[ML] AIOps: Improve cleanup of default queries. (#176534)

## Summary

- Moves some query utils from the `transform` plugin to
`@kbn/ml-query-utils` to make them available for the `aiops` plugin.
This allows us to better clean up default queries before sending them
off to API endpoints. Some more unit tests have been added as well as
query utils to clean up the default queries we get from EUI search query
bars.
- Adds assertions for url state to `aiops` functional tests. These
ensure that the overall time frame and window parameters for analysis
get correctly set.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

x-pack/packages/ml/query_utils/index.ts

@@ -7,8 +7,17 @@
 
 export { addExcludeFrozenToQuery } from './src/add_exclude_frozen_to_query';
 export { buildBaseFilterCriteria } from './src/build_base_filter_criteria';
+export { isDefaultQuery } from './src/default_query';
 export { ES_CLIENT_TOTAL_HITS_RELATION } from './src/es_client_total_hits_relation';
 export { getSafeAggregationName } from './src/get_safe_aggregation_name';
+export { matchAllQuery, isMatchAllQuery } from './src/match_all_query';
+export { isSimpleQuery } from './src/simple_query';
 export { SEARCH_QUERY_LANGUAGE } from './src/types';
-export type { SearchQueryLanguage } from './src/types';
+export type {
+  BoolFilterBasedSimpleQuery,
+  SavedSearchQuery,
+  SearchQueryLanguage,
+  SearchQueryVariant,
+  SimpleQuery,
+} from './src/types';
 export { getDefaultDSLQuery } from './src/get_default_query';

x-pack/packages/ml/query_utils/src/__mocks__/simple_query.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SearchQueryVariant } from '../types';
+
+export const simpleQueryMock: SearchQueryVariant = { query_string: { query: 'airline:AAL' } };

x-pack/packages/ml/query_utils/src/bool_filter_based_simple_query.test.ts

@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isBoolFilterBasedSimpleQuery } from './bool_filter_based_simple_query';
+import { simpleQueryMock } from './__mocks__/simple_query';
+import { matchAllQuery } from './match_all_query';
+import { defaultSimpleQuery } from './simple_query';
+
+describe('isBoolFilterBasedSimpleQuery', () => {
+  it('should identify bool filter based simple queries', () => {
+    expect(
+      isBoolFilterBasedSimpleQuery({
+        bool: { filter: [simpleQueryMock] },
+      })
+    ).toBe(true);
+
+    expect(
+      isBoolFilterBasedSimpleQuery({
+        bool: { filter: [simpleQueryMock], must: [], must_not: [], should: [] },
+      })
+    ).toBe(true);
+  });
+
+  it('should identify non-simple queries or differently structured simple queries', () => {
+    expect(isBoolFilterBasedSimpleQuery(defaultSimpleQuery)).toBe(false);
+    expect(isBoolFilterBasedSimpleQuery(matchAllQuery)).toBe(false);
+    expect(isBoolFilterBasedSimpleQuery(simpleQueryMock)).toBe(false);
+
+    expect(
+      isBoolFilterBasedSimpleQuery({
+        bool: { filter: [], must: [], must_not: [], should: [] },
+      })
+    ).toBe(false);
+
+    expect(
+      isBoolFilterBasedSimpleQuery({
+        bool: { filter: [] },
+      })
+    ).toBe(false);
+
+    expect(
+      isBoolFilterBasedSimpleQuery({
+        bool: { filter: [matchAllQuery], must: [], must_not: [], should: [] },
+      })
+    ).toBe(false);
+
+    expect(
+      isBoolFilterBasedSimpleQuery({
+        bool: { filter: [matchAllQuery] },
+      })
+    ).toBe(false);
+
+    expect(
+      isBoolFilterBasedSimpleQuery({
+        bool: { filter: [], must: [matchAllQuery], must_not: [] },
+      })
+    ).toBe(false);
+  });
+});

x-pack/packages/ml/query_utils/src/bool_filter_based_simple_query.ts

@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isPopulatedObject } from '@kbn/ml-is-populated-object';
+
+import { isSimpleQuery } from './simple_query';
+import type { BoolFilterBasedSimpleQuery } from './types';
+
+/**
+ * Type guard to check if the provided argument is a boolean filter-based simple query.
+ *
+ * A valid `BoolFilterBasedSimpleQuery` must have a `bool` property, which itself
+ * must have a `filter` property. This `filter` must be an array with exactly
+ * one element, and that element must satisfy the conditions of a simple query
+ * as defined by `isSimpleQuery`.
+ *
+ * The type guard is useful to identify simple queries within bool filter
+ * queries exposed from Kibana/EUI search bars.
+ *
+ * @param arg - The argument to be checked.
+ * @returns `true` if `arg` meets the criteria of a `BoolFilterBasedSimpleQuery`, otherwise `false`.
+ */
+export function isBoolFilterBasedSimpleQuery(arg: unknown): arg is BoolFilterBasedSimpleQuery {
+  return (
+    isPopulatedObject(arg, ['bool']) &&
+    isPopulatedObject(arg.bool, ['filter']) &&
+    Array.isArray(arg.bool.filter) &&
+    arg.bool.filter.length === 1 &&
+    isSimpleQuery(arg.bool.filter[0])
+  );
+}

x-pack/packages/ml/query_utils/src/build_base_filter_criteria.ts

@@ -8,6 +8,9 @@
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { Query } from '@kbn/es-query';
 
