[Security Solution]Applying custom field filter on Alerts page filters is not showing alerts table.

[sukhwindersingh-qasource]

Describe the bug:

• Applying custom field filter on Alerts page filters is not showing alerts table.

Build Details:

VERSION: 8.8.0 - Snapshot
BUILD: 62260
COMMIT: f150d0149c1a95923e1c9e2858ac8bdc4feec645

Preconditions

• Alerts should be present on kibana instance.
• Create a custom field ,lets say Days with set values define script as - emit(doc['@timestamp'].value.getDayOfWeekEnum().toString())

Steps to Reproduce

• Navigate to Security.
• Navigate to Alerts tab.
• Alerts page filter click on overflow menu select edit controls
• Click on + icon add new filter select the field value of created custom filed.
• Save the added filter.
• Now select the filter from the created custom filed.

Actual Result

Applying custom field filter on Alerts page filters is not showing alerts table.

Expected Result

Applying custom field filter on Alerts page filters should be showing alerts table.

Screen-Recording

Alerts.-.Kibana.Mozilla.Firefox.2023-04-21.14-32-18.mp4

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[logeekal]

Update:
It looks to be an issue with how Alert Table is fetching runtime fields. Adding same filter to the global query bar also results in empty table. Looks like issue with the Alerts Table since it is not using runtime mapping in the request.

Below is the runtimeMappings object, we are sending to timelineSearchStrategy and missing from Trigger actions alert table request.

{
	"runtimeMappings": {
		"Day": {
			"script": {
				"source": "emit(doc['@timestamp'].value.getDayOfWeekEnum().toString())"
			},
			"type": "keyword"
		}
	}
}

Screen.Recording.2023-04-21.at.17.24.33.mov

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[XavierM]

@dhurley14 and I would have to fix it together because i need to be aware of the runtime fields to do that on the alert table.

[cnasikas]

Hey @sukhwindersingh-qasource! Is this still valid?