elastic / elastic/detection-rules
[DaC] export-rules fails on KQL rules with empty query (filters only)
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
### Command or doc area
- [x] `kibana export-rules` / `kibana import-rules`
- [ ] `import-rules-to-repo`
- [ ] `export-rules-from-repo`
- [ ] Other DaC CLI command (name it in the field below)
- [ ] Documentation in this repo only (link the page/section below)
### Other command name or doc link
_No response_
### Summary
When exporting KQL security rules that have an empty `query` (`""`) but use filters only,
the tool fails with `KqlParseError: No query provided` and skips the rule.
This is a valid Kibana configuration — the rule runs fine in the Detection Engine.
### Expected vs actual
The `kql` library's `lark_parse()` function raises `KqlParseError("No query provided")` when the query string is empty.
But Kibana accepts an empty query if there is at least one filter.
Rule example:
```
[...]
"query": "",
"filters": [
{
"meta": {
"disabled": false,
"negate": false,
"alias": null,
"index": "logs-*",
"key": "message",
"field": "message",
"params": {
"query": "qzfzqfzqfzqf"
},
"type": "phrase"
},
"query": {
"match_phrase": {
"message": "qzfzqfzqfzqf"
}
},
"$state": {
"store": "appState"
}
}
[...]
```
I would like to export this rule, but I can't.
```
█▀▀▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄▄▄ ▄ ▄ █▀▀▄ ▄ ▄ ▄ ▄▄▄ ▄▄▄
█ █ █▄▄ █ █▄▄ █ █ █ █ █ █▀▄ █ █▄▄▀ █ █ █ █▄▄ █▄▄
█▄▄▀ █▄▄ █ █▄▄ █▄▄ █ ▄█▄ █▄█ █ ▀▄█ █ ▀▄ █▄▄█ █▄▄ █▄▄ ▄▄█
- skipping test dac - KqlParseError
1 results exported
0 rules converted
0 exceptions exported
0 action connectors exported
0 rules saved to rules
0 exception lists saved to None
0 action connectors saved to None
1 errors saved to rules/_errors.txt
appuser@ed3b80e7df3f:/app/detection-rules$ cat rules/_errors.txt
- test dac - Error at line:1,column:1
No query provided
```
### Environment (if relevant)
elastic/kibana version: 9.2.4
detection-rules: dev-v1.6.39
### Reproduction (if applicable)
_No response_
### Related issues (optional)
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.