21"
    - "Production"
    - "OPS"
    - "network connected"
- match:
    values.1:
    - - "10.100.0.21"
      - "10.101.0.107"
    - - "Production"
      - "QA"
    - - "OPS"
      - "Engineering"
    - "sending messages"
- match:
    values.2:
    - "10.101.0.107"
    - "QA"
    - "Engineering"
    - "network disconnected"
- match:
    values.3:
    - "13.101.0.114"
    - null
    - null
    - "authentication failed"
---
Invalid IP strings:
- skip:
    awaits_fix: "We switched from exceptions to null+warnings for ENRICH runtime errors"
- requires:
    capabilities:
    - method: "POST"
      path: "/_query"
      parameters:
      - "method"
      - "path"
      - "parameters"
      - "capabilities"
      capabilities:
      - "enrich_strict_range_types"
    reason: "Runtime range type checking was added"
    test_runner_features:
    - "capabilities"
    - "allowed_warnings_regex"
    - "warnings_regex"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - "Line (1:68|-1:-1): evaluation of \\[(ENRICH networks-policy ON ip_str|)\\]\
      \ failed, treating result as null. Only first 20 failures recorded."
    - "Line (1:68|-1:-1): java.lang.IllegalArgumentException: 'invalid_' is not an\
      \ IP string literal."
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events | eval ip_str = mv_concat(\"invalid_\", to_string(ip))\
          \ | ENRICH networks-policy ON ip_str | sort @timestamp | KEEP ip, name,\
          \ department, message"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "ip"
- match:
    columns.0.type: "ip"
- match:
    columns.1.name: "name"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "department"
- match:
    columns.2.type: "keyword"
- match:
    columns.3.name: "message"
- match:
    columns.3.type: "keyword"
- length:
    values: 4
- match:
    values.0:
    - "10.100.0.21"
    - null
    - null
    - "network connected"
- match:
    values.1:
    - - "10.100.0.21"
      - "10.101.0.107"
    - null
    - null
    - "sending messages"
- match:
    values.2:
    - "10.101.0.107"
    - null
    - null
    - "network disconnected"
- match:
    values.3:
    - "13.101.0.114"
    - null
    - null
    - "authentication failed"
---
IP:
- requires:
    cluster_features:
    - "gte_v8.14.0"
    reason: "IP range ENRICH support was added in 8.14.0"
- do:
    allowed_warnings_regex:
    - "No limit defined, adding default limit of \\[.*\\]"
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
    esql.query:
      body:
        query: "FROM events | ENRICH networks-policy ON ip | sort @timestamp | KEEP\
          \ ip, name, department, message"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
- match:
    columns.0.name: "ip"
- match:
    columns.0.type: "ip"
- match:
    columns.1.name: "name"
- match:
    columns.1.type: "keyword"
- match:
    columns.2.name: "department"
- match:
    columns.2.type: "keyword"
- match:
    columns.3.name: "message"
- match:
    columns.3.type: "keyword"
- length:
    values: 4
- match:
    values.0:
    - "10.100.0.21"
    - "Production"
    - "OPS"
    - "network connected"
- match:
    values.1:
    - - "10.100.0.21"
      - "10.101.0.107"
    - - "Production"
      - "QA"
    - - "OPS"
      - "Engineering"
    - "sending messages"
- match:
    values.2:
    - "10.101.0.107"
    - "QA"
    - "Engineering"
    - "network disconnected"
- match:
    values.3:
    - "13.101.0.114"
    - null
    - null
    - "authentication failed"
