---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    headers:
      Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    ml.put_job:
      job_id: "custom-all-test-1"
      body: "{\n  \"description\":\"Job for testing custom all field\",\n  \"analysis_config\"\
        \ : {\n      \"detectors\" :[{\"function\":\"metric\",\"field_name\":\"responsetime\"\
        ,\"by_field_name\":\"airline\"}]\n  },\n  \"data_description\": {}\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    ml.put_job:
      job_id: "custom-all-test-2"
      body: "{\n  \"description\":\"Job for testing custom all field\",\n  \"analysis_config\"\
        \ : {\n      \"detectors\" :[{\"function\":\"metric\",\"field_name\":\"responsetime\"\
        ,\"by_field_name\":\"airline\"}]\n  },\n  \"data_description\": {}\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    index:
      index: ".ml-anomalies-custom-all-test-1-000001"
      id: "custom_all_1464739200000_1_1"
      body:
        job_id: "custom-all-test-1"
        result_type: "record"
        timestamp: "2016-06-01T00:00:00Z"
        anomaly_score: 60.0
        bucket_span: 1
        by_field_value: "A by field"
        partition_field_value: "A partition field"
        over_field_value: "An over field"
        influencer_field_name: "An influencer field"
        causes:
        - by_field_value: "Cause by field"
          partition_field_value: "Cause partition field"
          over_field_value: "Cause over field"
          correlated_by_field_value: "Cause correlated by field"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    index:
      index: ".ml-anomalies-custom-all-test-2-000001"
      id: "custom_all_1464739200000_1_2"
      body:
        job_id: "custom-all-test-2"
        result_type: "record"
        timestamp: "2016-06-01T00:00:00Z"
        bucket_span: 1
        by_field_value: "A by field"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    indices.refresh:
      index:
      - ".ml-anomalies*"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test querying custom all field:
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "A by field"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "A partition field"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "An over field"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "An influencer field"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "Cause by field"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "Cause partition field"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "Cause over field"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "Cause correlated by field"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
- do:
    search:
      rest_total_hits_as_int: true
      index: ".ml-anomalies-custom-all-test-1-000001"
      body:
        query:
          query_string:
            query: "custom-all-test-1"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 1
---
Test wildcard job id:
- do:
    search:
      index: ".ml-anomalies-custom-all-test-1-000001,.ml-anomalies-custom-all-test-2-000001"
      expand_wildcards: "all"
      rest_total_hits_as_int: true
      body:
        query:
          bool:
            must:
            - query_string:
                query: "result_type:record"
            - query_string:
                query: "A by field"
            - query_string:
                query: "job_id:*"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 2
