[Unified search] Complex filter capabilities - Support ORs

[stratoula]

Describe the feature:
We want to give the users the ability to create more complex filter expressions by supporting ORs.

Currently, the users are able to create one filter at the time and all the filters applied are related with AND. (filter1: A AND filter2: B etc). We would like to enhance our query builder in order to give the users the ability to create N-depth complexity filters related with AND/ORs.

The UI will look like this:

Tasks:

Step 1 (preparation):

• Create a filter form component which will work with nested OR/AND filters
  Notes:
  - nesting is limited by the passed parameter;
  - user should be able to add/modify multiple filters with complex relationships;
  - new component should support drag and drop experience;
  - new component should be developed with the focus of what will become shared.

Step 2 (integration):

• Moves the filter form and DSL query into a robust modal
• The filters will be presented to the UI as enhanced filter badges

Notes

• In order to create smaller PRS and being able to work on this in parallel, we should create a feature branch.
• This task needs user testing as it introduces many changes

[elasticmachine]

Pinging @elastic/kibana-app-services (Team:AppServicesSv)

[elasticmachine]

Pinging @elastic/kibana-visualizations @elastic/kibana-visualizations-external (Team:Visualizations)

[cyber-petushator]

Hello! This seems to be completed, but when we can see it in Kibana release?

[stratoula]

It is available in 8.7!

[cyber-petushator]

It is available in 8.7!

Thanks will try it. Din't know it's out. Very recently! :)

[cyber-petushator]

It is available in 8.7!

Yes. It is up and running in 8.7. Thank you.
Unfortunately it does not work as i hope...
This feature give user filter builder gui which allow to build SINGLE complex filter (with AND/OR relationships within this complex filter). This filter in fact turns into simple KQL query (which is frankly faster to write than select from gui).

What this feature lacks - it is ability to quickly add new filter from some Discover / Dashboard / Map by selected field value with OR relationship to already existing filters collection.

That, in my humble opinion, makes this feature quite useless :(

At least for my user cases. (Didn't meant to disappoint devs).

[stratoula]

@cyber-petushator something like that you mean? #148372

[cyber-petushator]

@cyber-petushator something like that you mean? #148372

Thanks for reply!
Mentioned feature are closer to what iam looking for but not exactly.

If you don't mind i'll try to give live example.
Let's take a map (Kibana-maps) which tracks active entities and may present historical data for chosen entities.
Let's pretend we tracking network connection (with geoip). By default operator have preconfigured filter "ActiveConnection:true" which correspond to appropriate field in doc.
Now some connection picks an interest, operator chose it with mouse click. Tooltip with info comes up.

Now what iam struggling to achieve is to give user ability to click on some field in tooltip which is uniquely describe entity (like IP address) to show all historical data about this entity.

That in filter language should mean:
Add to existing filter new filter with OR. Like:
ActiveConnection:true OR IP:1.2.3.4
Thing is it should be two separate filter. One should be preconfigured (and basically always on) and second one should be addable via click on some property but with OR (not AND is it now).

[stratoula]

I see so you would like 2 filter pills in this case but connected with OR not AND. It is not possible atm unfortunately, if you want to create an OR relationship it should be on the same filter pill.

One ehnancement could be to give the option to disable temporarily filter rows, e.g. I could disable the second one

Wdyt?

[cyber-petushator]

I see so you would like 2 filter pills in this case but connected with OR not AND. It is not possible atm unfortunately, if you want to create an OR relationship it should be on the same filter pill.

One ehnancement could be to give the option to disable temporarily filter rows, e.g. I could disable the second one

Wdyt?

Thanks for understanding. Iam glad to reach the understanding that is not possible ( that means that i didn't miss some knowledge how to do it).

About enhancement you mention - i don't see how it helps (in my case). Thank you nonetheless!