-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Saved object filter KQL do not work with multiple nested filters #81009
Comments
Pinging @elastic/kibana-platform (Team:Platform) |
@nchaulet I'm currently looking at the ast validation we are using for SO to try to fix that. In the meantime, looking at the tests, I think that expanding the query should work?
Could you confirm that this 'workaround' is correctly working for your case. |
So, I can confirm we got an issue in Note that this seems to only be a validation issue. By removing the validation step, I think the query is executed just fine against the index. A simple test to reproduce the behavior (in test('Validate multiple items nested filter query through KueryNode', () => {
const validationObject = validateFilterKueryNode({
astFilter: esKuery.fromKueryExpression(
'alert.attributes.actions:{ actionTypeId: ".server-log" AND actionRef: "foo" }'
),
types: ['alert'],
indexMapping: mockMappings,
hasNestedKey: true,
});
// nodes will have errors in the array
expect(validationObject).toEqual(...);
}); @lukasolson (and @elastic/kibana-app-arch in general) I (well, the team in general) kinda lack KQL knowledge to be able to fix this. From what I see, the current validation is rather simple, and totally lack nested functions logic (it only handle the |
@pgayvallet I think the workaround if we have this document `{inputs: [{package: endpoint, status: healthy}, {package: nginx, status: error}]`` it's going to be returned by your workaround but a nested query will not return it. |
You are right. Did not thought about Waiting on @elastic/kibana-app-arch insight then. |
Hmm, yeah this seems like a bug that falls on our team. What's the priority of fixing this? |
I'll let @nchaulet answer that, but I think this is required for a feature they are planning for 7.11 |
Yes we would like to have this for 7.11 it will allow us a better filtering of Fleet agents |
Hi some news we will not use that feature on fleet for 7.11, so there is no urgence on our side to fix that |
This PR should fix it, #64002 |
@XavierM would you mind extracting that fix into a dedicated PR? |
Looked some more at this today, I don't think this is anything relating to KQL itself, and I believe the fix that @XavierM has in the other PR should do the trick. |
Closed by #96292 |
Description
I am trying to use nested filter in a saved object filter query using KQL, and it's throwing a validation error if I have multiple items in my nested query
This work
This do not work
The error
The text was updated successfully, but these errors were encountered: