[Security Solution]Error in Default on ES|QL tab

[ghost]

Describe the bug: Error in Default on ES|QL tab

Kibana/Elasticsearch Stack version Version: 8.11.4 BC1 Commit: 4e90188951eb2dce4f4a0d45ba1a0b9ae9efe19d Build: 68328

Browser and Browser OS Version: Firefox for windows OS Version: 121.0

Elastic Endpoint Version: N/A

Original install method: None

Functional Area: ES|QL

Initial Setup:

• None

precondition

• N/A

Steps to reproduce

• Create an Timeline
• Move to ES|QL Tab
• Validate that user view the Error on default on ES|QL tab due to blank query tab. however it should be handled in better way for first time landing

Additional Result

• we are aware of this change of keeping no query in query bar of ES|QL which is the reason of this error to appear . However it can be handled in better way for first time visit to ES|QL as user will get this error without doing any action on ES|QL tab

Current Result

• Error in Default on ES|QL tab

Expected behavior:

• Better handling on ES|QL tab to avoid showing error in first place

Screen-Cast:

https://github.com/elastic/kibana/assets/59917825/c6203f0f-999b-454a-b84d-cbd2bf7e0c87

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

[MadameSheema]

Thanks for the report!!

Closing the ticket since there is no default query anymore.

[ghost]

@MadameSheema by default we meant to say default empty query state. when user goes for creating fresh timeline user get the error response which is requested to be handled in a better way .

[PhilippeOberti]

@MadameSheema by default we meant to say default empty query state. when user goes for creating fresh timeline user get the error response which is requested to be handled in a better way .

@karanbirsingh-qasource we want the same thing, the challenge at the moment is that we do not control this, we're purely loading the Discover page inside the tab, so we are relying on them making the change. You can actually reproduce this behavior by trying to run an empty query on the Discover page.

[ghost]

ok understood @PhilippeOberti thanks for sharing this insight