Summary

Closes #178069

This PR fixes agent policies KQL filtering in Fleet UI. Because agent policy data is retrieved from Saved Objects, the policy fields require the SO prefix (ingest-agent-policies), which was removed in #161064, to be present (see #178069 (comment) for details). A further ER captures the requirements for displaying custom labels without the prefix.

In Fleet UI, the SearchBar component that uses KQL filtering is used in three tabs:

• Agents
• Agent policies
• Enrollment tokens

Note that the search inputs in the Uninstall tokens and Data streams tabs are simple text filtering, not KQL.

The filtering behaviour with this fix matches the one in 8.11.0 and is captured in the screen recording below:

• Agents tab: agent fields (e.g. policy_id or agent.version)
• Agent policies tab: agent policy fields prefixed with ingest-agent-policies (e.g. ingest-agent-policies.name)
• Enrollment tokens tab: token fields (e.g. name or policy_id)

Screen recording

This screen recording shows working KQL filtering and suggestions for the three tabs (fixed for Agent policies):

Testing

1. Create a few agent policies and enroll a couple of agents.
2. Test that the expected fields are shown in the KQL search bars for agents, agent policies and enrollment tokens. For each, check that suggestions are shown when you select a particular field with existing values.
3. For agent policies in particular, also check that KQL syntax works as expect. For instance, if you have an agent policy named "Test agent policy", the query ingest-agent-policies.name : *agent* should correctly filter for it.

Checklist

• Unit or functional tests were updated or added to match the most common scenarios