[Logs UI] Correctly filter for log rate anomaly examples with missing dataset (#76775)

This fixes #76493 by querying for the "unknown" (i.e. empty) dataset using an exists clause. This should be in line with how ML anomaly detection treats missing partition values.
2020-09-22 19:32:50 +02:00 · 2020-09-22 19:32:50 +02:00 · e0aeebc149
parent 311805a57d
commit e0aeebc149
1 changed files with 14 additions and 2 deletions
--- a/x-pack/plugins/infra/server/lib/log_analysis/queries/log_entry_examples.ts
+++ b/x-pack/plugins/infra/server/lib/log_analysis/queries/log_entry_examples.ts
@ -33,7 +33,7 @@ export const createLogEntryExamplesQuery = (
              },
            },
          },
-          ...(!!dataset
+          ...(dataset !== ''
            ? [
                {
                  term: {
@ -41,7 +41,19 @@ export const createLogEntryExamplesQuery = (
                  },
                },
              ]
-            : []),
+            : [
+                {
+                  bool: {
+                    must_not: [
+                      {
+                        exists: {
+                          field: partitionField,
+                        },
+                      },
+                    ],
+                  },
+                },
+              ]),
          ...(categoryQuery
            ? [
                {