Failing test: X-Pack Cloud Security Posture API Tests.x-pack/solutions/security/test/cloud_security_posture_api/routes/graph·ts - Cloud Security Posture POST /internal/cloud_security_posture/graph Happy flows should return label nodes with correct ID pattern confirming boolean handling

[kibanamachine]

A test failed on a tracked branch

Error: Expected 200 ,got 500 resp: {"statusCode":500,"error":"Internal Server Error","message":"illegal_state_exception: PropagateNullable: notNullExpressions is null before second replace() call [#141579]. and=isOrigin AND event.id in (?og_alrt_id0)"}
    at Context.apply (graph.ts:1443:12)
    at Object.apply (wrap_function.js:74:30)
----
    at helpers.ts:42:13
    at /opt/buildkite-agent/builds/bk-agent-prod-gcp-1780305431597955549/elastic/kibana-on-merge/kibana/node_modules/supertest/lib/test.js:365:13
    at Test._assertFunction (node_modules/supertest/lib/test.js:342:13)
    at Test.assert (node_modules/supertest/lib/test.js:195:23)
    at localAssert (node_modules/supertest/lib/test.js:138:14)
    at fn (node_modules/supertest/lib/test.js:156:7)
    at Test.callback (node_modules/superagent/src/node/index.js:904:3)
    at fn (node_modules/superagent/src/node/index.js:1183:18)
    at IncomingMessage.<anonymous> (node_modules/superagent/src/node/parsers/json.js:19:7)
    at IncomingMessage.emit (node:events:520:35)
    at endReadableNT (node:internal/streams/readable:1729:12)
    at processTicksAndRejections (node:internal/process/task_queues:90:21)

First failure: kibana-on-merge - main

[infra-vault-gh-plugin-prod]

Pinging @elastic/contextual-security-apps (Team:Cloud Security)

[github-actions]

Application: ES|QL planner crashes on COALESCE(... AND event.id IN (...)) in graph query

Classification: application | Confidence: high | Introduced by: ES planner bug elasticsearch#141579; already addressed in open Kibana PR #269060

Summary: The POST /internal/cloud_security_posture/graph route generates an ES|QL fragment COALESCE(isOrigin AND event.id in (?og_alrt_id0), false) for isOriginAlert. The Elasticsearch ES|QL planner's PropagateNullable rule crashes (illegal_state_exception: notNullExpressions is null before second replace() call [#141579]) on this exact shape, returning HTTP 500.

Proposed Fix

Merge the existing open draft PR #269060 — Fix flaky CSP graph ESQL tests (CASE guard for origin predicates), which is already authored to fix this and 5 related sibling issues (#267867, #267901, #268111, #268237, #268321).

The PR rewrites both isOrigin and isOriginAlert in x-pack/solutions/security/plugins/cloud_security_posture/server/routes/graph/fetch_events_graph.ts#L538-L551 from COALESCE(... event.id in (...), false) to a CASE guard that skips the IN when event.id is null/empty:

- | EVAL isOrigin = COALESCE(event.id in (?og_id0, ...), false)
+ | EVAL isOrigin = CASE (event.id IS NOT NULL AND event.id != "", event.id in (?og_id0, ...), false)
- | EVAL isOriginAlert = COALESCE(isOrigin AND event.id in (?og_alrt_id0, ...), false)
+ | EVAL isOriginAlert = CASE (event.id IS NOT NULL AND event.id != "", isOrigin AND event.id in (?og_alrt_id0, ...), false)

PR #269060 has been open in draft since 2026-05-13 and a flaky-test runner against it showed 49/50 passes (vs. the recurring failures here). It should be finalized and merged.

Root Cause & Evidence

The failing test graph.ts#L1432-L1483 posts originEventIds: [{id: 'kabcd1234efgh5678', isAlert: true}, {id: 'failed-event', isAlert: false}]. This produces one originAlertId, so fetch_events_graph.ts#L545-L551 emits:

| EVAL isOriginAlert = COALESCE(isOrigin AND event.id in (?og_alrt_id0), false)

The ES error returned by the API call quotes this fragment verbatim: and=isOrigin AND event.id in (?og_alrt_id0). The crash originates in Elasticsearch's PropagateNullable optimizer rule, tracked as elasticsearch#141579 ("Cannot invoke java.lang.Iterable.iterator() because pattern is null"); the recent Kibana failure messages contain [#141579] as an inline marker.

The same ES bug previously triggered failures on the Pinning test variants (see #267867 and siblings), all on kibana-on-merge. The boolean handling test added in this area is the next instance to surface.

Ruled out

• Test design / fixtures: The assertions are well-formed and the test only fails because the API returns 500 — not on the label-shape checks themselves.
• Environment: The same ES|QL pattern, not parallel-slot or fixture leakage, causes deterministic failures across multiple builds and issues.
• Inconclusive: The error message explicitly cites the planner rule and the exact predicate; there is no ambiguity about the trigger.

Generated by Failed Test Investigator for issue #272086 · ● 16.5M · ◷