opensearch-project / observability

Visualize and explore your logs, traces and metrics data in OpenSearch Dashboards
https://opensearch.org/docs/latest/observability-plugin/index/
Apache License 2.0
53 stars 98 forks source link

[BUG] Double quotes in WHERE statements lead to no returned results #1851

Closed A-Gray-Cat closed 3 months ago

A-Gray-Cat commented 3 months ago

What is the bug? Running a query where filters are applied by referencing data in double quotes returns no results. Using single quotes instead works as expected. The documentation references using double quotes for these types of statements so this bug can lead to user confusion. How can one reproduce the bug? Steps to reproduce the behavior:

  1. Go to Data sources -> securitylake -> query data -> open log explorer
  2. Run the follow queries:
    
    SELECT * 
    FROM
    securitylake.amazon_security_lake_glue_db_us_east_1.amazon_security_lake_table_us_east_1_cloud_trail_mgmt_2_0
    WHERE time_dt > "2024-07-31 00:00:00"
    AND region = "us-east-1"
    LIMIT 10

source = securitylake.amazon_security_lake_glue_db_us_east_1.amazon_security_lake_table_us_east_1_cloud_trail_mgmt_2_0 | where time_dt > "2024-07-31 00:00:00" and region = "us-east-1" | head 10



**What is the expected behavior?**
Filters are applied, and results that met the criteria returned

**What is your host/environment?**
 - OS: [e.g. iOS]
 - Version 2.13
 - Plugins

**Do you have any screenshots?**
If applicable, add screenshots to help explain your problem.

**Do you have any additional context?**
Add any other context about the problem.