From 8f9a02e37d1810abbebbd08cb4890a33571b1e1f Mon Sep 17 00:00:00 2001
From: Frank Hassanabad <frank.hassanabad@elastic.co>
Date: Fri, 31 Jul 2020 08:52:27 -0600
Subject: [PATCH] [SIEM] Fixes a bug where invalid regular expressions within
 the index patterns can cause UI toaster errors (#73754)

## Summary

https://github.com/elastic/kibana/issues/49753

When you have no data you get a toaster error when we don't want a toaster error.

Before with the toaster error:
![error](https://user-images.githubusercontent.com/1151048/88860918-0e2a5900-d1ba-11ea-95e7-5ed7324fc831.png)

After:
You don't get an error toaster because I catch any regular expression errors and do not report them up to the UI.

### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
---
 .../server/utils/beat_schema/index.test.ts         |  7 +++++++
 .../server/utils/beat_schema/index.ts              | 14 ++++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/x-pack/plugins/security_solution/server/utils/beat_schema/index.test.ts b/x-pack/plugins/security_solution/server/utils/beat_schema/index.test.ts
index 56ceca2b70e9c..5f002aa7fad7b 100644
--- a/x-pack/plugins/security_solution/server/utils/beat_schema/index.test.ts
+++ b/x-pack/plugins/security_solution/server/utils/beat_schema/index.test.ts
@@ -401,10 +401,17 @@ describe('Schema Beat', () => {
       const result = getIndexAlias([leadingWildcardIndex], leadingWildcardIndex);
       expect(result).toBe(leadingWildcardIndex);
     });
+
     test('getIndexAlias no match returns "unknown" string', () => {
       const index = 'auditbeat-*';
       const result = getIndexAlias([index], 'hello');
       expect(result).toBe('unknown');
     });
+
+    test('empty index should not cause an error to return although it will cause an invalid regular expression to occur', () => {
+      const index = '';
+      const result = getIndexAlias([index], 'hello');
+      expect(result).toBe('unknown');
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/server/utils/beat_schema/index.ts b/x-pack/plugins/security_solution/server/utils/beat_schema/index.ts
index ff7331cf39bc7..6ec15d328714d 100644
--- a/x-pack/plugins/security_solution/server/utils/beat_schema/index.ts
+++ b/x-pack/plugins/security_solution/server/utils/beat_schema/index.ts
@@ -77,10 +77,16 @@ const convertFieldsToAssociativeArray = (
     : {};
 
 export const getIndexAlias = (defaultIndex: string[], indexName: string): string => {
-  const found = defaultIndex.find((index) => `\\${indexName}`.match(`\\${index}`) != null);
-  if (found != null) {
-    return found;
-  } else {
+  try {
+    const found = defaultIndex.find((index) => `\\${indexName}`.match(`\\${index}`) != null);
+    if (found != null) {
+      return found;
+    } else {
+      return 'unknown';
+    }
+  } catch (error) {
+    // if we encounter an error because the index contains invalid regular expressions then we should return an unknown
+    // rather than blow up with a toaster error upstream
     return 'unknown';
   }
 };