Hello,
There is a global Kibana setting called "Autocomplete value suggestion method" (autocomplete:valueSuggestionMethod) which defaults to "terms_enum and with the following remark:
The method used for querying suggestions for values in KQL autocomplete. Select terms_enum to use the Elasticsearch terms enum API for improved autocomplete suggestion performance. (Note that terms_enum is incompatible with Document Level Security.) Select terms_agg to use an Elasticsearch terms aggregation. (Note that terms_agg is incompatible with IP-type fields.)
So, I know this is incompatible with DLS, but when I change this to "terms_agg" still terms_enum is used in the payload of the request. Even after reloading/hard refreshing and logout/login again.
For example (see method):
/internal/kibana/suggestions/values/logs-*
{
"query": "",
"field": "event.code",
"fieldMeta": {
"count": 0,
"name": "event.code",
"type": "string",
"esTypes": [
"keyword",
"text"
],
"scripted": false,
"searchable": true,
"aggregatable": true,
"readFromDocValues": true,
"shortDotsEnable": false,
"isMapped": true
},
"filters": [
{
"range": {
"@timestamp": {
"format": "strict_date_optional_time",
"gte": "2026-07-17T11:35:00.000Z",
"lte": "2026-07-17T11:50:59.999Z"
}
}
}
],
"method": "terms_enum"
}
So, at the moment I can't find a way for filters to work with autocomplete in a discover session when DLS is active on the index privileges.
Current version: 9.3.3
Kind regards,
Peter