Skip to content

[ML] Fixing anomaly chart empty query bug#246841

Merged
jgowdyelastic merged 10 commits intoelastic:mainfrom
jgowdyelastic:fixing-anomaly-chart-filter-issue
Dec 19, 2025
Merged

[ML] Fixing anomaly chart empty query bug#246841
jgowdyelastic merged 10 commits intoelastic:mainfrom
jgowdyelastic:fixing-anomaly-chart-filter-issue

Conversation

@jgowdyelastic
Copy link
Member

@jgowdyelastic jgowdyelastic commented Dec 18, 2025 •
edited by kibanamachine
Loading

Fixes an issue in the anomaly chart embeddable where the query can become malformed causing the chart to fail to render.

To reproduce:

  1. Create a new Dashboard
  2. Click the Add "+" and choose New Panel > Anomaly chart
  3. Select a job from the drop-down and click Confirm
  4. Add any single field filter: @timestamp Is 2025-12-01 (ML anomaly chart panel has no error - see screenshot below)
  5. Remove filter
  6. Add any OR'd filter: @timestamp Is 2025-12-01 OR @timestamp Is 2025-12-02 (ML anomaly chart panel generates error - see screenshot below)
@jgowdyelastic jgowdyelastic self-assigned this Dec 18, 2025
@jgowdyelastic jgowdyelastic marked this pull request as ready for review December 18, 2025 13:45
@jgowdyelastic jgowdyelastic requested a review from a team as a code owner December 18, 2025 13:45
@elasticmachine
Copy link
Contributor

elasticmachine commented Dec 18, 2025

Pinging @elastic/ml-ui (:ml)
@peteharverson peteharverson mentioned this pull request Dec 18, 2025
Closed
20 tasks
peteharverson
peteharverson reviewed Dec 18, 2025
View reviewed changes
x-pack/platform/plugins/shared/ml/public/embeddables/common/process_filters.ts Outdated
}

if (filterQuery) {
if (filterQuery && isPopulatedObject(filterQuery)) {
Copy link
Contributor

@peteharverson peteharverson Dec 18, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fixing the original bug, but it is now revealing that the wrong results are being returned when an OR filter is applied...

Screenshot 2025-12-18 at 14 32 46
Copy link
Member Author

@jgowdyelastic jgowdyelastic Dec 19, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated the processFilter function to remove all of the custom filter processing in favour of the core buildEsQuery function.
This fixes the original problem as well as the problem discovered here ^
@elastic-vault-github-plugin-prod elastic-vault-github-plugin-prod bot requested a review from a team as a code owner December 18, 2025 14:49
@jgowdyelastic jgowdyelastic requested review from qn895 and removed request for alvarezmelissa87 December 19, 2025 15:09
@elasticmachine
Copy link
Contributor

elasticmachine commented Dec 19, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] x-pack/solutions/security/test/cloud_security_posture_functional/config.ts / Cloud Security Posture Security Alerts Page - Graph visualization ECS fields only expanded flyout - entity enrichment for multiple generic targets - single target field

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
ml 5.6MB 5.6MB -640.0B

History

cc @jgowdyelastic
peteharverson
peteharverson approved these changes Dec 19, 2025
View reviewed changes
Copy link
Contributor

@peteharverson peteharverson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested latest changes and LGTM.

If the backport is straightforward, it would be worth putting this in v9.2.4 too.
qn895
qn895 approved these changes Dec 19, 2025
View reviewed changes
Copy link
Member

@qn895 qn895 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🎉
@jgowdyelastic jgowdyelastic merged commit b61dc27 into elastic:main Dec 19, 2025
16 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented Dec 19, 2025

