Skip to content

[Discover] [ES|QL] CSV export Post URL is incorrect when using a relative time range #223171

@davismcphee

Description

@davismcphee

Kibana version: 8.18+

Describe the bug:
Since 8.18, when using the export action in Discover to generate a CSV Post URL for an ES|QL search with a relative time range, the URL is incorrectly generated with an absolute time range. This results in the same report being generated repeatedly when using the Post URL.

Example Post URL >=8.18

Full URL
http://localhost:5601/api/reporting/generate/csv_v2?jobParams=%28browserTimezone%3AAmerica%2FHalifax%2ClocatorParams%3A%21%28%28id%3ADISCOVER_APP_LOCATOR%2Cparams%3A%28columns%3A%21%28%29%2CdataViewSpec%3A%28allowHidden%3A%21f%2CallowNoIndex%3A%21f%2CfieldFormats%3A%28%29%2Cid%3Ae3465e67bdeced2befff9f9dca7ecf9c48504cad68a10efd881f4c7dd5ade28a%2Cname%3Akibana_sample_data_logs%2CruntimeFieldMap%3A%28%29%2CsourceFilters%3A%21%28%29%2CtimeFieldName%3A%27%40timestamp%27%2Ctitle%3Akibana_sample_data_logs%2Ctype%3Aesql%29%2Cfilters%3A%21%28%29%2ChideChart%3A%21f%2Cinterval%3Aauto%2Cquery%3A%28esql%3A%27FROM%20kibana_sample_data_logs%20%7C%20LIMIT%2010%27%29%2CrefreshInterval%3A%28pause%3A%21t%2Cvalue%3A60000%29%2Csort%3A%21%28%21%28timestamp%2Cdesc%29%29%2CtimeRange%3A%28from%3A%272025-06-02T03%3A00%3A00.000Z%27%2Cto%3A%272025-06-09T21%3A54%3A30.092Z%27%29%29%29%29%2CobjectType%3Asearch%2Ctitle%3A%27Untitled%20Discover%20session%27%2Cversion%3A%279.1.0%27%29

Decoded jobParams
(browserTimezone:America/Halifax,locatorParams:!((id:DISCOVER_APP_LOCATOR,params:(columns:!(),dataViewSpec:(allowHidden:!f,allowNoIndex:!f,fieldFormats:(),id:e3465e67bdeced2befff9f9dca7ecf9c48504cad68a10efd881f4c7dd5ade28a,name:kibana_sample_data_logs,runtimeFieldMap:(),sourceFilters:!(),timeFieldName:'@timestamp',title:kibana_sample_data_logs,type:esql),filters:!(),hideChart:!f,interval:auto,query:(esql:'FROM kibana_sample_data_logs | LIMIT 10'),refreshInterval:(pause:!t,value:60000),sort:!(!(timestamp,desc)),timeRange:(from:'2025-06-02T03:00:00.000Z',to:'2025-06-09T21:54:30.092Z')))),objectType:search,title:'Untitled Discover session',version:'9.1.0')

Example Post URL <8.18

Full URL
http://localhost:5601/api/reporting/generate/csv_v2?jobParams=%28browserTimezone%3AAmerica%2FHalifax%2ClocatorParams%3A%21%28%28id%3ADISCOVER_APP_LOCATOR%2Cparams%3A%28columns%3A%21%28%29%2CdataViewSpec%3A%28allowHidden%3A%21f%2CallowNoIndex%3A%21f%2CfieldFormats%3A%28%29%2Cid%3Ae3465e67bdeced2befff9f9dca7ecf9c48504cad68a10efd881f4c7dd5ade28a%2Cname%3Akibana_sample_data_logs%2CruntimeFieldMap%3A%28%29%2CsourceFilters%3A%21%28%29%2CtimeFieldName%3A%27%40timestamp%27%2Ctitle%3Akibana_sample_data_logs%2Ctype%3Aesql%29%2Cfilters%3A%21%28%29%2ChideChart%3A%21f%2Cinterval%3Aauto%2Cquery%3A%28esql%3A%27FROM%20kibana_sample_data_logs%20%7C%20LIMIT%2010%27%29%2CrefreshInterval%3A%28pause%3A%21t%2Cvalue%3A60000%29%2Csort%3A%21%28%21%28timestamp%2Cdesc%29%29%2CtimeRange%3A%28from%3Anow-7d%2Fd%2Cto%3Anow%29%29%29%29%2CobjectType%3Asearch%2Ctitle%3A%27Untitled%20Discover%20session%27%2Cversion%3A%279.1.0%27%29

Decoded jobParams
(browserTimezone:America/Halifax,locatorParams:!((id:DISCOVER_APP_LOCATOR,params:(columns:!(),dataViewSpec:(allowHidden:!f,allowNoIndex:!f,fieldFormats:(),id:e3465e67bdeced2befff9f9dca7ecf9c48504cad68a10efd881f4c7dd5ade28a,name:kibana_sample_data_logs,runtimeFieldMap:(),sourceFilters:!(),timeFieldName:'@timestamp',title:kibana_sample_data_logs,type:esql),filters:!(),hideChart:!f,interval:auto,query:(esql:'FROM kibana_sample_data_logs | LIMIT 10'),refreshInterval:(pause:!t,value:60000),sort:!(!(timestamp,desc)),timeRange:(from:now-7d/d,to:now)))),objectType:search,title:'Untitled Discover session',version:'9.1.0')

Steps to reproduce:

  1. Create an ES|QL search in Discover with a relative time range
  2. Use the share action (or export action in 9.1) to generate a Post URL
  3. Observe that the timeRange is an absolute time range instead of relative

Expected behavior:
When generating a Post URL for an ES|QL search with a relative time range, the timeRange parameter should not be converted to an absolute time range, which results in duplicate reports. The fix should ensure that directly generating a CSV report continues to convert from a relative to absolute time range, but that Post URLs embed the relative time range as expected.

Any additional context:
This issue started after #216792 where we began converting from a relative to absolute time range when generating an ES|QL CSV report to ensure the data matches what the user sees in the table. This makes sense when generating a CSV report directly to ensure consistency, but does not make sense when generating a Post URL since it leads to duplicate reports.

Update: We ended up reverting the change from #216792 entirely for now in order to get a fix out quickly. The original issue of CSV exports using relative time ranges will be addressed in #216605.

Metadata

Metadata

Assignees

Labels

Feature:DiscoverDiscover ApplicationFeature:Reporting:CSVReporting issues pertaining to CSV file exportTeam:DataDiscoveryDiscover, search (data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL. t//bugFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.loe:needs-researchThis issue requires some research before it can be worked on or estimatedv8.18.0

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions