From 1c0db4ca77c5c1da554d9f0d86bdecd7ec5b0c2b Mon Sep 17 00:00:00 2001
From: Chase <62891993+engechas@users.noreply.github.com>
Date: Wed, 13 Mar 2024 22:38:51 -0700
Subject: [PATCH] Backport 1325 to 2.5 (#1375)

* Set docData to empty string if actual is null (#1325)

Signed-off-by: Chase Engelbrecht <engechas@amazon.com>

* Resolve backport conflicts

Signed-off-by: Chase Engelbrecht <engechas@amazon.com>

---------

Signed-off-by: Chase Engelbrecht <engechas@amazon.com>
---
 .../transport/TransportGetFindingsAction.kt   |  5 ++--
 .../alerting/resthandler/FindingsRestApiIT.kt | 27 +++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/alerting/src/main/kotlin/org/opensearch/alerting/transport/TransportGetFindingsAction.kt b/alerting/src/main/kotlin/org/opensearch/alerting/transport/TransportGetFindingsAction.kt
index b99c5c381..1ca5ceb05 100644
--- a/alerting/src/main/kotlin/org/opensearch/alerting/transport/TransportGetFindingsAction.kt
+++ b/alerting/src/main/kotlin/org/opensearch/alerting/transport/TransportGetFindingsAction.kt
@@ -218,8 +218,9 @@ class TransportGetFindingsSearchAction @Inject constructor(
         val documents: MutableMap<String, FindingDocument> = mutableMapOf()
         response.responses.forEach {
             val key = "${it.index}|${it.id}"
-            val docData = if (it.isFailed) "" else it.response.sourceAsString
-            val findingDocument = FindingDocument(it.index, it.id, !it.isFailed, docData)
+            val isDocFound = !(it.isFailed || it.response.sourceAsString == null)
+            val docData = if (isDocFound) it.response.sourceAsString else ""
+            val findingDocument = FindingDocument(it.index, it.id, isDocFound, docData)
             documents[key] = findingDocument
         }
 
diff --git a/alerting/src/test/kotlin/org/opensearch/alerting/resthandler/FindingsRestApiIT.kt b/alerting/src/test/kotlin/org/opensearch/alerting/resthandler/FindingsRestApiIT.kt
index dc61468a8..c90c58013 100644
--- a/alerting/src/test/kotlin/org/opensearch/alerting/resthandler/FindingsRestApiIT.kt
+++ b/alerting/src/test/kotlin/org/opensearch/alerting/resthandler/FindingsRestApiIT.kt
@@ -31,6 +31,33 @@ class FindingsRestApiIT : AlertingRestTestCase() {
         assertFalse(response.findings[0].documents[0].found)
     }
 
+    fun `test find Finding where source docData is null`() {
+        val testIndex = createTestIndex()
+        val testDoc = """{
+            "message" : "This is an error from IAD region",
+            "test_field" : "us-west-2"
+        }"""
+        indexDoc(testIndex, "someId", testDoc)
+
+        val docQuery = DocLevelQuery(query = "test_field:\"us-west-2\"", name = "3")
+        val docLevelInput = DocLevelMonitorInput("description", listOf(testIndex), listOf(docQuery))
+        val trigger = randomDocumentLevelTrigger(condition = ALWAYS_RUN)
+        val trueMonitor = createMonitor(randomDocumentLevelMonitor(inputs = listOf(docLevelInput), triggers = listOf(trigger)))
+        executeMonitor(trueMonitor.id, mapOf(Pair("dryrun", "true")))
+
+        createFinding(matchingDocIds = listOf("someId"), index = testIndex)
+        val responseBeforeDelete = searchFindings()
+        assertEquals(1, responseBeforeDelete.totalFindings)
+        assertEquals(1, responseBeforeDelete.findings[0].documents.size)
+        assertTrue(responseBeforeDelete.findings[0].documents[0].found)
+
+        deleteDoc(testIndex, "someId")
+        val responseAfterDelete = searchFindings()
+        assertEquals(1, responseAfterDelete.totalFindings)
+        assertEquals(1, responseAfterDelete.findings[0].documents.size)
+        assertFalse(responseAfterDelete.findings[0].documents[0].found)
+    }
+
     fun `test find Finding where doc is retrieved`() {
         val testIndex = createTestIndex()
         val testDoc = """{