feat: audit and auto-capitalize searches

package.json

@@ -120,7 +120,7 @@
     "@kbn/test-subj-selector": "0.2.1",
     "@kbn/ui-framework": "1.0.0",
     "@logrhythm/icons": "^1.19.0",
-    "@logrhythm/nm-web-shared": "^1.8.1",
+    "@logrhythm/nm-web-shared": "^1.10.0",
     "@logrhythm/webui": "^5.9.15",
     "@types/json-stable-stringify": "^1.0.32",
     "@types/lodash.clonedeep": "^4.5.4",

src/legacy/core_plugins/data/public/query_bar/components/query_bar.tsx

@@ -33,6 +33,9 @@ import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiLink, EuiSuperDatePicker } fro
 import { EuiSuperUpdateButton } from '@elastic/eui';
 
 import { FormattedMessage, InjectedIntl, injectI18n } from '@kbn/i18n/react';
+
+import { convertQuery } from '@logrhythm/nm-web-shared/services/query_mapping';
+
 import { documentationLinks } from 'ui/documentation_links';
 import { Toast, toastNotifications } from 'ui/notify';
 import chrome from 'ui/chrome';
@@ -202,7 +205,7 @@ export class QueryBarUI extends Component<Props, State> {
     );
   };
 
-  public onSubmit = (preventDefault?: () => void) => {
+  public onSubmit = async (preventDefault?: () => void) => {
     if (preventDefault) {
       preventDefault();
     }
@@ -214,16 +217,35 @@ export class QueryBarUI extends Component<Props, State> {
       to: this.state.dateRangeTo,
     });
 
-    this.props.onSubmit({
-      query: {
-        query: this.state.query.query,
-        language: this.state.query.language,
-      },
-      dateRange: {
-        from: this.state.dateRangeFrom,
-        to: this.state.dateRangeTo,
+    let convertedQuery: string = this.state.query.query;
+    try {
+      convertedQuery = await convertQuery(this.state.query.query);
+    } catch (err) {
+      console.warn( // eslint-disable-line
+        'An error occurred trying to correct the provided query for capitalization.',
+        err
+      );
+    }
+
+    this.setState(
+      s => {
+        const newState = { ...s };
+        newState.query.query = convertedQuery;
+        return newState;
       },
-    });
+      () => {
+        this.props.onSubmit({
+          query: {
+            query: this.state.query.query,
+            language: this.state.query.language,
+          },
+          dateRange: {
+            from: this.state.dateRangeFrom,
+            to: this.state.dateRangeTo,
+          },
+        });
+      }
+    );
   };
 
   private onInputSubmit = (query: Query) => {
@@ -232,8 +254,40 @@ export class QueryBarUI extends Component<Props, State> {
     });
   };
 
-  public componentDidMount() {
+  public async componentDidMount() {
     this.persistedLog = getQueryLog(this.props.appName, this.props.query.language);
+
+    const oldQuery = this.state.query.query;
+    try {
+      const convertedQuery = await convertQuery(this.state.query.query);
+      if (oldQuery === convertedQuery) {
+        return;
+      }
+      this.setState(
+        s => {
+          const newState = { ...s };
+          newState.query.query = convertedQuery;
+          return newState;
+        },
+        () => {
+          this.props.onSubmit({
+            query: {
+              query: this.state.query.query,
+              language: this.state.query.language,
+            },
+            dateRange: {
+              from: this.state.dateRangeFrom,
+              to: this.state.dateRangeTo,
+            },
+          });
+        }
+      );
+    } catch (err) {
+      console.warn( // eslint-disable-line
+        'An error occurred trying to correct the provided query for capitalization.',
+        err
+      );
+    }
   }
 
   public componentDidUpdate(prevProps: Props) {

src/legacy/ui/public/courier/fetch/fetch_now.js

@@ -24,6 +24,11 @@ import { ContinueIncompleteProvider } from './continue_incomplete';
 import { RequestStatus } from './req_status';
 import { i18n } from '@kbn/i18n';
 
+import moment from 'moment';
+import { auditSearch } from '@logrhythm/nm-web-shared/services/audit';
+
+const auditTimeFormat = 'YYYY/MM/DD HH:mm:ss';
+
 /**
  * Fetch now provider should be used if you want the results searched and returned immediately.
  * This can be slightly inefficient if a large number of requests are queued up, we can batch these
@@ -106,7 +111,47 @@ export function FetchNowProvider(Private, Promise) {
       });
   }
 
+  async function auditFetch(searchSource) {
+    const searchSourceFields = searchSource.getFields();
+
+    let queryToAudit = '';
+    if(Array.isArray(searchSourceFields.query)) {
+      queryToAudit = searchSourceFields.query[searchSourceFields.query.length - 1].query || '';
+    } else {
+      queryToAudit = searchSourceFields.query.query || '';
+    }
+
+    const dateFilter = Object.values(searchSource.getParent().getFields().filter().range)[0];
+
+    if (
+      !queryToAudit ||
+      queryToAudit.trim() === '*' ||
+      !dateFilter ||
+      !dateFilter.gte ||
+      !dateFilter.lte
+    ) {
+      return;
+    }
+
+    const formattedFrom = moment(dateFilter.gte).format(auditTimeFormat);
+    const formattedTo = moment(dateFilter.lte).format(auditTimeFormat);
+
+    await auditSearch({
+      query: queryToAudit,
+      from: formattedFrom,
+      to: formattedTo
+    });
+  }
+
   function startRequests(searchRequests) {
+    if(searchRequests.length > 0) {
+      try {
+        auditFetch(searchRequests[0].source);
+      } catch (err) {
+        console.warn('An error occurred trying to audit the query.', err); // eslint-disable-line
+      }
+    }
+
     return Promise.map(searchRequests, function (searchRequest) {
       if (searchRequest === ABORTED) {
         return searchRequest;

yarn.lock

@@ -1767,10 +1767,10 @@
   resolved "https://logrhythm.jfrog.io/logrhythm/api/npm/npm-virtual/@logrhythm/lucene-parser/-/@logrhythm/lucene-parser-3.4.0.tgz#19274929b73c83713c3597febe71a0c62ff2a5e9"
   integrity sha1-GSdJKbc8g3E8NZf+vnGgxi/ypek=
 
-"@logrhythm/nm-web-shared@^1.8.1":
-  version "1.8.1"
-  resolved "https://logrhythm.jfrog.io/logrhythm/api/npm/npm-virtual/@logrhythm/nm-web-shared/-/@logrhythm/nm-web-shared-1.8.1.tgz#2e0129b1b01a4ee8ef7f2cf0537590f2d4447e85"
-  integrity sha1-LgEpsbAaTujvfyzwU3WQ8tREfoU=
+"@logrhythm/nm-web-shared@^1.10.0":
+  version "1.10.0"
+  resolved "https://logrhythm.jfrog.io/logrhythm/api/npm/npm-virtual/@logrhythm/nm-web-shared/-/@logrhythm/nm-web-shared-1.10.0.tgz#7d8686afd3571f536cba0fc36a5625deafd3fae7"
+  integrity sha1-fYaGr9NXH1Nsug/DalYl3q/T+uc=
 
 "@logrhythm/webui@^5.9.15":
   version "5.9.15"