[BUG] Dashboard filter ignores index pattern

[franco-martin]

Describe the bug When using multiple index patterns in a dashboards, creating a filter applies it to all index patterns regardless of the "index pattern" field.

To Reproduce Steps to reproduce the behavior:

1. Create a dashboard with visualizations that use two index patterns that have different fields
2. Create a filter with a field that exists only in one of the index patterns.
3. Verify the filter is applied to all visualizations

Expected behavior The filter should only be applied to the index patterns that are selected.

OpenSearch Version 2.13.0

Dashboards Version 2.13.0

Plugins

Please list all plugins currently enabled.

Screenshots

Host/Environment (please complete the following information):

• OS: [e.g. iOS]
• Browser and version [e.g. 22]

Additional context In the attached screenshots I'm using data from metricbeat and a custom app called cluster-monitor. Metricbeat has fields.role while cluster-monitor doesn't have it. The dashboard has visualizations that use both index patterns. I have a generic load visualization that displays system load over time using tsvb and I'd like to use it to filter the role in the dashboard instead of having to create copies of the visualizations for each filter.

[franco-martin]

As a workaround the following filter works: fields.role:opensearch or _index:cluster-monitor* or using the following code as a query DSL filter

{
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "bool": {
                  "should": [
                    {
                      "match": {
                        "fields.role": "opensearch"
                      }
                    }
                  ],
                  "minimum_should_match": 1
                }
              },
              {
                "bool": {
                  "should": [
                    {
                      "query_string": {
                        "fields": [
                          "_index"
                        ],
                        "query": "cluster\\-monitor*"
                      }
                    }
                  ],
                  "minimum_should_match": 1
                }
              }
            ],
            "minimum_should_match": 1
          }
        },
        {
          "match_all": {}
        }
      ]
    }
  }

[kavilla]

Hello @franco-martin,

Can you please try setting this setting in your Advanced Settings: courier:ignoreFilterIfFieldNotInIndex?

This configuration enhances support for dashboards containing visualizations accessing dissimilar indexes. When disabled, all filters are applied to all visualizations. When enabled, filter(s) will be ignored for a visualization when the visualization's index does not contain the filtering field.

And lemme know if this is what you were looking for?

[franco-martin]

That did seem to fix it for when using multiple indices. But when using the same index, it doesn't fix it completely. In my scenario, I got kubernetes nodes that have metricbeat installed on them and they send "fields.role: kubernetes". I also got metricbeat running as a deployment within kubernetes to get the state of pods, nodes, etc but it doesn't send fields.role: kubernetes". In this second scenario when I filter for "fields.role: kubernetes" the visualizations that use the fields from pod state are also filtered and don't show any data. The option you suggest is also breaking the filter I was using :)