[DaC] Export fails on KQL queries with unbound free-text term (no field specified)

[fgeslot]

Command or doc area

• kibana export-rules / kibana import-rules
• import-rules-to-repo
• export-rules-from-repo
• Other DaC CLI command (name it in the field below)
• Documentation in this repo only (link the page/section below)

Other command name or doc link

No response

Summary

I have identified an issue with the export-rules command in DaC (detection_rules) when handling KQL rules that contain a free-text term not bound to any field. The export process fails with a parser error (Value not tied to field) instead of treating the bare string as a full-text search term, which is otherwise valid KQL syntax (e.g. in Discover).

Expected vs actual

Rule example:
[...]
"type": "query",
"language": "kuery",
"index": [
"logs-*"
],
"query": "process.name : agent12 and "Accepted password for root"",
"filters": []
},
[...]

This rules works in Kibana, but I am unable to export it

the _errors.txt file:

This is a valid Kibana configuration — the rule runs fine in the Detection Engine.

Environment (if relevant)

elastic/kibana version: 9.4.3
detection-rules: dev-v1.7.9

Reproduction (if applicable)

No response

Related issues (optional)

No response