# Investigate in timeline, extra wrong results

**URL:** <https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926>\
**Category:** Elastic Security\
**Created:** [March 7, 2024, 9:03am UTC](https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926 "2024-03-07T09:03:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticexpert](https://avatars.discourse-cdn.com/v4/letter/e/a5b964/32.png) [@elasticexpert](https://discuss.elastic.co/u/elasticexpert)\
**Post date:** [March 7, 2024, 9:03am UTC](https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926/1 "2024-03-07T09:03:32Z")

</div>

Hey!  
(Elasticsearch 8.11.1)  
I noticed that when I go to investigate in timeline on an alert, I get results that not match the timeline template search.  
For example, for the search of timeline template that looks like this:  
`kibana.alert.rule.name: "aa" and signal.rule.severity: "critical"`  
I get the the right results and more that have kibana.alert.rule.name: "bb" for some reason.

When searching in the timeline I opened F12 in my browser and copied the query string that is generated, it looked like this:

```auto
{"bool": {"must": [{"query_string": {"query": "((`kibana.alert.rule.name: "aa" and signal.rule.severity: "critical"`))", "analyze_wildcard": true}}],"filter": [], "should": [], "must_not": []}}

```

I tried to search myself in kibana dev tools and I really got the same results, but I found something interesting. If I use the same query string, but use "AND" in capital letters, it gives me only the right results

```auto
{"bool": {"must": [{"query_string": {"query": "((`kibana.alert.rule.name: "aa" AND signal.rule.severity: "critical"`))", "analyze_wildcard": true}}],"filter": [], "should": [], "must_not": []}}

```

---

<div class="post-metadata">

**Author:** ![Jatin\_Kathuria](https://avatars.discourse-cdn.com/v4/letter/j/d6d6ee/32.png) [@Jatin\_Kathuria](https://discuss.elastic.co/u/Jatin_Kathuria)\
**Post date:** [March 8, 2024, 10:22am UTC](https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926/2 "2024-03-08T10:22:39Z")

</div>

> [@elasticexpert](#):
>
> I noticed that when I go to investigate in timeline on an alert, I get results that not match the timeline template search.

Hey @elasticexpert ,

I tried your to reproduce example on `8.11` and could not . Below I have shown screenshots of the template I used and alert investigating with that template.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/83738ae881390cefe4feb8b130131876635bd90a.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/94cb7f63a74c1a8ceb988f82c45e0cf1eac51c62.png)

Regarding the dev tools, where did you see this particular query, Could you please share the HAR of the network requests?

---

<div class="post-metadata">

**Author:** ![elasticexpert](https://avatars.discourse-cdn.com/v4/letter/e/a5b964/32.png) [@elasticexpert](https://discuss.elastic.co/u/elasticexpert)\
**Post date:** [March 10, 2024, 6:26pm UTC](https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926/3 "2024-03-10T18:26:29Z")

</div>

The time range in the second photo doesnt include the "Custom Rule [Duplicate]" rule

---

<div class="post-metadata">

**Author:** ![Jatin\_Kathuria](https://avatars.discourse-cdn.com/v4/letter/j/d6d6ee/32.png) [@Jatin\_Kathuria](https://discuss.elastic.co/u/Jatin_Kathuria)\
**Post date:** [March 14, 2024, 6:54am UTC](https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926/4 "2024-03-14T06:54:43Z")

</div>

> [@elasticexpert](#):
>
> The time range in the second photo doesnt include the "Custom Rule [Duplicate]" rule

Okay. I tried to be more clear this time. [Here](https://drive.google.com/file/d/14FZDTWTjlaMDUIQCBs-pJY0M_HECc9E2/view?usp=sharing) is video of my attempt to replicate the issue that you suggested but I did not succeed and got expected results back.

I have heard about this issue before as well so I am not denying that the issue is not there but I would like to replicate it right way before I create an official ticket for it.

Do you think steps I took in the video should be enough to re-create the issue. If not, do you mind recreating the issue with exact steps? May be a video will help.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2024, 6:54am UTC](https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926/5 "2024-04-11T06:54:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.