+import { isDefaultQuery } from './default_query';
+import { isFilterBasedDefaultQuery } from './filter_based_default_query';
+
 /**
  * Builds the base filter criteria used in queries,
  * adding criteria for the time range and an optional query.
@@ -38,7 +41,12 @@ export function buildBaseFilterCriteria(
     });
   }
 
-  if (query && typeof query === 'object') {
+  if (
+    query &&
+    typeof query === 'object' &&
+    !isDefaultQuery(query) &&
+    !isFilterBasedDefaultQuery(query)
+  ) {
     filterCriteria.push(query);
   }
 

x-pack/packages/ml/query_utils/src/default_query.test.ts

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { simpleQueryMock } from './__mocks__/simple_query';
+import { isDefaultQuery } from './default_query';
+import { matchAllQuery } from './match_all_query';
+import { defaultSimpleQuery } from './simple_query';
+
+describe('isDefaultQuery', () => {
+  it("should return if it's a default query", () => {
+    expect(isDefaultQuery(defaultSimpleQuery)).toBe(true);
+    expect(isDefaultQuery(matchAllQuery)).toBe(true);
+    expect(isDefaultQuery(simpleQueryMock)).toBe(false);
+  });
+});

x-pack/packages/ml/query_utils/src/default_query.ts

@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isBoolFilterBasedSimpleQuery } from './bool_filter_based_simple_query';
+import { isMatchAllQuery } from './match_all_query';
+import { isSimpleDefaultQuery } from './simple_query';
+import type { SearchQueryVariant } from './types';
+
+/**
+ * Checks if the provided query is a default query. A default query is considered as one that matches all documents,
+ * either directly through a `match_all` query, a `SimpleQuery` with a wildcard query string, or a `BoolFilterBasedSimpleQuery`
+ * that contains a filter with a wildcard query or a `match_all` condition.
+ *
+ * @param query - The query to check.
+ * @returns True if the query is a default query, false otherwise.
+ */
+export function isDefaultQuery(query: SearchQueryVariant): boolean {
+  return (
+    isMatchAllQuery(query) ||
+    isSimpleDefaultQuery(query) ||
+    (isBoolFilterBasedSimpleQuery(query) &&
+      (query.bool.filter[0].query_string.query === '*' || isMatchAllQuery(query.bool.filter[0])))
+  );
+}

x-pack/packages/ml/query_utils/src/filter_based_default_query.test.ts

@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isFilterBasedDefaultQuery } from './filter_based_default_query';
+import { simpleQueryMock } from './__mocks__/simple_query';
+import { matchAllQuery } from './match_all_query';
+import { defaultSimpleQuery } from './simple_query';
+
+describe('isFilterBasedDefaultQuery', () => {
+  it('should identify filter based default queries', () => {
+    expect(
+      isFilterBasedDefaultQuery({
+        bool: { filter: [], must: [], must_not: [], should: [] },
+      })
+    ).toBe(true);
+    expect(
+      isFilterBasedDefaultQuery({
+        bool: { filter: [matchAllQuery], must: [], must_not: [], should: [] },
+      })
+    ).toBe(true);
+    expect(
+      isFilterBasedDefaultQuery({
+        bool: { filter: [], must: [matchAllQuery], must_not: [] },
+      })
+    ).toBe(true);
+  });
+
+  it('should identify non-default queries', () => {
+    expect(isFilterBasedDefaultQuery(defaultSimpleQuery)).toBe(false);
+    expect(isFilterBasedDefaultQuery(matchAllQuery)).toBe(false);
+    expect(isFilterBasedDefaultQuery(simpleQueryMock)).toBe(false);
+    expect(
+      isFilterBasedDefaultQuery({
+        bool: { filter: [simpleQueryMock], must: [], must_not: [], should: [] },
+      })
+    ).toBe(false);
+    expect(
+      isFilterBasedDefaultQuery({
+        bool: { filter: [], must: [matchAllQuery], must_not: [], should: [simpleQueryMock] },
+      })
+    ).toBe(false);
+    expect(
+      isFilterBasedDefaultQuery({
+        bool: { filter: [], must: [matchAllQuery], must_not: [simpleQueryMock] },
+      })
+    ).toBe(false);
+  });
+});

