elastic · kderusso · Jun 10, 2024 · May 23, 2024 · May 24, 2024 · May 24, 2024
diff --git a/docs/changelog/109042.yaml b/docs/changelog/109042.yaml
@@ -0,0 +1,5 @@
+pr: 109042
+summary: Add Create or update query rule API call
+area: Application
+type: enhancement
+issues: [ ]
diff --git a/rest-api-spec/src/main/resources/rest-api-spec/api/query_rule.put.json b/rest-api-spec/src/main/resources/rest-api-spec/api/query_rule.put.json
@@ -0,0 +1,42 @@
+{
+  "query_rule.put": {
+    "documentation": {
+      "url": "https://www.elastic.co/guide/en/elasticsearch/reference/master/put-query-rule.html",
+      "description": "Creates or updates a query rule within a ruleset."
+    },
+    "stability": "experimental",
+    "visibility": "public",
+    "headers": {
+      "accept": [
+        "application/json"
+      ],
+      "content_type": [
+        "application/json"
+      ]
+    },
+    "url": {
+      "paths": [
+        {
+          "path": "/_query_rules/{ruleset_id}/{rule_id}",
+          "methods": [
+            "PUT"
+          ],
+          "parts": {
+            "ruleset_id": {
+              "type": "string",
+              "description": "The unique identifier of the ruleset this rule should be added to. The ruleset will be created if it does not exist."
+            },
+            "rule_id": {
+              "type": "string",
+              "description": "The unique identifier of the rule to be created or updated."
+            }
+          }
+        }
+      ]
+    },
+    "body": {
+      "description": "The query rule configuration, including the type of rule, the criteria to match the rule, and the action that should be taken if the rule matches.",
+      "required": true
+    }
+  }
+}
diff --git a/server/src/main/java/org/elasticsearch/TransportVersions.java b/server/src/main/java/org/elasticsearch/TransportVersions.java
@@ -187,6 +187,7 @@ static TransportVersion def(int id) {
     public static final TransportVersion RANK_FEATURE_PHASE_ADDED = def(8_678_00_0);
     public static final TransportVersion RANK_DOC_IN_SHARD_FETCH_REQUEST = def(8_679_00_0);
     public static final TransportVersion SECURITY_SETTINGS_REQUEST_TIMEOUTS = def(8_680_00_0);
+    public static final TransportVersion QUERY_RULE_CRUD_API_PUT = def(8_681_00_0);
 
     /*
      * STOP! READ THIS FIRST! No, really,

diff --git a/x-pack/plugin/ent-search/qa/rest/build.gradle b/x-pack/plugin/ent-search/qa/rest/build.gradle
@@ -7,7 +7,20 @@ dependencies {
 
 restResources {
   restApi {
-    include '_common', 'bulk', 'cluster', 'connector', 'nodes', 'indices', 'index', 'query_ruleset', 'search_application', 'xpack', 'security', 'search', 'ml'
+    include '_common',
+      'bulk',
+      'cluster',
+      'connector',
+      'nodes',
+      'indices',
+      'index',
+      'query_ruleset',
+      'query_rule',
+      'search_application',
+      'xpack',
+      'security',
+      'search',
+      'ml'
   }
 }
 

diff --git a/...st/src/yamlRestTest/resources/rest-api-spec/test/entsearch/rules/10_query_ruleset_put.yml b/...st/src/yamlRestTest/resources/rest-api-spec/test/entsearch/rules/10_query_ruleset_put.yml
@@ -1,9 +1,20 @@
-
 setup:
   - requires:
-      cluster_features: ["gte_v8.10.0"]
+      cluster_features: [ "gte_v8.10.0" ]
       reason: Introduced in 8.10.0
 
+---
+teardown:
+  - do:
+      query_ruleset.delete:
+        ruleset_id: test-ruleset
+        ignore: 404
+
+  - do:
+      query_ruleset.delete:
+        ruleset_id: test-query-ruleset-recreating
+        ignore: 404
+
 ---
 'Create Query Ruleset':
   - do:
@@ -16,7 +27,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [elastic]
+                  values: [ elastic ]
               actions:
                 ids:
                   - 'id1'
@@ -26,7 +37,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [kibana]
+                  values: [ kibana ]
               actions:
                 docs:
                   - '_index': 'test-index1'
@@ -47,7 +58,7 @@ setup:
           criteria:
             - type: exact
               metadata: query_string
-              values: [elastic]
+              values: [ elastic ]
           actions:
             ids:
               - 'id1'
@@ -57,7 +68,7 @@ setup:
           criteria:
             - type: exact
               metadata: query_string
-              values: [kibana]
+              values: [ kibana ]
           actions:
             docs:
               - '_index': 'test-index1'
@@ -77,7 +88,7 @@ setup:
             criteria:
               type: 'exact'
               metadata: 'query_string'
-              values: ['elastic']
+              values: [ 'elastic' ]
             actions:
               ids:
                 - 'id1'
@@ -94,7 +105,7 @@ setup:
             criteria:
               type: 'exact'
               metadata: 'query_string'
-              values: ['elastic']
+              values: [ 'elastic' ]
             actions:
               ids:
                 - 'id2'
@@ -118,7 +129,7 @@ setup:
             criteria:
               type: 'exact'
               metadata: 'query_string'
-              values: ['elastic']
+              values: [ 'elastic' ]
             actions:
               ids:
                 - 'id1'

