-
Notifications
You must be signed in to change notification settings - Fork 8.5k
Description
Kibana version: 8.18+
Describe the bug:
Since 8.18, when using the export action in Discover to generate a CSV Post URL for an ES|QL search with a relative time range, the URL is incorrectly generated with an absolute time range. This results in the same report being generated repeatedly when using the Post URL.
Example Post URL >=8.18
Full URL
http://localhost:5601/api/reporting/generate/csv_v2?jobParams=%28browserTimezone%3AAmerica%2FHalifax%2ClocatorParams%3A%21%28%28id%3ADISCOVER_APP_LOCATOR%2Cparams%3A%28columns%3A%21%28%29%2CdataViewSpec%3A%28allowHidden%3A%21f%2CallowNoIndex%3A%21f%2CfieldFormats%3A%28%29%2Cid%3Ae3465e67bdeced2befff9f9dca7ecf9c48504cad68a10efd881f4c7dd5ade28a%2Cname%3Akibana_sample_data_logs%2CruntimeFieldMap%3A%28%29%2CsourceFilters%3A%21%28%29%2CtimeFieldName%3A%27%40timestamp%27%2Ctitle%3Akibana_sample_data_logs%2Ctype%3Aesql%29%2Cfilters%3A%21%28%29%2ChideChart%3A%21f%2Cinterval%3Aauto%2Cquery%3A%28esql%3A%27FROM%20kibana_sample_data_logs%20%7C%20LIMIT%2010%27%29%2CrefreshInterval%3A%28pause%3A%21t%2Cvalue%3A60000%29%2Csort%3A%21%28%21%28timestamp%2Cdesc%29%29%2CtimeRange%3A%28from%3A%272025-06-02T03%3A00%3A00.000Z%27%2Cto%3A%272025-06-09T21%3A54%3A30.092Z%27%29%29%29%29%2CobjectType%3Asearch%2Ctitle%3A%27Untitled%20Discover%20session%27%2Cversion%3A%279.1.0%27%29
Decoded jobParams
(browserTimezone:America/Halifax,locatorParams:!((id:DISCOVER_APP_LOCATOR,params:(columns:!(),dataViewSpec:(allowHidden:!f,allowNoIndex:!f,fieldFormats:(),id:e3465e67bdeced2befff9f9dca7ecf9c48504cad68a10efd881f4c7dd5ade28a,name:kibana_sample_data_logs,runtimeFieldMap:(),sourceFilters:!(),timeFieldName:'@timestamp',title:kibana_sample_data_logs,type:esql),filters:!(),hideChart:!f,interval:auto,query:(esql:'FROM kibana_sample_data_logs | LIMIT 10'),refreshInterval:(pause:!t,value:60000),sort:!(!(timestamp,desc)),timeRange:(from:'2025-06-02T03:00:00.000Z',to:'2025-06-09T21:54:30.092Z')))),objectType:search,title:'Untitled Discover session',version:'9.1.0')
Example Post URL <8.18
Full URL
http://localhost:5601/api/reporting/generate/csv_v2?jobParams=%28browserTimezone%3AAmerica%2FHalifax%2ClocatorParams%3A%21%28%28id%3ADISCOVER_APP_LOCATOR%2Cparams%3A%28columns%3A%21%28%29%2CdataViewSpec%3A%28allowHidden%3A%21f%2CallowNoIndex%3A%21f%2CfieldFormats%3A%28%29%2Cid%3Ae3465e67bdeced2befff9f9dca7ecf9c48504cad68a10efd881f4c7dd5ade28a%2Cname%3Akibana_sample_data_logs%2CruntimeFieldMap%3A%28%29%2CsourceFilters%3A%21%28%29%2CtimeFieldName%3A%27%40timestamp%27%2Ctitle%3Akibana_sample_data_logs%2Ctype%3Aesql%29%2Cfilters%3A%21%28%29%2ChideChart%3A%21f%2Cinterval%3Aauto%2Cquery%3A%28esql%3A%27FROM%20kibana_sample_data_logs%20%7C%20LIMIT%2010%27%29%2CrefreshInterval%3A%28pause%3A%21t%2Cvalue%3A60000%29%2Csort%3A%21%28%21%28timestamp%2Cdesc%29%29%2CtimeRange%3A%28from%3Anow-7d%2Fd%2Cto%3Anow%29%29%29%29%2CobjectType%3Asearch%2Ctitle%3A%27Untitled%20Discover%20session%27%2Cversion%3A%279.1.0%27%29
Decoded jobParams
(browserTimezone:America/Halifax,locatorParams:!((id:DISCOVER_APP_LOCATOR,params:(columns:!(),dataViewSpec:(allowHidden:!f,allowNoIndex:!f,fieldFormats:(),id:e3465e67bdeced2befff9f9dca7ecf9c48504cad68a10efd881f4c7dd5ade28a,name:kibana_sample_data_logs,runtimeFieldMap:(),sourceFilters:!(),timeFieldName:'@timestamp',title:kibana_sample_data_logs,type:esql),filters:!(),hideChart:!f,interval:auto,query:(esql:'FROM kibana_sample_data_logs | LIMIT 10'),refreshInterval:(pause:!t,value:60000),sort:!(!(timestamp,desc)),timeRange:(from:now-7d/d,to:now)))),objectType:search,title:'Untitled Discover session',version:'9.1.0')
Steps to reproduce:
- Create an ES|QL search in Discover with a relative time range
- Use the share action (or export action in 9.1) to generate a Post URL
- Observe that the
timeRangeis an absolute time range instead of relative
Expected behavior:
When generating a Post URL for an ES|QL search with a relative time range, the timeRange parameter should not be converted to an absolute time range, which results in duplicate reports. The fix should ensure that directly generating a CSV report continues to convert from a relative to absolute time range, but that Post URLs embed the relative time range as expected.
Any additional context:
This issue started after #216792 where we began converting from a relative to absolute time range when generating an ES|QL CSV report to ensure the data matches what the user sees in the table. This makes sense when generating a CSV report directly to ensure consistency, but does not make sense when generating a Post URL since it leads to duplicate reports.
Update: We ended up reverting the change from #216792 entirely for now in order to get a fix out quickly. The original issue of CSV exports using relative time ranges will be addressed in #216605.