The plan

Right now the editor shows an error any time there is an index pattern being used in the query that doesn't match any indices. Sometimes, this leads us to show errors even when the query will pass muster with Elasticsearch.

We will change our client-side validator to match the Elasticsearch logic.

Specifically, in the cases where an index pattern doesn't match any indices but the query is still valid, we will still show the message, but only as a warning.

We will cover this new behavior with tests against both our validator and Elasticsearch to make sure we don't diverge in the future.

Original report

Kibana version: serverless-production-observability

Browser version: chrome latest

Original install method (e.g. download page, yum, from source, etc.): from production

Describe the bug: When user switches from Logs explorer -> open in Discover - > Try ES|QL, Kibana adds filebeat-, kibana_sample_data_logs index to the ES|QL query even though they are not index into elasticsearch. This displays error "Line 1
Unknown index [filebeat-]
Line 1 Unknown index [kibana_sample_data_logs]".

There is no way to fix this error because user doesn't want them in the first place. I have seen other instances of this. Can we please remove this?