Skip to content

[ML] Saved search using KQL with negation operator (NOT) returns a blank page on ML job creation #68298

@ppf2

Description

@ppf2

Kibana version: Tested in both 7.6.0 and 7.7.1

Elasticsearch version: Same as Kibana

When creating a ML anomaly detection job from a saved search in Kibana, if the saved search contains a KQL that includes the "not" operator, e.g., NOT field_name:something, the job creation fails without any errors (in either ES or Kibana) and the page simply refreshes to a blank page without providing further options to proceed with the actual creation. If the saved search has just field_name:something, everything works. I haven't tested all the other operators, but a:b AND c:d also works.

image

Saved search: export (2).ndjson.zip

Workaround: Switch the default KQL query option back to the previous Lucene default:

image

Metadata

Metadata

Assignees

Labels

:mlFeature:Anomaly DetectionML anomaly detectionbugFixes for quality problems that affect the customer experiencev7.9.0

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions