From fc06355e3126fbd8803db18da8acf7ea05cfa5a6 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Tue, 17 Feb 2026 11:51:03 -0700
Subject: [PATCH 1/8] [filters] type meta.value as string or object

---
 .../packages/shared/kbn-es-query-server/src/stored_filter.ts   | 2 +-
 .../shared/kbn-es-query/src/filters/build_filters/types.ts     | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts b/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
index 892bdbcdf68da..933c2ea19e8b5 100644
--- a/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
+++ b/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
@@ -44,7 +44,7 @@ export const storedFilterMetaSchema = schema.object(
     // This would require a more complex schema definition that can handle recursive types.
     // For now, we use `schema.any()` to allow flexibility in the params field.
     params: schema.maybe(schema.any()),
-    value: schema.maybe(schema.string()),
+    value: schema.maybe(schema.oneOf([schema.string(), schema.object({}, { unknowns: 'allow' })])),
   },
   { unknowns: 'allow' }
 );
diff --git a/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts b/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
index f67a51342333e..e5147375a1461 100644
--- a/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
+++ b/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
@@ -13,6 +13,7 @@ import type { PhrasesFilter, PhrasesFilterMeta } from './phrases_filter';
 import type { PhraseFilter, PhraseFilterMeta, PhraseFilterMetaParams } from './phrase_filter';
 import type { RangeFilter, RangeFilterMeta, RangeFilterParams } from './range_filter';
 import type { MatchAllFilter, MatchAllFilterMeta } from './match_all_filter';
+import { SerializableRecord } from '@kbn/utility-types';
 
 /**
  * A common type for filters supported by this package
@@ -73,7 +74,7 @@ export type FilterMeta = {
   type?: string;
   key?: string;
   params?: FilterMetaParams;
-  value?: string;
+  value?: string | SerializableRecord;
 };
 
 // eslint-disable-next-line @typescript-eslint/consistent-type-definitions

From 0f17b02ec669b826b9dafac954442e9ad886cc93 Mon Sep 17 00:00:00 2001
From: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 17 Feb 2026 19:15:43 +0000
Subject: [PATCH 2/8] Changes from node scripts/eslint_all_files --no-cache
 --fix

---
 .../shared/kbn-es-query/src/filters/build_filters/types.ts      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts b/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
index e5147375a1461..ec9d68b475a58 100644
--- a/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
+++ b/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
@@ -8,12 +8,12 @@
  */
 
 import type { FilterStateStore } from '@kbn/es-query-constants';
+import type { SerializableRecord } from '@kbn/utility-types';
 import type { ExistsFilter } from './exists_filter';
 import type { PhrasesFilter, PhrasesFilterMeta } from './phrases_filter';
 import type { PhraseFilter, PhraseFilterMeta, PhraseFilterMetaParams } from './phrase_filter';
 import type { RangeFilter, RangeFilterMeta, RangeFilterParams } from './range_filter';
 import type { MatchAllFilter, MatchAllFilterMeta } from './match_all_filter';
-import { SerializableRecord } from '@kbn/utility-types';
 
 /**
  * A common type for filters supported by this package

From 2a860994653a160a0faedf4d7c34a987d2b03fe7 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Tue, 17 Feb 2026 13:50:45 -0700
Subject: [PATCH 3/8] tslint

---
 .../kbn-es-query-server/src/stored_filter.ts  |  2 +-
 .../filter_manager/lib/get_display_value.ts   | 14 +++++++--
 .../shared/data/server/query/route_types.ts   |  4 ++-
 .../saved_objects/schemas/raw_rule/v3.ts      | 31 ++-----------------
 .../plugins/shared/alerting/tsconfig.json     |  1 +
 5 files changed, 18 insertions(+), 34 deletions(-)

