The help/suggestion feature on the search bar is not working

[Mayons]

Wazuh	Elastic	Rev	Security
4.3	7.10.2	4.3 RC3	ODFE

Browser
Chrome, Firefox, Safari, etc

Description The help/suggestion search feature is not working

Steps to reproduce

1. Login to wazuh-kibana app
2. Navigate to any dashboard
3. Click on the search field
4. Start writing a valid query (Ex: agent...)

Expected Result: Under the search field it should be displayed a help/suggest windows to complete the search query. Actual Result: The help/suggest query window is not displayed

Screenshots

Additional context Add any other context about the problem here. Here you can paste log entries too or any other useful information that may help with the issue.

[AlexRuiz7]

is OpenDistro or OpenSearch?

[Mayons]

This bug is also reproducible on Open Search 1.2.0 with Wazuh 4.3 @matiasmoreno876 @MauGaP @AlexRuiz7

[Mayons]

We test this issue again with @mauceballos and @Desvelao and we identify that the suggestions on the search bar are displayed using x-pack security for Kibana 7.10.2, but with ODFE not. We also tested in new versions with basic authentication and the suggestions are displayed on the search bar.

[Desvelao]

Research

I was investigating this, and I can confirm that the autocompletion suggestion feature in the search bar, that is used in the Wazuh plugin for the Module/Dashboard or Module/Events and that is coming from the plugin platform core, is offered only by X-Pack.

One of the X-Pack plugins, data_enhanced, registers a query suggestion provider for the kuery language: https://github.com/elastic/kibana/blob/v7.10.2/x-pack/plugins/data_enhanced/public/plugin.ts#L32-L35

The search bar component uses the registered suggestion provider for the language to build the suggestions that are displayed in the UI. See https://github.com/elastic/kibana/blob/v7.10.2/src/plugins/data/public/ui/query_string_input/query_string_input.tsx#L149-L180

The Kibana OSS distribution (v7.10.2 or older) has no available the suggestion provider. OpenSearch Dashboards, that was a fork of Kibana OSS v7.10.2, and in its current version (v1.2.0) has not defined an autocompletion provider for the kuery language.

So, if we want to add autocompletion suggestions, we have to build the suggestion provider.

For OpenSearch Dashboards (or Wazuh dashboard) case, taking in account that the kuery language is used in the core, maybe this could be a feature added by the plugin platform itself.

[gdiazlo]

Won't do. The underlying platform does not support suggestion.