[8.19] [ES|QL] Use correct timeFieldName for time brush filter (#221322) (#221524)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[ES|QL] Use correct timeFieldName for time brush filter
(#221322)](#221322)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Marco
Vettorello","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-05-26T14:41:06Z","message":"[ES|QL]
Use correct timeFieldName for time brush filter (#221322)\n\n##
Summary\n\nfix #221241\n\n## Bug and fix descriptions\n\nThe logic that
applies a time filter by updating the time picker vs\nadding it as a
filter pill in the filter bar is described
here:\n\nhttps://github.com/elastic/kibana/blob/e877bafa3e4725d3e7cfd3b2ca0be4bc6d88a0b9/src/platform/plugins/shared/unified_search/public/actions/apply_filter_action/apply_filter_action.tsx#L107-L114\n\nThe
`extractTimeFilter` function extracts the `timeRangeFilter` only if\nthe
`timeFieldName === keys(filter.query.range)[0]` . The problem was\nthat
the first key of `query.range` was different than the\n`timeFieldName`.
That `timeFieldName` in the ESQL world was wrongly\napplied via the `
table.columns[xAxisColumnIndex].name` that doesn't\nreflect the actual
column name for ES|QL, in fact that name reflect the\nvisualization
label name for the time dimension. In particular, before\nthe fix, that
timeFieldName was set as the axis name (e.g.`@timestamp\nevery 5 minute`
) and cause the time range filter to fail to be\nextracted from the
filters list.\n\nA combination of two PRs caused this to be now anymore
the correct\nbehaviour:\n- this PR
#196049 introduced the\nuse of the
`souceField` as field name for the creation of filter from a\nrange\n-
this PR #217719
instead\nintroduced the use of `sourceField` also for ESQL datasources.
This\nfield points to the actual column name described in the ESQL
query.\n\nBoth PR causes the `extractTimeFilter` to fail to extract
the\ntimeFilter, pushing the filter up to the filter pills.\n\n### Side
notes\n\nThis could be probably fixed in other ways, like by avoiding
using the\n`sourceField` in ESQL, or by using only the column.name in
the filter\ncreation, or by avoiding checking the `timeFieldName`
against the\n`query.range` key (not really sure why this is required).
In general the\nproblem here is that there is a low confidence on what
these\nfields/params are supposed to be and which is supposted to be
the\nidentifiers to use everywhere. For example the column ids reflects
only\na link between the rows and the column descriptions, the name is
the\nassociated label, but can we rely on that label for filtering? i
believe\nwe need a stronger connection with the data and the actual
original\nsource field or column identifier is a better choice.\nI
believe a valid subsequent task
is\nhttps://github.com//issues/189044","sha":"eb4ba962ec29256f086ade49d04150c3aec1789b","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","Team:Visualizations","release_note:skip","Feature:ES|QL","backport:version","v9.1.0","v8.19.0"],"title":"[ES|QL]
Use correct timeFieldName for time brush
filter","number":221322,"url":"https://github.com/elastic/kibana/pull/221322","mergeCommit":{"message":"[ES|QL]
Use correct timeFieldName for time brush filter (#221322)\n\n##
Summary\n\nfix #221241\n\n## Bug and fix descriptions\n\nThe logic that
applies a time filter by updating the time picker vs\nadding it as a
filter pill in the filter bar is described
here:\n\nhttps://github.com/elastic/kibana/blob/e877bafa3e4725d3e7cfd3b2ca0be4bc6d88a0b9/src/platform/plugins/shared/unified_search/public/actions/apply_filter_action/apply_filter_action.tsx#L107-L114\n\nThe
`extractTimeFilter` function extracts the `timeRangeFilter` only if\nthe
`timeFieldName === keys(filter.query.range)[0]` . The problem was\nthat
the first key of `query.range` was different than the\n`timeFieldName`.
That `timeFieldName` in the ESQL world was wrongly\napplied via the `
table.columns[xAxisColumnIndex].name` that doesn't\nreflect the actual
column name for ES|QL, in fact that name reflect the\nvisualization
label name for the time dimension. In particular, before\nthe fix, that
timeFieldName was set as the axis name (e.g.`@timestamp\nevery 5 minute`