x-pack/packages/ml/query_utils/src/filter_based_default_query.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isPopulatedObject } from '@kbn/ml-is-populated-object';
+
+import { isDefaultQuery } from './default_query';
+
+const boolRequiredAttributes = ['filter', 'must', 'must_not'];
+
+/**
+ * Determines if the provided argument is a filter-based default query within a boolean filter context.
+ *
+ * A valid filter-based default query must include a `bool` property that contains
+ * `filter`, `must`, and `must_not` properties. These properties should either be empty arrays
+ * or arrays containing exactly one default query. The function checks for these conditions
+ * to identify variants of default queries structured within a boolean filter.
+ *
+ * Examples of valid structures include:
+ * - `{ bool: { filter: [{ match_all: {} }], must: [], must_not: [], should: [] } }`
+ * - `{ bool: { filter: [], must: [{ match_all: {} }], must_not: [] } }`
+ *
+ * Useful to identify simple queries within bool queries
+ * exposed from Kibana/EUI search bars.
+ *
+ * @param arg - The argument to be checked, its structure is unknown upfront.
+ * @returns  Returns `true` if `arg` matches the expected structure of a
+ * filter-based default query, otherwise `false`.
+ */
+export function isFilterBasedDefaultQuery(arg: unknown): boolean {
+  return (
+    isPopulatedObject(arg, ['bool']) &&
+    isPopulatedObject(arg.bool, boolRequiredAttributes) &&
+    Object.values(arg.bool).every(
+      // should be either an empty array or an array with just 1 default query
+      (d) => {
+        return Array.isArray(d) && (d.length === 0 || (d.length === 1 && isDefaultQuery(d[0])));
+      }
+    )
+  );
+}

x-pack/packages/ml/query_utils/src/match_all_query.test.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isMatchAllQuery, matchAllQuery } from './match_all_query';
+
+describe('isMatchAllQuery', () => {
+  it("should return if it's a match_all query", () => {
+    expect(isMatchAllQuery(matchAllQuery)).toBe(true);
+    expect(isMatchAllQuery({ query_string: { query: '*' } })).toBe(false);
+    expect(isMatchAllQuery({ query_string: { query: 'airline:AAL' } })).toBe(false);
+  });
+});

x-pack/packages/ml/query_utils/src/match_all_query.ts

@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isPopulatedObject } from '@kbn/ml-is-populated-object';
+
+/**
+ * Represents a query that matches all documents.
+ */
+export const matchAllQuery = {
+  /**
+   * 'match_all' property specifies a query that matches all documents.
+   */
+  match_all: {},
+};
+
+/**
+ * Checks if an argument is a `match_all` query.
+ * @param {unknown} query - Argument to check.
+ * @returns {boolean} True if `query` is a `match_all` query, false otherwise.
+ */
+export function isMatchAllQuery(query: unknown): boolean {
+  return (
+    isPopulatedObject(query, ['match_all']) &&
+    typeof query.match_all === 'object' &&
+    query.match_all !== null &&
+    Object.keys(query.match_all).length === 0
+  );
+}

x-pack/packages/ml/query_utils/src/simple_query.test.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { simpleQueryMock } from './__mocks__/simple_query';
+import { defaultSimpleQuery, isSimpleQuery, isSimpleDefaultQuery } from './simple_query';
+import { matchAllQuery } from './match_all_query';
+
+describe('isSimpleQuery', () => {
+  it("should return if it's a simple query", () => {
+    expect(isSimpleQuery(defaultSimpleQuery)).toBe(true);
+    expect(isSimpleQuery(matchAllQuery)).toBe(false);
+    expect(isSimpleQuery(simpleQueryMock)).toBe(true);
+  });
+});
+
+describe('isSimpleDefaultQuery', () => {
+  it("should return if it's a simple default query", () => {
+    expect(isSimpleDefaultQuery(defaultSimpleQuery)).toBe(true);
+    expect(isSimpleDefaultQuery(matchAllQuery)).toBe(false);
+    expect(isSimpleDefaultQuery(simpleQueryMock)).toBe(false);
+  });
+});

x-pack/packages/ml/query_utils/src/simple_query.ts

@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { isPopulatedObject } from '@kbn/ml-is-populated-object';
+
+import type { SimpleQuery } from './types';
+
+/**
+ * Default instance of `SimpleQuery` with a wildcard query string.
+ */
+export const defaultSimpleQuery: SimpleQuery<'*'> = { query_string: { query: '*' } };
+
+/**
+ * Type guard verifying if an argument is a `SimpleQuery`.
+ * @param {unknown} arg - Argument to check.
+ * @returns {boolean} True if `arg` is a `SimpleQuery`, false otherwise.
+ */
+export function isSimpleQuery(arg: unknown): arg is SimpleQuery {
+  return isPopulatedObject(arg, ['query_string']);
+}
+
+/**
+ * Type guard verifying if an argument is a `SimpleQuery` with a default query.
+ * @param {unknown} arg - Argument to check.
+ * @returns {boolean} True if `arg` is a `SimpleQuery`, false otherwise.
+ */
+export function isSimpleDefaultQuery(arg: unknown): arg is SimpleQuery<'*'> {
+  return isSimpleQuery(arg) && arg.query_string.query === '*';
+}