diff --git a/...t/src/yamlRestTest/resources/rest-api-spec/test/entsearch/rules/20_query_ruleset_list.yml b/...t/src/yamlRestTest/resources/rest-api-spec/test/entsearch/rules/20_query_ruleset_list.yml
@@ -1,6 +1,6 @@
 setup:
   - requires:
-      cluster_features: ["gte_v8.10.0"]
+      cluster_features: [ "gte_v8.10.0" ]
       reason: Introduced in 8.10.0
   - do:
       query_ruleset.put:
@@ -12,7 +12,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [elastic]
+                  values: [ elastic ]
               actions:
                 ids:
                   - 'id1'
@@ -22,7 +22,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [kibana]
+                  values: [ kibana ]
               actions:
                 ids:
                   - 'id3'
@@ -38,7 +38,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [elastic]
+                  values: [ elastic ]
               actions:
                 ids:
                   - 'id1'
@@ -48,7 +48,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [kibana]
+                  values: [ kibana ]
               actions:
                 ids:
                   - 'id3'
@@ -58,7 +58,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [logstash]
+                  values: [ logstash ]
               actions:
                 ids:
                   - 'id5'
@@ -74,7 +74,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [elastic]
+                  values: [ elastic ]
               actions:
                 ids:
                   - 'id1'
@@ -84,7 +84,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [kibana]
+                  values: [ kibana ]
               actions:
                 ids:
                   - 'id3'
@@ -94,7 +94,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [logstash]
+                  values: [ logstash ]
               actions:
                 ids:
                   - 'id5'
@@ -104,11 +104,32 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [beats]
+                  values: [ beats ]
               actions:
                 ids:
                   - 'id7'
                   - 'id8'
+---
+teardown:
+  - do:
+      query_ruleset.delete:
+        ruleset_id: test-query-ruleset-1
+        ignore: 404
+
+  - do:
+      query_ruleset.delete:
+        ruleset_id: test-query-ruleset-2
+        ignore: 404
+
+  - do:
+      query_ruleset.delete:
+        ruleset_id: test-query-ruleset-3
+        ignore: 404
+
+  - do:
+      query_ruleset.delete:
+        ruleset_id: a-test-query-ruleset-with-lots-of-criteria
+        ignore: 404
 
 ---
 "List Query Rulesets":
@@ -263,3 +284,16 @@ setup:
         prefix: 1
         suffix: 1
         always: 1
+
+---
+'List Query Rulesets - Insufficient privilege':
+  - skip:
+      features: headers
+
+  - do:
+      catch: forbidden
+      headers: { Authorization: "Basic ZW50c2VhcmNoLXVzZXI6ZW50c2VhcmNoLXVzZXItcGFzc3dvcmQ=" }  # user
+      query_ruleset.list: { }
+
+  - match: { error.type: 'security_exception' }
+
diff --git a/...src/yamlRestTest/resources/rest-api-spec/test/entsearch/rules/30_query_ruleset_delete.yml b/...src/yamlRestTest/resources/rest-api-spec/test/entsearch/rules/30_query_ruleset_delete.yml
@@ -1,6 +1,6 @@
 setup:
   - requires:
-      cluster_features: ["gte_v8.10.0"]
+      cluster_features: [ "gte_v8.10.0" ]
       reason: Introduced in 8.10.0
   - do:
       query_ruleset.put:
@@ -12,7 +12,7 @@ setup:
               criteria:
                 - type: exact
                   metadata: query_string
-                  values: [elastic]
+                  values: [ elastic ]
               actions:
                 ids:
                   - 'id1'
@@ -37,3 +37,16 @@ setup:
       catch: "missing"
       query_ruleset.delete:
         ruleset_id: test-nonexistent-query-ruleset
+
+---
+'Delete Query Ruleset - Insufficient privilege':
+  - skip:
+      features: headers
+
+  - do:
+      catch: forbidden
+      headers: { Authorization: "Basic ZW50c2VhcmNoLXVzZXI6ZW50c2VhcmNoLXVzZXItcGFzc3dvcmQ=" }  # user
+      query_ruleset.delete:
+        ruleset_id: test-query-ruleset-to-delete
+
+  - match: { error.type: 'security_exception' }
diff --git a/...st/src/yamlRestTest/resources/rest-api-spec/test/entsearch/rules/40_rule_query_search.yml b/...st/src/yamlRestTest/resources/rest-api-spec/test/entsearch/rules/40_rule_query_search.yml
@@ -98,6 +98,23 @@ setup:
                 ids:
                   - 'doc6'
 
+---
+teardown:
+  - do:
+      query_ruleset.delete:
+        ruleset_id: test-ruleset
+        ignore: 404
+
+  - do:
+      query_ruleset.delete:
+        ruleset_id: another-test-ruleset
+        ignore: 404
+
+  - do:
+      query_ruleset.delete:
+        ruleset_id: combined-ruleset
+        ignore: 404
+
 ---
 "Perform a rule query specifying a ruleset that does not exist":
   - do: