DSL query error - input.charAt is not a function

[Leandro Lorenzini]

Hey,

Every time I use the Discover DSL query I get the error: "input.charAt is not a function"

If I try running this query on the dev tools it works. Is there any trick for the search to work?

{
  "aggs": {
    "host": {
      "terms": {
        "field": "agent.id",
        "size": 150
      }
    },
    "cve": {
      "terms": {
        "field": "data.vulnerability.cve",
        "size": 150
      }
    }
  }
}

Thank you!

Leandro

[Nicolas Agustin Guevara Pihen]

Hello Leandro, thank you for using Wazuh!

By default the search bar on Discover uses KQL or DQL (depending on the version that you are using). You can click that (at the right of the search bar) and turn it off to use Lucene expressions. 

With that option, you will no longer see that error. However, only the query/filter part of the query DSL works in the Kibana search bar, and is not possible to apply aggregations there.

You can see more information in the official documentation:
Kibana Query Language (KQL)
Opensearch Dashboard Query Language (DQL)
Lucene Query Syntax

I hope you find this information helpful, please let me know if you have any questions or doubts.
Kind regards,