x-pack/packages/ml/query_utils/src/types.ts

@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+
 /**
  * Constant for kuery and lucene string
  */
@@ -17,3 +19,51 @@ export const SEARCH_QUERY_LANGUAGE = {
  * Type for SearchQueryLanguage
  */
 export type SearchQueryLanguage = typeof SEARCH_QUERY_LANGUAGE[keyof typeof SEARCH_QUERY_LANGUAGE];
+
+/**
+ * Placeholder for the structure for a saved search query.
+ */
+export type SavedSearchQuery = object;
+
+/**
+ * Represents a simple query structure for searching documents.
+ */
+export interface SimpleQuery<Q = string> {
+  /**
+   * Defines the query string parameters for the search.
+   */
+  query_string: {
+    /**
+     * The query text to search for within documents.
+     */
+    query: Q;
+
+    /**
+     * The default logical operator.
+     */
+    default_operator?: estypes.QueryDslOperator;
+  };
+}
+
+/**
+ * Represents simple queries that are based on a boolean filter.
+ */
+export interface BoolFilterBasedSimpleQuery {
+  /**
+   * The container for the boolean filter logic.
+   */
+  bool: {
+    /**
+     * An array of `SimpleQuery` objects.
+     */
+    filter: [SimpleQuery];
+    must: [];
+    must_not: [];
+    should?: [];
+  };
+}
+
+/**
+ * Represents a union of search queries that can be used to fetch documents.
+ */
+export type SearchQueryVariant = BoolFilterBasedSimpleQuery | SimpleQuery | SavedSearchQuery;

x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.test.ts

@@ -119,7 +119,6 @@ describe('query_utils', () => {
             },
           },
         },
-        { match_all: {} },
       ]);
     });
 
@@ -142,7 +141,6 @@ describe('query_utils', () => {
             },
           },
         },
-        { match_all: {} },
         { term: { 'meta.cloud.instance_id.keyword': '1234' } },
       ]);
     });
@@ -167,7 +165,6 @@ describe('query_utils', () => {
             },
           },
         },
-        { match_all: {} },
         { bool: { must_not: [{ term: { 'meta.cloud.instance_id.keyword': '1234' } }] } },
       ]);
     });
@@ -193,7 +190,6 @@ describe('query_utils', () => {
             },
           },
         },
-        { match_all: {} },
         {
           term: {
             'error.message': 'rate limit exceeded',
@@ -248,7 +244,6 @@ describe('query_utils', () => {
             },
           },
         },
-        { match_all: {} },
         {
           bool: {
             must_not: [

x-pack/plugins/transform/public/app/common/data_grid.test.ts

@@ -6,8 +6,8 @@
  */
 
 import type { DataView } from '@kbn/data-views-plugin/common';
+import type { SimpleQuery } from '@kbn/ml-query-utils';
 
-import type { SimpleQuery } from '.';
 import { getPreviewTransformRequestBody } from '.';
 import { getIndexDevConsoleStatement, getTransformPreviewDevConsoleStatement } from './data_grid';
 

x-pack/plugins/transform/public/app/common/index.ts

@@ -59,15 +59,10 @@ export {
   pivotGroupByFieldSupport,
   PIVOT_SUPPORTED_GROUP_BY_AGGS,
 } from './pivot_group_by';
-export type { TransformConfigQuery, SimpleQuery } from './request';
+export type { TransformConfigQuery } from './request';
 export {
-  defaultQuery,
   getPreviewTransformRequestBody,
   getCreateTransformRequestBody,
   getTransformConfigQuery,
   getRequestPayload,
-  isDefaultQuery,
-  isMatchAllQuery,
-  isSimpleQuery,
-  matchAllQuery,
 } from './request';

x-pack/plugins/transform/public/app/common/request.test.ts

@@ -18,23 +18,15 @@ import type { StepDetailsExposedState } from '../sections/create_transform/compo
 import { PIVOT_SUPPORTED_GROUP_BY_AGGS } from './pivot_group_by';
 import type { PivotAggsConfig } from './pivot_aggs';
 import {
-  defaultQuery,
   getPreviewTransformRequestBody,
   getCreateTransformRequestBody,
   getCreateTransformSettingsRequestBody,
   getTransformConfigQuery,
   getMissingBucketConfig,
   getRequestPayload,
-  isDefaultQuery,
-  isMatchAllQuery,
-  isSimpleQuery,
-  matchAllQuery,
-  type TransformConfigQuery,
 } from './request';
 import type { LatestFunctionConfigUI } from '../../../common/types/transform';
 
-const simpleQuery: TransformConfigQuery = { query_string: { query: 'airline:AAL' } };
-
 const groupByTerms: PivotGroupByConfig = {
   agg: PIVOT_SUPPORTED_GROUP_BY_AGGS.TERMS,
   field: 'the-group-by-field',
@@ -50,24 +42,6 @@ const aggsAvg: PivotAggsConfig = {
 };
 
 describe('Transform: Common', () => {
-  test('isMatchAllQuery()', () => {
-    expect(isMatchAllQuery(defaultQuery)).toBe(false);
-    expect(isMatchAllQuery(matchAllQuery)).toBe(true);
-    expect(isMatchAllQuery(simpleQuery)).toBe(false);
-  });
-
-  test('isSimpleQuery()', () => {
-    expect(isSimpleQuery(defaultQuery)).toBe(true);
-    expect(isSimpleQuery(matchAllQuery)).toBe(false);
-    expect(isSimpleQuery(simpleQuery)).toBe(true);
-  });
-
-  test('isDefaultQuery()', () => {
-    expect(isDefaultQuery(defaultQuery)).toBe(true);
-    expect(isDefaultQuery(matchAllQuery)).toBe(true);
-    expect(isDefaultQuery(simpleQuery)).toBe(false);
-  });
-
   test('getTransformConfigQuery()', () => {
     const query = getTransformConfigQuery('the-query');
 

x-pack/plugins/transform/public/app/common/request.ts

@@ -5,10 +5,14 @@
  * 2.0.
  */
 
-import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { DataView } from '@kbn/data-views-plugin/public';
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
-import { buildBaseFilterCriteria } from '@kbn/ml-query-utils';
+import {
+  buildBaseFilterCriteria,
+  isDefaultQuery,
+  type SearchQueryVariant,
+  type SavedSearchQuery,
+} from '@kbn/ml-query-utils';
 
 import {
   DEFAULT_CONTINUOUS_MODE_DELAY,
@@ -29,7 +33,6 @@ import type {
   TermsAgg,
 } from '../../../common/types/pivot_group_by';
 
