Error Leading wildcards are disabled. See query:allowLeadingWildcards in Advanced Settings. when this option is already enabled

[narph]

Kibana version: 7.6.0

Elasticsearch version: 7.6.0

Describe the bug:
When building a visualization ex. Horizontal Bar and adding a KQL filter in we get the error message on the right side:

[esaggs] > Leading wildcards are disabled. See query:allowLeadingWildcards in Advanced Settings. user.keyword : * kimchy ---------------^

The query:allowLeadingWildcards option is already enabled in Kibana. This worked in previous versions.

Steps to reproduce:

1. Make sure query:allowLeadingWildcards is enabled in Kibana
2. Run:

POST twitter/_doc/
{
    "user" : "ekimchy",
    "post_date" : "2020-01-15T14:12:12",
    "message" : "trying out dss Elasticsearch"
}

3. Create twitter index pattern and attempt to build a Horizontal bar visualization with the filter:
   user.keyword : * kimchy
   or
   user : * kimchy

Expected behavior: Expected to see any data or not depending on the filter instead we get:

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[AlonaNadler]

@timroes is it a good candidate to the fix it week?

[Echbert]

We have the same issue.

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)

[philippkahr]

I tried toggling on and off the setting in the Kibana advanced settings tab. it still tells me that leading wildcards are disabled.

[lukasolson]

I've got a fresh install of 7.6, followed your steps exactly, and I'm not able to reproduce the issue. Obviously, since others are also having this issue, there's got to be something to it. Can you reproduce it creating a new visualization or is the visualization you're using one you created prior to 7.6? Does refreshing the page help?

[KevSex]

Receiving this error when using the below default dashboards:
[Filebeat Azure] User Activity
[Filebeat Azure] Cloud Overview
This was after configuring the Azure module within filebeat (7.6.0)

azure.activitylogs.identity.action : *write

[hadiatou2k20]

I got the same error when i import object from a previous version (7.4.1 and 7.3.1) to the 7.6.1 . It comes from a vzualisation where i have different KQL filters

[lukeelmers]

So far I'm also unable to reproduce. Tested the following two scenarios:

1. Tried the steps to reproduced outlined at the top of the issue on a fresh 7.6.0 install (docker), and no luck.
2. Using that same sample document, tried creating a horizontal bar chart in 7.4.1, saving it with a KQL query containing a leading wildcard, and embedding it in a dashboard. Exported and imported into a fresh 7.6.0 install, still unable to reproduce: both the visualization & the dashboard load as expected.

@hadiatou2k20 Do you by chance have a sample document & visualization object you'd be able to share which could be used to reproduce this?

[fastlorenzo]

FYI - I've got the same error in a visualization filter:

The same query works in the discover view:

Kibana: 7.6.2
Elasticsearch: 7.6.2

[bplessis]

Same here with elasticsearch installed from scratch starting at 7.6 and upgraded to 7.6.2

Error only seen in the visualisation filter like @fastlorenzo

[KeeganStandifer]

Running into this on 7.6.1 when separating pie graphs slices with KQL filters. We appreciate any assist with this bug.

[lukeelmers]

I was finally able to reproduce this on 7.6.2 -- not sure why Lukas and I had troubles with it before, but here are the steps I followed:

1. Ingest test documents:

POST oops/_doc
{
  "created_at": "2020-04-25T08:21:10.881Z",
  "fancy_title": "Hello World"
}

POST oops/_doc
{
  "created_at": "2020-04-22T08:21:13.658Z",
  "fancy_title": "Foo Bar"
}

2. Create oops* index pattern with created_at timefield
3. Ensure query:allowLeadingWildcards is set to true
4. Create new bar chart visualization with split series filters agg
   • Use KQL with the following query: fancy_title.keyword : *Foo*

Worth noting that this issue is only present in 7.6, not 7.5 or 7.7. Here are the versions I tested:

• ✅ 7.3.2
• ✅ 7.4.2
• ✅ 7.5.2
• ❌ 7.6.1
• ❌ 7.6.2
• ✅ 7.7.0
• ✅ master

I am putting up a fix for 7.6 so that it can be included should there end up being a 7.6.3 release. Otherwise, this issue should be resolved for folks by upgrading to 7.7

[lukeelmers]

Closed by #67227

Should there end up being a 7.6.3 release, this fix will be included.
Otherwise, this issue is resolved starting in 7.7