search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.35k stars 7.98k forks source link

Elasticsearch KQL query rule fails with `TypeError: Cannot read properties of undefined (reading 'type')` #182879

Closed ymao1 closed 1 week ago

ymao1 commented 1 week ago

Elasticsearch KQL rules which use data views and determine the time field to use for the rule condition match query based on the time field of the data view can run into an issue where a user creates a rule with a data view with a certain time field, then modifies the data view to have a different time field, the rule can fail with the error TypeError: Cannot read properties of undefined (reading 'type').

elasticmachine commented 1 week ago

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

jughosta commented 1 week ago

Hi @ymao1,

Thanks for reporting! I tried that locally and the rule continued to work with the original time field which seems to me expected. ~Could you please share steps on how to reproduce and where this error would be logged?~

Update: found the Slack thread about it.