-import type { SavedSearchQuery } from '../hooks/use_search_items';
 import type { StepDefineExposedState } from '../sections/create_transform/components/step_define';
 import type { StepDetailsExposedState } from '../sections/create_transform/components/step_details';
 
@@ -42,20 +45,7 @@ import {
   isGroupByTerms,
 } from '.';
 
-export interface SimpleQuery {
-  query_string: {
-    query: string;
-    default_operator?: estypes.QueryDslOperator;
-  };
-}
-
-export interface FilterBasedSimpleQuery {
-  bool: {
-    filter: [SimpleQuery];
-  };
-}
-
-export type TransformConfigQuery = FilterBasedSimpleQuery | SimpleQuery | SavedSearchQuery;
+export type TransformConfigQuery = SearchQueryVariant;
 
 export function getTransformConfigQuery(search: string | SavedSearchQuery): TransformConfigQuery {
   if (typeof search === 'string') {
@@ -70,40 +60,6 @@ export function getTransformConfigQuery(search: string | SavedSearchQuery): Tran
   return search;
 }
 
-export function isSimpleQuery(arg: unknown): arg is SimpleQuery {
-  return isPopulatedObject(arg, ['query_string']);
-}
-
-export function isFilterBasedSimpleQuery(arg: unknown): arg is FilterBasedSimpleQuery {
-  return (
-    isPopulatedObject(arg, ['bool']) &&
-    isPopulatedObject(arg.bool, ['filter']) &&
-    Array.isArray(arg.bool.filter) &&
-    arg.bool.filter.length === 1 &&
-    isSimpleQuery(arg.bool.filter[0])
-  );
-}
-
-export const matchAllQuery = { match_all: {} };
-export function isMatchAllQuery(query: unknown): boolean {
-  return (
-    isPopulatedObject(query, ['match_all']) &&
-    typeof query.match_all === 'object' &&
-    query.match_all !== null &&
-    Object.keys(query.match_all).length === 0
-  );
-}
-
-export const defaultQuery: TransformConfigQuery = { query_string: { query: '*' } };
-export function isDefaultQuery(query: TransformConfigQuery): boolean {
-  return (
-    isMatchAllQuery(query) ||
-    (isSimpleQuery(query) && query.query_string.query === '*') ||
-    (isFilterBasedSimpleQuery(query) &&
-      (query.bool.filter[0].query_string.query === '*' || isMatchAllQuery(query.bool.filter[0])))
-  );
-}
-
 export const getMissingBucketConfig = (
   g: GroupByConfigWithUiSupport
 ): { missing_bucket?: boolean } => {
@@ -181,7 +137,7 @@ export function getPreviewTransformRequestBody(
     dataView.timeFieldName,
     timeRangeMs?.from,
     timeRangeMs?.to,
-    isDefaultQuery(transformConfigQuery) ? undefined : transformConfigQuery
+    transformConfigQuery
   );
 
   const queryWithBaseFilterCriteria = {

x-pack/plugins/transform/public/app/hooks/use_get_histograms_for_fields.ts

@@ -10,6 +10,7 @@ import { useQuery } from '@tanstack/react-query';
 import type { IHttpFetchError } from '@kbn/core-http-browser';
 import type { KBN_FIELD_TYPES } from '@kbn/field-types';
 import { DEFAULT_SAMPLER_SHARD_SIZE } from '@kbn/ml-agg-utils';
+import type { SavedSearchQuery } from '@kbn/ml-query-utils';
 
 import { addInternalBasePath, TRANSFORM_REACT_QUERY_KEYS } from '../../../common/constants';
 import type {
@@ -19,8 +20,6 @@ import type {
 
 import { useAppDependencies } from '../app_dependencies';
 
-import type { SavedSearchQuery } from './use_search_items';
-
 export interface FieldHistogramRequestConfig {
   fieldName: string;
   type?: KBN_FIELD_TYPES;

x-pack/plugins/transform/public/app/hooks/use_index_data.test.tsx

@@ -15,11 +15,10 @@ import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
 import type { CoreSetup } from '@kbn/core/public';
 import { DataGrid, type UseIndexDataReturnType } from '@kbn/ml-data-grid';
 import type { RuntimeMappings } from '@kbn/ml-runtime-field-utils';
+import type { SimpleQuery } from '@kbn/ml-query-utils';
 
 import { getMlSharedImports } from '../../shared_imports';
 