) and cause the time range filter to fail to be\nextracted from the
filters list.\n\nA combination of two PRs caused this to be now anymore
the correct\nbehaviour:\n- this PR
#196049 introduced the\nuse of the
`souceField` as field name for the creation of filter from a\nrange\n-
this PR #217719
instead\nintroduced the use of `sourceField` also for ESQL datasources.
This\nfield points to the actual column name described in the ESQL
query.\n\nBoth PR causes the `extractTimeFilter` to fail to extract
the\ntimeFilter, pushing the filter up to the filter pills.\n\n### Side
notes\n\nThis could be probably fixed in other ways, like by avoiding
using the\n`sourceField` in ESQL, or by using only the column.name in
the filter\ncreation, or by avoiding checking the `timeFieldName`
against the\n`query.range` key (not really sure why this is required).
In general the\nproblem here is that there is a low confidence on what
these\nfields/params are supposed to be and which is supposted to be
the\nidentifiers to use everywhere. For example the column ids reflects
only\na link between the rows and the column descriptions, the name is
the\nassociated label, but can we rely on that label for filtering? i
believe\nwe need a stronger connection with the data and the actual
original\nsource field or column identifier is a better choice.\nI
believe a valid subsequent task
is\nhttps://github.com//issues/189044","sha":"eb4ba962ec29256f086ade49d04150c3aec1789b"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/221322","number":221322,"mergeCommit":{"message":"[ES|QL]
Use correct timeFieldName for time brush filter (#221322)\n\n##
Summary\n\nfix #221241\n\n## Bug and fix descriptions\n\nThe logic that
applies a time filter by updating the time picker vs\nadding it as a
filter pill in the filter bar is described
here:\n\nhttps://github.com/elastic/kibana/blob/e877bafa3e4725d3e7cfd3b2ca0be4bc6d88a0b9/src/platform/plugins/shared/unified_search/public/actions/apply_filter_action/apply_filter_action.tsx#L107-L114\n\nThe
`extractTimeFilter` function extracts the `timeRangeFilter` only if\nthe
`timeFieldName === keys(filter.query.range)[0]` . The problem was\nthat
the first key of `query.range` was different than the\n`timeFieldName`.
That `timeFieldName` in the ESQL world was wrongly\napplied via the `
table.columns[xAxisColumnIndex].name` that doesn't\nreflect the actual
column name for ES|QL, in fact that name reflect the\nvisualization
label name for the time dimension. In particular, before\nthe fix, that
timeFieldName was set as the axis name (e.g.`@timestamp\nevery 5 minute`
) and cause the time range filter to fail to be\nextracted from the
filters list.\n\nA combination of two PRs caused this to be now anymore
the correct\nbehaviour:\n- this PR
#196049 introduced the\nuse of the
`souceField` as field name for the creation of filter from a\nrange\n-
this PR #217719
instead\nintroduced the use of `sourceField` also for ESQL datasources.
This\nfield points to the actual column name described in the ESQL
query.\n\nBoth PR causes the `extractTimeFilter` to fail to extract
the\ntimeFilter, pushing the filter up to the filter pills.\n\n### Side
notes\n\nThis could be probably fixed in other ways, like by avoiding
using the\n`sourceField` in ESQL, or by using only the column.name in
the filter\ncreation, or by avoiding checking the `timeFieldName`
against the\n`query.range` key (not really sure why this is required).
In general the\nproblem here is that there is a low confidence on what
these\nfields/params are supposed to be and which is supposted to be
the\nidentifiers to use everywhere. For example the column ids reflects
only\na link between the rows and the column descriptions, the name is
the\nassociated label, but can we rely on that label for filtering? i
believe\nwe need a stronger connection with the data and the actual
original\nsource field or column identifier is a better choice.\nI
believe a valid subsequent task
is\nhttps://github.com//issues/189044","sha":"eb4ba962ec29256f086ade49d04150c3aec1789b"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Marco Vettorello <[email protected]>

