Field name not stored in Kibana filter after dropdown selection

[berglh]

This might interest you @varunsharma27 and @AnnaGerber; I've been using this plugin in Kibana 6.2.3 and everything has been working well, however we noticed that when a filter is added in the dashboard, the field name referenced doesn't actually get saved and is replaced by a "*" character:

The DSL structure of the filter gets added like this:

{
  "query": {
    "query_string": {
      "default_field": "source.field_name.raw",
      "query": "\"Value selected in dropdown here\"",
      "analyze_wildcard": true
    }
  }
}

However, when this filter is "saved" the default_field value is lost and replaced with a "*".

{
  "query": {
    "query_string": {
      "default_field": "*",
      "query": "\"Value selected in dropdownhere\"",
      "analyze_wildcard": true
    }
  }
}

This isn't too much of a problem if you've your using queries that don't overlap other indices or using unique values; but could become a problem matching identical strings in other fields other than what the drop down picker was originally used to scope the selection with.

Adding this filter manually and pasting in the above top DSL query string, results in the same behaviour experienced by the dropdown picker. That would indicate that there is something wrong with Kibana using the query_string DSL as a filter in Kibana 6.2.3.

So one might ask, should we be better off changing the structure to something that is more default these days. When you add a filter in Kibana, the default for an exact match is like so:

{
  "query": {
    "match": {
      "type.raw": {
        "query": "session",
        "type": "phrase"
      }
    }
  }
}

I'm not highlighting that the old method is incorrect; according to the ES documentation; this is still a valid query structure: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html

It is still a problem of sorts; I haven't tried the latest version of Kibana or a prior version of Kibana to test it out, just thought I'd open an issue for discussion. I might try to adapt the structure if I get around to understanding the plugin javascript, but it'd be nice to get this confirmed in other Kibana versions.

[AnnaGerber]

Thanks for looking into this, seems like it would be a good idea to move to the new format, but as you say, would need to confirm with other Kibana versions. Feel free to create a PR if you get around to it.

[varunsharma27]

In kibana 6.2.3, there is an input control vis which dropdown obsolete. Have you tried that?