-import type { SimpleQuery } from '../common';
-
 import type { SearchItems } from './use_search_items';
 import { useIndexData } from './use_index_data';
 

x-pack/plugins/transform/public/app/hooks/use_index_data.ts

@@ -12,7 +12,7 @@ import type { EuiDataGridColumn } from '@elastic/eui';
 
 import { reportPerformanceMetricEvent } from '@kbn/ebt-tools';
 import { isRuntimeMappings } from '@kbn/ml-runtime-field-utils';
-import { buildBaseFilterCriteria } from '@kbn/ml-query-utils';
+import { buildBaseFilterCriteria, isDefaultQuery, matchAllQuery } from '@kbn/ml-query-utils';
 import {
   getFieldType,
   getDataGridSchemaFromKibanaFieldType,
@@ -36,7 +36,6 @@ import {
 import { getErrorMessage } from '../../../common/utils/errors';
 
 import type { TransformConfigQuery } from '../common';
-import { isDefaultQuery, matchAllQuery } from '../common';
 import { useToastNotifications, useAppDependencies } from '../app_dependencies';
 import type { StepDefineExposedState } from '../sections/create_transform/components/step_define/common';
 

x-pack/plugins/transform/public/app/hooks/use_search_items/common.ts

@@ -9,13 +9,10 @@ import { buildEsQuery } from '@kbn/es-query';
 import type { IUiSettingsClient } from '@kbn/core/public';
 import { getEsQueryConfig } from '@kbn/data-plugin/public';
 import type { DataView, DataViewsContract } from '@kbn/data-views-plugin/public';
-
-import { matchAllQuery } from '../../common';
+import { matchAllQuery } from '@kbn/ml-query-utils';
 
 import { isDataView } from '../../../../common/types/data_view';
 
-export type SavedSearchQuery = object;
-
 let dataViewCache: DataView[] = [];
 
 export let refreshDataViews: () => Promise<unknown>;

x-pack/plugins/transform/public/app/hooks/use_search_items/index.ts

@@ -5,5 +5,5 @@
  * 2.0.
  */
 
-export type { SavedSearchQuery, SearchItems } from './common';
+export type { SearchItems } from './common';
 export { useSearchItems } from './use_search_items';

x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/apply_transform_config_to_define_state.ts

@@ -8,6 +8,7 @@
 import { isEqual } from 'lodash';
 
 import { getCombinedRuntimeMappings } from '@kbn/ml-runtime-field-utils';
+import { matchAllQuery } from '@kbn/ml-query-utils';
 
 import type { Dictionary } from '../../../../../../../common/types/common';
 import type { PivotSupportedAggs } from '../../../../../../../common/types/pivot_aggs';
@@ -21,7 +22,6 @@ import type {
   PivotGroupByConfigDict,
   PIVOT_SUPPORTED_GROUP_BY_AGGS,
 } from '../../../../../common';
-import { matchAllQuery } from '../../../../../common';
 
 import type { StepDefineExposedState } from './types';
 import { getAggConfigFromEsAgg } from '../../../../../common/pivot_aggs';

x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/types.ts

@@ -11,6 +11,7 @@ import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import type { TIME_SERIES_METRIC_TYPES } from '@kbn/ml-agg-utils';
 import type { TimeRange as TimeRangeMs } from '@kbn/ml-date-picker';
 import type { RuntimeMappings } from '@kbn/ml-runtime-field-utils';
+import type { SavedSearchQuery } from '@kbn/ml-query-utils';
 
 import type { EsFieldName } from '../../../../../../../common/types/fields';
 
@@ -19,9 +20,7 @@ import type {
   PivotGroupByConfigDict,
   PivotGroupByConfigWithUiSupportDict,
 } from '../../../../../common';
-import type { SavedSearchQuery } from '../../../../../hooks/use_search_items';
 
-import type { QUERY_LANGUAGE } from './constants';
 import type { TransformFunction } from '../../../../../../../common/constants';
 import type {
   LatestFunctionConfigUI,
@@ -29,6 +28,8 @@ import type {
 } from '../../../../../../../common/types/transform';
 import type { LatestFunctionConfig } from '../../../../../../../common/api_schemas/transforms';
 
+import type { QUERY_LANGUAGE } from './constants';
+
 export interface Field {
   name: EsFieldName;
   type: KBN_FIELD_TYPES | TIME_SERIES_METRIC_TYPES.COUNTER;

x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/step_define_summary.tsx

@@ -14,14 +14,13 @@ import { EuiBadge, EuiCodeBlock, EuiForm, EuiFormRow, EuiSpacer, EuiText } from
 
 import { formatHumanReadableDateTimeSeconds } from '@kbn/ml-date-utils';
 import { DataGrid } from '@kbn/ml-data-grid';
+import { isDefaultQuery, isMatchAllQuery } from '@kbn/ml-query-utils';
 
 import { useToastNotifications } from '../../../../app_dependencies';
 import {
   getTransformConfigQuery,
   getTransformPreviewDevConsoleStatement,
   getPreviewTransformRequestBody,
-  isDefaultQuery,
-  isMatchAllQuery,
 } from '../../../../common';
 import { useTransformConfigData } from '../../../../hooks/use_transform_config_data';
 import type { SearchItems } from '../../../../hooks/use_search_items';

x-pack/test/functional/apps/aiops/log_rate_analysis.ts

@@ -163,6 +163,11 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         testData.dataGenerator
       );
 
