Summary

The SIEM app is migrating to using SavedObjects which also means migrating all their queries. Since these are written in KQL rewriting them as Simple Query Strings will be time-consuming and error-prone. In addition, Simple Query String doesn't support range queries.

Since KQL is designed as a simple filter language it doesn't replace searching with Simple Query Strings in Saved Objects but rather can be used in addition to constructing more powerful queries.

Dev Docs

SavedObjectsClient.find now supports filtering using a KQL string, with the caveat that if you filter with an attribute from your type saved object, it should look like this: savedObjectType.attributes.name: "SayMyName". However, If you use a direct attribute of a saved object like updatedAt, you will have to define your filter like this: savedObjectType.updatedAt > 2018-12-22.

savedObjectsClient.find({
      type: 'savedObjectType',
      sortField: '@timestamp',
      sortOrder: 'desc',
      search: '',
      searchFields:'',
      fields: ['id', 'name', '@created', '@timestamp'],
      filter:
        'savedObjectType.attributes.name: "SayMyName" and savedObjectType.updatedAt > 2018-12-22'
    });

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• [ ] This was checked for cross-browser compatibility, including a check against IE11
• [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials~~
• Unit or functional tests were updated or added to match the most common scenarios
• [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

• [ ] This was checked for breaking API changes and was labeled appropriately
• [ ] This includes a feature addition or change that requires a release note and was labeled appropriately