KQL Search in the Transform UI doesn't support index patterns with > 1024 fields

[Alex3k]

Kibana version: 7.6.2

Elasticsearch version: 7.6.2

Original install method (e.g. download page, yum, from source, etc.): Elastic Cloud

Describe the bug:
You can't use KQL search within the Transforms UI if an index pattern has more than 1024 fields (see screenshot)

Steps to reproduce:

1. Open the Transform UI through Management
2. Find an index pattern with more than 1024 fields (filebeat-* by default does)
3. Notice that there is a message that says that only index patterns with less than 1024 fields

Expected behavior:
The search bar works regardless of the number of fields in the index pattern

Screenshots (if relevant):

** Extra context: **
discussed with @sophiec20 who recommend I submit a bug

[nicpenning]

This is still occurring in 7.8 (on-premise/stand-alone solution):

Any update on when or if this will be resolved?

Thanks!

[Alex3k]

This is still occuring within 7.9.x

[walterra]

Thanks for resurfacing this. There's a bit of history involved how we ended up with this limitation (#37183). We'll re-evaluate if we can safely remove the limitation.

This hasn't been a high priority for us since there are several work-arounds:

• Use a saved-search to limit the scope of the results used for the transform
• Switch to the JSON editor to adjust the query
• Copy the transform configuration (copy-to-clipboard button for the transform preview) and paste the config in Kibana's Dev Tools to fine-tuning the query.

Note another currently known limitation of using indices with a lot of fields results in some performance degradation of the UI (#78590).

[elasticmachine]

Pinging @elastic/ml-ui (:ml)

[Alex3k]

@walterra from thinking of this further I feel that although those are valid technical workarounds, they really make Transforms much harder to use for the non-power user. Especially considering most of the index patterns we have OOTB (filebeat etc) all have over 1024 fields. A lot of folks I talk to won't be comfortable with switching to the JSON editor or going over to dev tools. They want to point and click :/