+      await aiops.logRateAnalysisPage.assertUrlState(
+        testData.expected.globalState,
+        testData.expected.appState
+      );
+
       // The group switch should be disabled by default
       await aiops.logRateAnalysisPage.assertLogRateAnalysisResultsGroupSwitchExists(false);
 
@@ -291,6 +296,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
         after(async () => {
           await elasticChart.setNewChartUiDebugFlag(false);
+          await ml.testResources.deleteDataViewByTitle(testData.sourceIndexOrSavedSearch);
           await aiops.logRateAnalysisDataGenerator.removeGeneratedData(testData.dataGenerator);
         });
 

x-pack/test/functional/apps/aiops/log_rate_analysis/test_data/artificial_log_data_view_test_data.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { LogRateAnalysisType } from '@kbn/aiops-utils';
+import { type LogRateAnalysisType, LOG_RATE_ANALYSIS_TYPE } from '@kbn/aiops-utils';
 
 import type { TestData } from '../../types';
 
@@ -88,7 +88,7 @@ export const getArtificialLogDataViewTestData = ({
   }
 
   function getBrushBaselineTargetTimestamp() {
-    if (analysisType === 'dip' && zeroDocsFallback) {
+    if (analysisType === LOG_RATE_ANALYSIS_TYPE.DIP && zeroDocsFallback) {
       return DEVIATION_TS;
     }
 
@@ -96,13 +96,40 @@ export const getArtificialLogDataViewTestData = ({
   }
 
   function getBrushDeviationTargetTimestamp() {
-    if (analysisType === 'dip' && zeroDocsFallback) {
+    if (analysisType === LOG_RATE_ANALYSIS_TYPE.DIP && zeroDocsFallback) {
       return DEVIATION_TS + DAY_MS * 1.5;
     }
 
     return zeroDocsFallback ? DEVIATION_TS : DEVIATION_TS + DAY_MS / 2;
   }
 
+  function getGlobalStateTime() {
+    if (zeroDocsFallback) {
+      return analysisType === LOG_RATE_ANALYSIS_TYPE.SPIKE
+        ? { from: '2022-11-17T08:12:34.793Z', to: '2022-11-21T08:12:34.793Z' }
+        : { from: '2022-11-17T08:12:34.793Z', to: '2022-11-21T08:12:34.793Z' };
+    }
+
+    return analysisType === LOG_RATE_ANALYSIS_TYPE.SPIKE
+      ? { from: '2022-11-18T08:26:58.793Z', to: '2022-11-20T08:16:11.193Z' }
+      : { from: '2022-11-18T08:16:10.793Z', to: '2022-11-20T08:12:34.793Z' };
+  }
+
+  function getWindowParameters() {
+    if (zeroDocsFallback) {
+      return analysisType === LOG_RATE_ANALYSIS_TYPE.SPIKE
+        ? { bMax: 1668722400000, bMin: 1668715200000, dMax: 1668852000000, dMin: 1668844800000 }
+        : { bMax: 1668852000000, bMin: 1668844800000, dMax: 1668981600000, dMin: 1668974400000 };
+    }
+
+    return {
+      bMax: 1668837600000,
+      bMin: 1668769200000,
+      dMax: 1668924000000,
+      dMin: 1668855600000,
+    };
+  }
+
   return {
     suiteTitle: getSuiteTitle(),
     analysisType,
@@ -121,6 +148,19 @@ export const getArtificialLogDataViewTestData = ({
       filteredAnalysisGroupsTable: getFilteredAnalysisGroupsTable(),
       analysisTable: getAnalysisTable(),
       fieldSelectorPopover: getFieldSelectorPopover(),
+      globalState: {
+        refreshInterval: { pause: true, value: 60000 },
+        time: getGlobalStateTime(),
+      },
+      appState: {
+        logRateAnalysis: {
+          filters: [],
+          searchQuery: { match_all: {} },
+          searchQueryLanguage: 'kuery',
+          searchString: '',
+          wp: getWindowParameters(),
+        },
+      },
     },
   };
 };

x-pack/test/functional/apps/aiops/log_rate_analysis/test_data/farequote_data_view_test_data.ts

@@ -24,5 +24,23 @@ export const farequoteDataViewTestData: TestData = {
     totalDocCountFormatted: '86,374',
     sampleProbabilityFormatted: '0.5',
     fieldSelectorPopover: ['airline', 'custom_field.keyword'],
+    globalState: {
+      refreshInterval: { pause: true, value: 60000 },
+      time: { from: '2016-02-07T00:00:00.000Z', to: '2016-02-11T23:59:54.000Z' },
+    },
+    appState: {
+      logRateAnalysis: {
+        filters: [],
+        searchQuery: { match_all: {} },
+        searchQueryLanguage: 'kuery',
+        searchString: '',
+        wp: {
+          bMax: 1454940000000,
+          bMin: 1454817600000,
+          dMax: 1455040800000,
+          dMin: 1455033600000,
+        },
+      },
+    },
   },
 };

x-pack/test/functional/apps/aiops/log_rate_analysis/test_data/farequote_data_view_test_data_with_query.ts

