From d83db31a230b18ef57842ba3a9228a7b7a344cb8 Mon Sep 17 00:00:00 2001
From: Isabella Siu <Isabella.siu@grafana.com>
Date: Tue, 25 Feb 2025 09:16:55 -0500
Subject: [PATCH] Elasticsearch: Replace level in adhoc filters with level
 field name (#100315)

Elasticsearch: replace level in adhoc filters with level field name
---
 .../datasource/elasticsearch/datasource.test.ts       |  7 +++++++
 .../plugins/datasource/elasticsearch/datasource.ts    |  2 +-
 .../plugins/datasource/elasticsearch/modifyQuery.ts   | 11 ++++++++---
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/public/app/plugins/datasource/elasticsearch/datasource.test.ts b/public/app/plugins/datasource/elasticsearch/datasource.test.ts
index 9cab4431395..f80d969bfb0 100644
--- a/public/app/plugins/datasource/elasticsearch/datasource.test.ts
+++ b/public/app/plugins/datasource/elasticsearch/datasource.test.ts
@@ -812,6 +812,13 @@ describe('ElasticDatasource', () => {
           const query = ds.addAdHocFilters('', filters);
           expect(query).toBe('field\\:name:/field value\\//');
         });
+
+        it('should replace level with the log level field', () => {
+          const ds = createElasticDatasource({ jsonData: { logLevelField: 'level_field' } });
+          const filters = [{ key: 'level', operator: '=', value: 'foo', condition: '' }];
+          const query = ds.addAdHocFilters('', filters);
+          expect(query).toBe('level_field:"foo"');
+        });
       });
     });
 
diff --git a/public/app/plugins/datasource/elasticsearch/datasource.ts b/public/app/plugins/datasource/elasticsearch/datasource.ts
index 34d22b1e33a..bccb678babf 100644
--- a/public/app/plugins/datasource/elasticsearch/datasource.ts
+++ b/public/app/plugins/datasource/elasticsearch/datasource.ts
@@ -1108,7 +1108,7 @@ export class ElasticDatasource
     }
     let finalQuery = query;
     adhocFilters.forEach((filter) => {
-      finalQuery = addAddHocFilter(finalQuery, filter);
+      finalQuery = addAddHocFilter(finalQuery, filter, this.logLevelField);
     });
 
     return finalQuery;
diff --git a/public/app/plugins/datasource/elasticsearch/modifyQuery.ts b/public/app/plugins/datasource/elasticsearch/modifyQuery.ts
index 3971e3b1396..467d5bea494 100644
--- a/public/app/plugins/datasource/elasticsearch/modifyQuery.ts
+++ b/public/app/plugins/datasource/elasticsearch/modifyQuery.ts
@@ -83,7 +83,7 @@ function concatenate(query: string, filter: string, condition = 'AND'): string {
 /**
  * Adds a label:"value" expression to the query.
  */
-export function addAddHocFilter(query: string, filter: AdHocVariableFilter): string {
+export function addAddHocFilter(query: string, filter: AdHocVariableFilter, logLevelField?: string): string {
   if (!filter.key || !filter.value) {
     return query;
   }
@@ -94,15 +94,20 @@ export function addAddHocFilter(query: string, filter: AdHocVariableFilter): str
     value: filter.value.toString(),
   };
 
+  let key = filter.key;
+  if (logLevelField && key === 'level') {
+    key = logLevelField;
+  }
+
   const equalityFilters = ['=', '!='];
   if (equalityFilters.includes(filter.operator)) {
-    return addFilterToQuery(query, filter.key, filter.value, filter.operator === '=' ? '' : '-');
+    return addFilterToQuery(query, key, filter.value, filter.operator === '=' ? '' : '-');
   }
   /**
    * Keys and values in ad hoc filters may contain characters such as
    * colons, which needs to be escaped.
    */
-  const key = escapeFilter(filter.key);
+  key = escapeFilter(key);
   const value = escapeFilterValue(filter.value);
   const regexValue = escapeFilterValue(filter.value, false);
   let addHocFilter = '';