Describe the bug
Error occurred during rule execution message: "Search has been aborted due to cancelled execution" on rule preview

Kibana/Elasticsearch Stack version

VERSION: 8.15.1
BUILD: 76516
COMMIT: 1796ec02f5523bff4e449c368a3fea574d44455a

Steps

1. Navigate to Security Rule
2. Create New Rule with Custom Query Rule type
3. Enter the custom query:
   not observer.egress:* and not observer.egress.zone:* and not observer.hostname:* and not observer.ingress:* and not observer.ingress.zone:* and not observer.ip:* and not observer.mac:* and not observer.name:* and not observer.product:* and not observer.serial_number:* and not observer.type:* and not observer.vendor:* and not observer.version:* and not agent.ephemeral_id:* and not agent.id:* and not agent.name:* and not agent.type:* and not agent.version:*
4. Click on Rule Preview
5. Observe the error is thrown for the same

Expected Result

• The error should not occur when the task is not aborted

Screenshot