@@ -43,5 +43,149 @@ export const farequoteDataViewTestDataWithQuery: TestData = {
       },
     ],
     fieldSelectorPopover: ['airline', 'custom_field.keyword'],
+    globalState: {
+      refreshInterval: { pause: true, value: 60000 },
+      time: { from: '2016-02-07T00:00:00.000Z', to: '2016-02-11T23:59:54.000Z' },
+    },
+    appState: {
+      logRateAnalysis: {
+        filters: [],
+        searchQuery: {
+          bool: {
+            filter: [],
+            must_not: [
+              {
+                bool: {
+                  minimum_should_match: 1,
+                  should: [
+                    {
+                      bool: {
+                        minimum_should_match: 1,
+                        should: [
+                          {
+                            term: {
+                              airline: {
+                                value: 'SWR',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      bool: {
+                        minimum_should_match: 1,
+                        should: [
+                          {
+                            term: {
+                              airline: {
+                                value: 'ACA',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      bool: {
+                        minimum_should_match: 1,
+                        should: [
+                          {
+                            term: {
+                              airline: {
+                                value: 'AWE',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      bool: {
+                        minimum_should_match: 1,
+                        should: [
+                          {
+                            term: {
+                              airline: {
+                                value: 'BAW',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      bool: {
+                        minimum_should_match: 1,
+                        should: [
+                          {
+                            term: {
+                              airline: {
+                                value: 'JAL',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      bool: {
+                        minimum_should_match: 1,
+                        should: [
+                          {
+                            term: {
+                              airline: {
+                                value: 'JBU',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      bool: {
+                        minimum_should_match: 1,
+                        should: [
+                          {
+                            term: {
+                              airline: {
+                                value: 'JZA',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                    {
+                      bool: {
+                        minimum_should_match: 1,
+                        should: [
+                          {
+                            term: {
+                              airline: {
+                                value: 'KLM',
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        },
+        searchQueryLanguage: 'kuery',
+        searchString:
+          'NOT airline:("SWR" OR "ACA" OR "AWE" OR "BAW" OR "JAL" OR "JBU" OR "JZA" OR "KLM")',
+        wp: {
+          bMax: 1454940000000,
+          bMin: 1454817600000,
+          dMax: 1455040800000,
+          dMin: 1455033600000,
+        },
+      },
+    },
   },
 };

x-pack/test/functional/apps/aiops/log_rate_analysis/test_data/kibana_logs_data_view_test_data.ts

@@ -30,6 +30,24 @@ export const kibanaLogsDataViewTestData: TestData = {
   },
   expected: {
     totalDocCountFormatted: '14,068',
+    globalState: {
+      refreshInterval: { pause: true, value: 60000 },
+      time: { from: '2023-04-16T00:39:02.912Z', to: '2023-06-15T21:45:26.749Z' },
+    },
+    appState: {
+      logRateAnalysis: {
+        filters: [],
+        searchQuery: { match_all: {} },
+        searchQueryLanguage: 'kuery',
+        searchString: '',
+        wp: {
+          bMax: 1684368000000,
+          bMin: 1682899200000,
+          dMax: 1685491200000,
+          dMin: 1684886400000,
+        },
+      },
+    },
     analysisGroupsTable: [
       {
         group:

x-pack/test/functional/apps/aiops/types.ts

@@ -21,6 +21,8 @@ interface TestDataTableActionLogPatternAnalysis {
 
 interface TestDataExpectedWithSampleProbability {
   totalDocCountFormatted: string;
+  globalState: object;
+  appState: object;
   sampleProbabilityFormatted: string;
   fieldSelectorPopover: string[];
 }
@@ -33,6 +35,8 @@ export function isTestDataExpectedWithSampleProbability(
 
 interface TestDataExpectedWithoutSampleProbability {
   totalDocCountFormatted: string;
+  globalState: object;
+  appState: object;
   analysisGroupsTable: Array<{ group: string; docCount: string }>;
   filteredAnalysisGroupsTable?: Array<{ group: string; docCount: string }>;
   analysisTable: Array<{

x-pack/test/functional/services/aiops/log_rate_analysis_page.ts

@@ -6,6 +6,7 @@
  */
 
 import expect from '@kbn/expect';
+import { decode } from '@kbn/rison';
 
 import type { LogRateAnalysisType } from '@kbn/aiops-utils';
 
@@ -26,6 +27,17 @@ export function LogRateAnalysisPageProvider({ getService, getPageObject }: FtrPr
       await testSubjects.existOrFail('aiopsTimeRangeSelectorSection');
     },
 
+    async assertUrlState(expectedGlogalState: object, expectedAppState: object) {
+      const currentUrl = await browser.getCurrentUrl();
+      const parsedUrl = new URL(currentUrl);
+
+      const stateG = decode(parsedUrl.searchParams.get('_g') ?? '');
+      const stateA = decode(parsedUrl.searchParams.get('_a') ?? '');
+
+      expect(stateG).to.eql(expectedGlogalState);
+      expect(stateA).to.eql(expectedAppState);
+    },
+
     async assertTotalDocumentCount(expectedFormattedTotalDocCount: string) {
       await retry.tryForTime(5000, async () => {
         const docCount = await testSubjects.getVisibleText('aiopsTotalDocCount');