Starting backport for target branches: 9.2, 9.3

https://github.com/elastic/kibana/actions/runs/20378414166
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Dec 19, 2025
@jgowdyelastic
[ML] Fixing anomaly chart empty query bug (elastic#246841)
9957337 
(cherry picked from commit b61dc27)
@kibanamachine kibanamachine mentioned this pull request Dec 19, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Dec 19, 2025
@jgowdyelastic
[ML] Fixing anomaly chart empty query bug (elastic#246841)
88ab00d 
(cherry picked from commit b61dc27)
@kibanamachine kibanamachine mentioned this pull request Dec 19, 2025
Merged
@kibanamachine
Copy link
Contributor

kibanamachine commented Dec 19, 2025

💚 All backports created successfully

Status Branch Result
✅ 9.2
✅ 9.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation
baileycash-elastic pushed a commit to baileycash-elastic/kibana that referenced this pull request Dec 19, 2025
@jgowdyelastic @baileycash-elastic
[ML] Fixing anomaly chart empty query bug (elastic#246841)
7832a42
kibanamachine added a commit that referenced this pull request Dec 23, 2025
@kibanamachine @jgowdyelastic
[9.2] [ML] Fixing anomaly chart empty query bug (#246841) (#247160)
d9831e1 
# Backport

This will backport the following commits from `main` to `9.2`:
- [[ML] Fixing anomaly chart empty query bug
(#246841)](#246841)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"James
Gowdy","email":"jgowdy@elastic.co"},"sourceCommit":{"committedDate":"2025-12-19T18:04:50Z","message":"[ML]
Fixing anomaly chart empty query bug
(#246841)","sha":"b61dc27ea2a90eab266403248a547e3f5ee366ee","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix",":ml","Feature:Anomaly
Detection","backport:version","v9.3.0","v9.4.0","v9.2.4"],"title":"[ML]
Fixing anomaly chart empty query
bug","number":246841,"url":"https://github.com/elastic/kibana/pull/246841","mergeCommit":{"message":"[ML]
Fixing anomaly chart empty query bug
(#246841)","sha":"b61dc27ea2a90eab266403248a547e3f5ee366ee"}},"sourceBranch":"main","suggestedTargetBranches":["9.3","9.2"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/246841","number":246841,"mergeCommit":{"message":"[ML]
Fixing anomaly chart empty query bug
(#246841)","sha":"b61dc27ea2a90eab266403248a547e3f5ee366ee"}},{"branch":"9.2","label":"v9.2.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

---------

Co-authored-by: James Gowdy <jgowdy@elastic.co>
kibanamachine added a commit that referenced this pull request Dec 23, 2025
@kibanamachine @jgowdyelastic
[9.3] [ML] Fixing anomaly chart empty query bug (#246841) (#247161)
e0e4e09 
# Backport

This will backport the following commits from `main` to `9.3`:
- [[ML] Fixing anomaly chart empty query bug
(#246841)](#246841)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"James
Gowdy","email":"jgowdy@elastic.co"},"sourceCommit":{"committedDate":"2025-12-19T18:04:50Z","message":"[ML]
Fixing anomaly chart empty query bug
(#246841)","sha":"b61dc27ea2a90eab266403248a547e3f5ee366ee","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix",":ml","Feature:Anomaly
Detection","backport:version","v9.3.0","v9.4.0","v9.2.4"],"title":"[ML]
Fixing anomaly chart empty query
bug","number":246841,"url":"https://github.com/elastic/kibana/pull/246841","mergeCommit":{"message":"[ML]
Fixing anomaly chart empty query bug
(#246841)","sha":"b61dc27ea2a90eab266403248a547e3f5ee366ee"}},"sourceBranch":"main","suggestedTargetBranches":["9.3","9.2"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/246841","number":246841,"mergeCommit":{"message":"[ML]
Fixing anomaly chart empty query bug
(#246841)","sha":"b61dc27ea2a90eab266403248a547e3f5ee366ee"}},{"branch":"9.2","label":"v9.2.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: James Gowdy <jgowdy@elastic.co>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Jan 6, 2026
@jgowdyelastic @CAWilson94
[ML] Fixing anomaly chart empty query bug (elastic#246841)
c6ccfc2
dej611 pushed a commit to dej611/kibana that referenced this pull request Jan 8, 2026
@jgowdyelastic @dej611
[ML] Fixing anomaly chart empty query bug (elastic#246841)
bbcf6d1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels Feature:Anomaly Detection ML anomaly detection :ml release_note:fix v9.2.4 v9.3.0 v9.4.0

5 participants

@jgowdyelastic @elasticmachine @kibanamachine @peteharverson @qn895