[es-query] Add indexPatternToCcs helper

src/platform/packages/shared/kbn-es-query/index.ts

@@ -116,6 +116,8 @@ export {
   BooleanRelation,
 } from './src/filters';
 
+export { indexPatternToCcs } from './src/indices';
+
 export {
   KQLSyntaxError,
   fromKueryExpression,

src/platform/packages/shared/kbn-es-query/src/indices/index.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+export { indexPatternToCcs } from './index_pattern_to_ccs';

src/platform/packages/shared/kbn-es-query/src/indices/index_pattern_to_ccs.test.ts

@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { indexPatternToCcs } from './index_pattern_to_ccs';
+
+describe('indexPatternToCcs', () => {
+  it('expands a simple local pattern', () => {
+    const result = indexPatternToCcs('logs-*');
+    expect(result).toEqual(['logs-*', '*:logs-*']);
+  });
+
+  it('returns remote-cluster pattern untouched', () => {
+    const result = indexPatternToCcs('prod:logs-*');
+    expect(result).toEqual(['prod:logs-*']);
+  });
+
+  it('returns wildcard-cluster pattern untouched', () => {
+    const result = indexPatternToCcs('*:metrics-*');
+    expect(result).toEqual(['*:metrics-*']);
+  });
+
+  it('expands local failure-store pattern', () => {
+    const result = indexPatternToCcs('logs-*::failures');
+    expect(result).toEqual(['logs-*::failures', '*:logs-*::failures']);
+  });
+
+  it('handles array input and deduplication', () => {
+    const result = indexPatternToCcs(['logs-*', 'prod:metrics-*', '*:logs-*']);
+    expect(result).toEqual(['logs-*', '*:logs-*', 'prod:metrics-*']);
+  });
+
+  it('splits comma-separated string', () => {
+    const result = indexPatternToCcs('logs-*, metrics-*');
+    expect(result).toEqual(['logs-*', '*:logs-*', 'metrics-*', '*:metrics-*']);
+  });
+});

src/platform/packages/shared/kbn-es-query/src/indices/index_pattern_to_ccs.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { castArray } from 'lodash';
+
+function isCrossCluster(pattern: string): boolean {
+  if (pattern.startsWith('*:')) return true; // already wildcard cluster
+
+  // simple, cheap heuristic first
+  if (!pattern.includes(':')) {
+    return false;
+  }
+
+  // match on single `:`, but exclude `::` which is used for e.g. `::failure`
+  return /(?<!:):(?!:)/.test(pattern);
+}
+
+/**
+ * Appends cross-cluster search equivalents for each specified index pattern.
+ * Use this when you want to query both local and cross-cluster indices automatically.
+ */
+export function indexPatternToCcs(index: string | string[]) {
+  // split on commas, normalise whitespace, and drop empty indices
+  const indices = castArray(index)
+    .flatMap((idx) => idx.split(','))
+    .map((i) => i.trim())
+    .filter(Boolean);
+
+  const expanded = new Set<string>();
+  for (const idx of indices) {
+    expanded.add(idx);
+    if (!isCrossCluster(idx)) {
+      expanded.add(`*:${idx}`);
+    }
+  }
+
+  return Array.from(expanded);
+}