[Bug] OR instead of AND when searching saved searches, visualizations, and dashboards

[anhlqn]

Kibana version: 5.6.8

Elasticsearch version: 5.6.8

Server OS version: Windows Server 2012 R2

Browser version: Chrome 63

Browser OS version:

Original install method (e.g. download page, yum, from source, etc.): Zip file

Description of the problem including expected versus actual behavior:

I guess the screenshot explains the issue pretty well. When I search for a saved item in Kibana, i.e., searches, visualizations, dashboards, Kibana displays any items that match any of the search terms, which makes it a nightmare to search through 400 visualizations and tens of dashboards.

Searching for perfmon disk should return only visualizations that have both perfmon AND disk in their name, not perfmon OR disk.

This is not the behavior in Kibana 4, so I wonder what the justification for this change is or whether it's just a bug. I'm surprised that this change is still around in Kibana 5.6.8 without anyone complaining.

Steps to reproduce:

1. Open the search box for saved searches, visualizations, or dashboards
2. Enter two search terms

[chrisronline]

Hi @anhlqn,

Can you try putting the search query in quotes, like "perfmon disk"?

Does that help?

[anhlqn]

Yes, "perfmon disk" works. Looks like it behaves like a normal query with OR as the default operator?

[chrisronline]

Correct. See this code and these docs

[anhlqn]

Would that make sense in terms of user experience though? This is the management UI, not the regular search box. When I type in perfmon disk, I think naturally I am looking for both perfmon and disk visualizations, not perfmon or disk.

[chrisronline]

I don't disagree, but the experience throughout Kibana is consistent with the OR. If we did decide to change, we'd want to ensure all other areas change as well.

Pinging for thoughts: @elastic/kibana-visualizations @elastic/kibana-sharing

[anhlqn]

Thanks for the clarification.

[trevan]

This is probably related or a duplicate of #14687.

[anhlqn]

@trevan yes, it's duplicate of #14687.

[LeeDr]

I'm going to close this so I don't have to update 2 issues. See #14687