elastic / elastic/detection-rules
[DaC] additional line break added to query after export/import
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
### Command or doc area
- [x] `kibana export-rules` / `kibana import-rules`
- [x] `import-rules-to-repo`
- [ ] `export-rules-from-repo`
- [ ] Other DaC CLI command (name it in the field below)
- [ ] Documentation in this repo only (link the page/section below)
### Other command name or doc link
_No response_
### Summary
If you export and import a rule, the query at the destination contains an additional line break (\n) at the end.
This might not impact the functionality but it shows up if you compare the rule at source and destination system. I also expect you will get multiple trailing newlines if you redo the procedure.
The issue for this can be found at the point where the query is saved to the toml file:
https://github.com/elastic/detection-rules/blob/36e6f54e43f15b7c6f0cb8636c4fdccc4257e9f5/detection_rules/rule_formatter.py#L294-L302
The original query is prefixed and suffixed with a line break (\n) before written to the toml file.
When the query is imported again, the toml parser removes the prefix newline but not the trailing one.
> Multi-line basic strings are surrounded by three quotation marks on each side and allow newlines. A newline immediately following the opening delimiter will be trimmed. All other whitespace and newline characters remain intact.
Source: https://github.com/toml-lang/toml/blob/main/toml.md
I would suggest to not add line breaks to the original query.
UPDATE:
I tested it locally and removed the surrounding newlines which worked well. But then an additional issue occurred.
I identified that already the query part is stripped, which leads to the fact that if a rule on the source system contains an "intentional" white space or new line at the end, will loose it on the target system.
https://github.com/elastic/detection-rules/blob/36e6f54e43f15b7c6f0cb8636c4fdccc4257e9f5/detection_rules/rule_formatter.py#L224-L232
Would be better if the query part is not touched to stay the same all the time.
### Expected vs actual
_No response_
### Environment (if relevant)
_No response_
### Reproduction (if applicable)
Export/Import a rule with a multiline query.
### Related issues (optional)
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.