Disallow missing events in UNTIL

Author: luigidellaquila

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/LogicalPlanBuilder.java

@@ -334,6 +334,9 @@ public Sequence visitSequence(SequenceContext ctx) {
  throw new ParsingException(source, "A sequence requires a minimum of 2 queries (excluding UNTIL clause), found [1]");
  }
  until = queries.remove(queries.size() - 1);
+ if (until.isMissingEventFilter()) {
+ throw new ParsingException(source, "UNTIL clause cannot be a negative clause (missing event)");
+ }
  } else {
  until = defaultUntil(source);
  }

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/planner/QueryTranslatorFailTests.java

@@ -267,6 +267,11 @@ public void testSequenceWithTooLittleQueriesWithUntil() throws Exception {
  plan("sequence [any where true] [any where true] until [any where true]");
  }
 
+ public void testSequenceWithNegativeUntil() throws Exception {
+ String s = errorParsing("sequence [any where true] [any where true] until ![any where true]");
+ assertEquals("1:2: UNTIL clause cannot be a negative clause (missing event)", s);
+ }
+
  public void testSequenceWithIncorrectOption() throws Exception {
  EqlClientException e = expectThrows(EqlClientException.class, () -> plan("sequence [any where true] with repeat=123"));
  String msg = e.getMessage();