[8.15] [Custom threshold] Always pass allowLeadingWildcards as true t…

…o the KQL validation in the custom threshold rule API param validation (#190031) (#190494)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[Custom threshold] Always pass allowLeadingWildcards as true to the
KQL validation in the custom threshold rule API param validation
(#190031)](#190031)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Maryam
Saeidi","email":"maryam.saeidi@elastic.co"},"sourceCommit":{"committedDate":"2024-08-14T10:38:53Z","message":"[Custom
threshold] Always pass allowLeadingWildcards as true to the KQL
validation in the custom threshold rule API param validation
(#190031)\n\nFixes #189072\r\nRelated #190029\r\n\r\n##
Summary\r\n\r\nThis PR updates the KQL validation on the server side by
passing the\r\nKibana leadingWildcard setting as true during validation.
This means\r\nthat even if this configuration is disabled in Kibana, we
will still\r\nallow saving such a filter in the rule, but it will fail
during rule\r\nexecution.\r\nI've created a separate ticket to discuss
how to apply the KQL\r\nvalidation correctly during API param
validation.\r\n([issue](https://github.com/elastic/kibana/issues/190029))\r\n\r\nThis
fix will solve the following
issues:\r\n<img\r\nsrc=\"https://github.com/user-attachments/assets/d99177cb-d4cd-4f33-9a60-8575d87372e3\"\r\nwidth=500
/>\r\n\r\n\r\nWe also have [proper validation on the
UI\r\nside](https://github.com/elastic/kibana/blob/main/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/validation.tsx#L60,L64)\r\nthat
considers Kibana setting during validation:\r\n\r\n|Error|Leading
wildcard
error|\r\n|---|---|\r\n|\r\n![image](https://github.com/user-attachments/assets/81cfaea6-c932-4184-8f2f-0d06b267a986)|![image](https://github.com/user-attachments/assets/7719813d-ee7b-4eac-b04f-69a867a6dd89)|","sha":"ae4d522b52b2c3573c4e276bfd38ecec00d9ff96","branchLabelMapping":{"^v8.16.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","backport:prev-minor","ci:project-deploy-observability","Team:obs-ux-management","Feature:
Custom threshold","v8.16.0"],"title":"[Custom threshold] Always pass
allowLeadingWildcards as true to the KQL validation in the custom
threshold rule API param
validation","number":190031,"url":"https://github.com/elastic/kibana/pull/190031","mergeCommit":{"message":"[Custom
threshold] Always pass allowLeadingWildcards as true to the KQL
validation in the custom threshold rule API param validation
(#190031)\n\nFixes #189072\r\nRelated #190029\r\n\r\n##
Summary\r\n\r\nThis PR updates the KQL validation on the server side by
passing the\r\nKibana leadingWildcard setting as true during validation.
This means\r\nthat even if this configuration is disabled in Kibana, we
will still\r\nallow saving such a filter in the rule, but it will fail
during rule\r\nexecution.\r\nI've created a separate ticket to discuss
how to apply the KQL\r\nvalidation correctly during API param
validation.\r\n([issue](https://github.com/elastic/kibana/issues/190029))\r\n\r\nThis
fix will solve the following
issues:\r\n<img\r\nsrc=\"https://github.com/user-attachments/assets/d99177cb-d4cd-4f33-9a60-8575d87372e3\"\r\nwidth=500
/>\r\n\r\n\r\nWe also have [proper validation on the
UI\r\nside](https://github.com/elastic/kibana/blob/main/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/validation.tsx#L60,L64)\r\nthat
considers Kibana setting during validation:\r\n\r\n|Error|Leading
wildcard
error|\r\n|---|---|\r\n|\r\n![image](https://github.com/user-attachments/assets/81cfaea6-c932-4184-8f2f-0d06b267a986)|![image](https://github.com/user-attachments/assets/7719813d-ee7b-4eac-b04f-69a867a6dd89)|","sha":"ae4d522b52b2c3573c4e276bfd38ecec00d9ff96"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/190031","number":190031,"mergeCommit":{"message":"[Custom
threshold] Always pass allowLeadingWildcards as true to the KQL
validation in the custom threshold rule API param validation
(#190031)\n\nFixes #189072\r\nRelated #190029\r\n\r\n##
Summary\r\n\r\nThis PR updates the KQL validation on the server side by
passing the\r\nKibana leadingWildcard setting as true during validation.
This means\r\nthat even if this configuration is disabled in Kibana, we
will still\r\nallow saving such a filter in the rule, but it will fail
during rule\r\nexecution.\r\nI've created a separate ticket to discuss
how to apply the KQL\r\nvalidation correctly during API param
validation.\r\n([issue](https://github.com/elastic/kibana/issues/190029))\r\n\r\nThis
fix will solve the following
issues:\r\n<img\r\nsrc=\"https://github.com/user-attachments/assets/d99177cb-d4cd-4f33-9a60-8575d87372e3\"\r\nwidth=500
/>\r\n\r\n\r\nWe also have [proper validation on the
UI\r\nside](https://github.com/elastic/kibana/blob/main/x-pack/plugins/observability_solution/observability/public/components/custom_threshold/components/validation.tsx#L60,L64)\r\nthat
considers Kibana setting during validation:\r\n\r\n|Error|Leading
wildcard
error|\r\n|---|---|\r\n|\r\n![image](https://github.com/user-attachments/assets/81cfaea6-c932-4184-8f2f-0d06b267a986)|![image](https://github.com/user-attachments/assets/7719813d-ee7b-4eac-b04f-69a867a6dd89)|","sha":"ae4d522b52b2c3573c4e276bfd38ecec00d9ff96"}}]}]
BACKPORT-->

---------

Co-authored-by: Maryam Saeidi <maryam.saeidi@elastic.co>

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/register_custom_threshold_rule_type.ts

@@ -56,10 +56,10 @@ export const MetricsRulesTypeAlertDefinition: IRuleTypeAlerts<CustomThresholdAle
 export const searchConfigurationSchema = schema.object({
   index: schema.oneOf([schema.string(), dataViewSpecSchema]),
   query: schema.object({
-    language: schema.string({
+    language: schema.string(),
+    query: schema.string({
       validate: validateKQLStringFilter,
     }),
-    query: schema.string(),
   }),
   filter: schema.maybe(
     schema.arrayOf(

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/utils.ts

@@ -52,7 +52,11 @@ export const validateKQLStringFilter = (value: string) => {
   }
 
   try {
-    kbnBuildEsQuery(undefined, [{ query: value, language: 'kuery' }], []);
+    kbnBuildEsQuery(undefined, [{ query: value, language: 'kuery' }], [], {
+      allowLeadingWildcards: true,
+      queryStringOptions: {},
+      ignoreFilterIfFieldNotInIndex: false,
+    });
   } catch (e) {
     return i18n.translate('xpack.observability.customThreshold.rule.schema.invalidFilterQuery', {
       defaultMessage: 'filterQuery must be a valid KQL filter',