Make condition work with numeric values as strings. (#38080)

elastic · Feb 22, 2024 · d762071 · d762071
1 parent 8ea5411
commit d762071
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 31 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -132,6 +132,7 @@ Setting environmental variable ELASTIC_NETINFO:false in Elastic Agent pod will d
 - Upgrade to elastic-agent-libs v0.7.3 and golang.org/x/crypto v0.17.0. {pull}37544[37544]
 - Make more selective the Pod autodiscovery upon node and namespace update events. {issue}37338[37338] {pull}37431[37431]
 - Upgrade go-sysinfo from 1.12.0 to 1.13.1. {pull}37996[37996]
+- Make `range` condition work with numeric values as strings. {pull}38080[38080]
 
 *Auditbeat*
 

diff --git a/libbeat/conditions/range.go b/libbeat/conditions/range.go
@@ -19,7 +19,6 @@ package conditions
 
 import (
 	"fmt"
-	"reflect"
 	"strings"
 
 	"github.com/elastic/elastic-agent-libs/logp"
@@ -113,30 +112,13 @@ func (c Range) Check(event ValuesMap) bool {
 			return false
 		}
 
-		switch value.(type) {
-		case int, int8, int16, int32, int64:
-			intValue := reflect.ValueOf(value).Int()
-
-			if !checkValue(float64(intValue), rangeValue) {
-				return false
-			}
-
-		case uint, uint8, uint16, uint32, uint64:
-			uintValue := reflect.ValueOf(value).Uint()
-
-			if !checkValue(float64(uintValue), rangeValue) {
-				return false
-			}
-
-		case float64, float32:
-			floatValue := reflect.ValueOf(value).Float()
-
-			if !checkValue(floatValue, rangeValue) {
-				return false
-			}
+		floatValue, err := ExtractFloat(value)
+		if err != nil {
+			logp.L().Named(logName).Warnf(err.Error())
+			return false
+		}
 
-		default:
-			logp.L().Named(logName).Warnf("unexpected type %T in range condition.", value)
+		if !checkValue(floatValue, rangeValue) {
 			return false
 		}
 

diff --git a/libbeat/conditions/range_test.go b/libbeat/conditions/range_test.go
@@ -83,7 +83,8 @@ func TestMultipleOpenRangeConditionNegativeMatch(t *testing.T) {
 
 var procCPURangeConfig = &Config{
 	Range: &Fields{fields: map[string]interface{}{
-		"proc.cpu.total_p.gte": 0.5,
+		"proc.cpu.total_p.gte":     0.5,
+		"proc.cpu.total_p_str.gte": 0.5,
 	}},
 }
 
@@ -94,11 +95,12 @@ func TestOpenGteRangeConditionPositiveMatch(t *testing.T) {
 			"proc": mapstr.M{
 				"cmdline": "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdworker -s mdworker -c MDSImporterWorker -m com.apple.mdworker.single",
 				"cpu": mapstr.M{
-					"start_time": "09:19",
-					"system":     22,
-					"total":      66,
-					"total_p":    0.6,
-					"user":       44,
+					"start_time":  "09:19",
+					"system":      22,
+					"total":       66,
+					"total_p_str": "0.6",
+					"total_p":     0.6,
+					"user":        44,
 				},
 				"name":     "mdworker",
 				"pid":      44978,

diff --git a/libbeat/docs/processors-using.asciidoc b/libbeat/docs/processors-using.asciidoc
@@ -276,7 +276,7 @@ regexp:
 
 The `range` condition checks if the field is in a certain range of values. The
 condition supports `lt`, `lte`, `gt` and `gte`. The condition accepts only
-integer or float values.
+integer, float, or strings that can be converted to either of these as values.
 
 For example, the following condition checks for failed HTTP transactions by
 comparing the `http.response.code` field with 400.