diff --git a/packages/kbn-esql-ast/src/parser/__tests__/from.test.ts b/packages/kbn-esql-ast/src/parser/__tests__/from.test.ts
index 101661973a692c..15e0496a9087c7 100644
--- a/packages/kbn-esql-ast/src/parser/__tests__/from.test.ts
+++ b/packages/kbn-esql-ast/src/parser/__tests__/from.test.ts
@@ -187,5 +187,21 @@ describe('FROM', () => {
 
       expect(errors.length > 0).toBe(true);
     });
+
+    it('when open square bracket "[" is entered', () => {
+      const text = 'FROM kibana_sample_data_logs [';
+      const { errors } = parse(text);
+
+      expect(errors.length > 0).toBe(true);
+      expect(errors[0].message.toLowerCase().includes('metadata')).toBe(true);
+    });
+
+    it('when close square bracket "]" is entered', () => {
+      const text = 'FROM kibana_sample_data_logs []';
+      const { errors } = parse(text);
+
+      expect(errors.length > 0).toBe(true);
+      expect(errors[0].message.toLowerCase().includes('metadata')).toBe(true);
+    });
   });
 });
diff --git a/packages/kbn-esql-ast/src/parser/esql_ast_builder_listener.ts b/packages/kbn-esql-ast/src/parser/esql_ast_builder_listener.ts
index de406e33aa7a5a..3959d42d8a35f2 100644
--- a/packages/kbn-esql-ast/src/parser/esql_ast_builder_listener.ts
+++ b/packages/kbn-esql-ast/src/parser/esql_ast_builder_listener.ts
@@ -120,7 +120,7 @@ export class ESQLAstBuilderListener implements ESQLParserListener {
     const metadataContext = ctx.metadata();
     const metadataContent =
       metadataContext?.deprecated_metadata()?.metadataOption() || metadataContext?.metadataOption();
-    if (metadataContent) {
+    if (metadataContent && metadataContent.METADATA()) {
       const option = createOption(
         metadataContent.METADATA().getText().toLowerCase(),
         metadataContent
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_esql_index.test.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_esql_index.test.ts
index 2f5065eb113be1..eabd2050e7ba2a 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_esql_index.test.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_esql_index.test.ts
@@ -27,8 +27,16 @@ describe('useEsqlIndex', () => {
     expect(result.current).toEqual([]);
   });
 
+  it('returns indices which appear in source before syntax error', async () => {
+    const typeErrorCausingQuery = 'from auditbeat* [, auditbeat2*';
+
+    const { result } = renderHook(() => useEsqlIndex(typeErrorCausingQuery, 'esql'));
+
+    expect(result.current).toEqual(['auditbeat*']);
+  });
+
   it('should return empty array if invalid query is causing a TypeError in ES|QL parser', async () => {
-    const typeErrorCausingQuery = 'from auditbeat* []';
+    const typeErrorCausingQuery = 'from []';
 
     const { result } = renderHook(() => useEsqlIndex(typeErrorCausingQuery, 'esql'));