Author: kibanamachine

src/platform/packages/shared/kbn-es-query/src/filters/helpers/extract_time_filter.ts

@@ -12,28 +12,28 @@ import { Filter, isRangeFilter, RangeFilter } from '../build_filters';
 import { TimeRange } from './types';
 import { convertRangeFilterToTimeRangeString } from './convert_range_filter';
 
-export function extractTimeFilter(timeFieldName: string, filters: Filter[]) {
-  const [timeRangeFilter, restOfFilters] = partition(filters, (obj: Filter) => {
-    let key;
-
-    if (isRangeFilter(obj)) {
-      key = keys(obj.query.range)[0];
-    }
-
-    return Boolean(key && key === timeFieldName);
-  });
+export function extractTimeFilter(
+  timeFieldName: string,
+  filters: Filter[]
+): { restOfFilters: Filter[]; timeRangeFilter?: RangeFilter } {
+  const [timeRangeFilter, restOfFilters] = partition<Filter, RangeFilter>(
+    filters,
+    (f: Filter): f is RangeFilter => isRangeFilter(f) && timeFieldName === keys(f.query.range)[0]
+  );
 
   return {
     restOfFilters,
-    timeRangeFilter: timeRangeFilter[0] as RangeFilter | undefined,
+    timeRangeFilter: timeRangeFilter[0],
   };
 }
 
 export function extractTimeRange(
   filters: Filter[],
   timeFieldName?: string
 ): { restOfFilters: Filter[]; timeRange?: TimeRange } {
-  if (!timeFieldName) return { restOfFilters: filters, timeRange: undefined };
+  if (!timeFieldName) {
+    return { restOfFilters: filters };
+  }
   const { timeRangeFilter, restOfFilters } = extractTimeFilter(timeFieldName, filters);
   return {
     restOfFilters,

src/platform/plugins/shared/chart_expressions/expression_xy/public/components/xy_chart.tsx

@@ -658,12 +658,16 @@ export function XYChart({
         ? getAccessorByDimension(dataLayers[0].xAccessor, table.columns)
         : undefined;
     const xAxisColumnIndex = table.columns.findIndex((el) => el.id === xAccessor);
-
     const context: BrushEvent['data'] = {
       range: [min, max],
       table,
       column: xAxisColumnIndex,
-      ...(isEsqlMode ? { timeFieldName: table.columns[xAxisColumnIndex].name } : {}),
+      ...(isEsqlMode
+        ? {
+            timeFieldName:
+              table.columns[xAxisColumnIndex].meta.sourceParams?.sourceField?.toString(),
+          }
+        : {}),
     };
     onSelectRange(context);
   };

src/platform/test/functional/apps/discover/esql/_esql_view.ts

@@ -26,6 +26,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const esql = getService('esql');
   const dashboardAddPanel = getService('dashboardAddPanel');
   const dataViews = getService('dataViews');
+  const elasticChart = getService('elasticChart');
+  const filterBar = getService('filterBar');
+
   const { common, discover, dashboard, header, timePicker, unifiedFieldList, unifiedSearch } =
     getPageObjects([
       'common',
@@ -236,6 +239,36 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         const cell = await dataGrid.getCellElementExcludingControlColumns(0, 0);
         expect(await cell.getVisibleText()).to.be('1');
       });
+
+      it('should allow brushing time series', async () => {
+        await timePicker.setDefaultAbsoluteRange();
+        await discover.selectTextBaseLang();
+        await header.waitUntilLoadingHasFinished();
+        await discover.waitUntilSearchingHasFinished();
+        await unifiedFieldList.waitUntilSidebarHasLoaded();
+
+        const testQuery = `from logstash-* | limit 100`;
+
+        await monacoEditor.setCodeEditorValue(testQuery);
+        await testSubjects.click('querySubmitButton');
+        await header.waitUntilLoadingHasFinished();
+        await discover.waitUntilSearchingHasFinished();
+
+        const initialTimeConfig = await timePicker.getTimeConfigAsAbsoluteTimes();
+        expect(initialTimeConfig.start).to.equal(timePicker.defaultStartTime);
+        expect(initialTimeConfig.end).to.equal(timePicker.defaultEndTime);
+
+        const renderingCount = await elasticChart.getVisualizationRenderingCount();
+        await discover.brushHistogram();
+        await discover.waitUntilSearchingHasFinished();
+        // no filter pill created for time brush
+        expect(await filterBar.getFilterCount()).to.be(0);
+        // chart and time picker updated
+        await elasticChart.waitForRenderingCount(renderingCount + 1);
+        const updatedTimeConfig = await timePicker.getTimeConfigAsAbsoluteTimes();
+        expect(updatedTimeConfig.start).to.be('Sep 20, 2015 @ 08:41:22.854');
+        expect(updatedTimeConfig.end).to.be('Sep 21, 2015 @ 04:14:56.951');
+      });
     });
 
     describe('errors', () => {