[ML] Anomaly Explorer - ensure valid syntax after removing 2nd of 3 f…

…ilters via icon (#34187)

* Remove middle filter value correctly using icons

* remove middle filter value in OR query correctly with icons

* combine operator pattern check

x-pack/plugins/ml/public/components/kql_filter_bar/__tests__/utils.js

@@ -71,6 +71,24 @@ describe('ML - KqlFilterBar utils', () => {
       expect(result).to.be(expectedOutput);
     });
 
+    it('removes selected fieldName/fieldValue correctly from  AND query string when it is the middle value', () => {
+      const currentQueryString = `http.response.status_code : "400" and http.response.status_code : "200"
+        and http.response.status_code : "300"`;
+      const expectedOutput = 'http.response.status_code : "400" and http.response.status_code : "300"';
+      const result = removeFilterFromQueryString(currentQueryString, fieldName, fieldValue);
+      expect(result).to.be(expectedOutput);
+    });
+
+    it('removes selected fieldName/fieldValue correctly from OR query string when it is the middle value', () => {
+      const currentQueryString = `http.response.status_code : "400" or http.response.status_code : "200"
+        or http.response.status_code : "300"`;
+      const expectedOutput = 'http.response.status_code : "400" or http.response.status_code : "300"';
+      const result = removeFilterFromQueryString(currentQueryString, fieldName, fieldValue);
+      expect(result).to.be(expectedOutput);
+    });
+
+
+
   });
 
   describe('getQueryPattern', () => {

x-pack/plugins/ml/public/components/kql_filter_bar/utils.js

@@ -88,6 +88,9 @@ export function removeFilterFromQueryString(currentQueryString, fieldName, field
   // match 'and' or 'or' at the start/end of the string
   const endPattern = /\s(and|or)\s*$/ig;
   const startPattern = /^\s*(and|or)\s/ig;
+  // If string has a double operator (e.g. tag:thing or or tag:other) remove and replace with the first occurring operator
+  const invalidOperatorPattern = /\s+(and|or)\s+(and|or)\s+/ig;
+  newQueryString = newQueryString.replace(invalidOperatorPattern, ' $1 ');
   // If string starts/ends with 'and' or 'or' remove that as that is illegal kuery syntax
   newQueryString = newQueryString.replace(endPattern, '');
   newQueryString = newQueryString.replace(startPattern, '');