diff --git a/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts b/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
index 933c2ea19e8b5..00c22fb5ea02d 100644
--- a/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
+++ b/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
@@ -31,7 +31,7 @@ export const storedFilterMetaSchema = schema.object(
     group: schema.maybe(
       schema.string({ meta: { description: 'The group to which this filter belongs.' } })
     ),
-    relation: schema.maybe(schema.string()),
+    relation: schema.maybe(schema.oneOf([schema.literal('OR'), schema.literal('AND')])),
     // field is missing from the Filter type, but is stored in SerializedSearchSourceFields
     // see the todo in src/platform/packages/shared/kbn-es-query/src/filters/helpers/update_filter.ts
     field: schema.maybe(schema.string()),
diff --git a/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts b/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
index 90278bad5fb73..b91fad07072bf 100644
--- a/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
+++ b/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
@@ -66,9 +66,17 @@ export function getDisplayValueFromFilter(filter: Filter, indexPatterns: DataVie
 
   if (isPhraseFilter(filter) || isScriptedPhraseFilter(filter)) {
     return getPhraseDisplayValue(filter, valueFormatter, fieldType);
-  } else if (isPhrasesFilter(filter)) {
+  }
+
+  if (isPhrasesFilter(filter)) {
     return getPhrasesDisplayValue(filter, valueFormatter);
-  } else if (isRangeFilter(filter) || isScriptedRangeFilter(filter)) {
+  }
+
+  if (isRangeFilter(filter) || isScriptedRangeFilter(filter)) {
     return getRangeDisplayValue(filter, valueFormatter);
-  } else return filter.meta.value ?? '';
+  }
+
+  return filter.meta.value && typeof filter.meta.value === 'object'
+    ? JSON.stringify(filter.meta.value)
+    : filter.meta.value ?? '';
 }
diff --git a/src/platform/plugins/shared/data/server/query/route_types.ts b/src/platform/plugins/shared/data/server/query/route_types.ts
index 646b0ee54f305..bc7c849f0ed8a 100644
--- a/src/platform/plugins/shared/data/server/query/route_types.ts
+++ b/src/platform/plugins/shared/data/server/query/route_types.ts
@@ -74,6 +74,7 @@ interface QueryRestResponse {
   language: string;
 }
 
+// TODO - duplicate of FilterMeta type - remove this type
 // eslint-disable-next-line @typescript-eslint/consistent-type-definitions
 type FilterMetaRestResponse = {
   alias?: string | null;
@@ -89,11 +90,12 @@ type FilterMetaRestResponse = {
   type?: string;
   key?: string;
   params?: FilterMetaParamsRestResponse;
-  value?: string;
+  value?: string | SerializableRecord;
 };
 
 type FilterStateStoreRestResponse = 'appState' | 'globalState';
 
+// duplicate of Filter - remove this type
 // eslint-disable-next-line @typescript-eslint/consistent-type-definitions
 type FilterRestResponse = {
   $state?: {
diff --git a/x-pack/platform/plugins/shared/alerting/server/saved_objects/schemas/raw_rule/v3.ts b/x-pack/platform/plugins/shared/alerting/server/saved_objects/schemas/raw_rule/v3.ts
index 2e07c73e1537a..d2bced6b16971 100644
--- a/x-pack/platform/plugins/shared/alerting/server/saved_objects/schemas/raw_rule/v3.ts
+++ b/x-pack/platform/plugins/shared/alerting/server/saved_objects/schemas/raw_rule/v3.ts
@@ -6,7 +6,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { FilterStateStore } from '@kbn/es-query';
+import { storedFilterSchema } from '@kbn/es-query-server';
 import {
   RuleExecutionStatusErrorReasons,
   RuleExecutionStatusWarningReasons,
@@ -164,34 +164,7 @@ export const rawRuleAlertsFilterSchema = schema.object({
   query: schema.maybe(
     schema.object({
       kql: schema.string(),
-      filters: schema.arrayOf(
-        schema.object({
-          query: schema.maybe(schema.recordOf(schema.string(), schema.any())),
-          meta: schema.object({
-            alias: schema.maybe(schema.nullable(schema.string())),
-            disabled: schema.maybe(schema.boolean()),
-            negate: schema.maybe(schema.boolean()),
-            controlledBy: schema.maybe(schema.string()),
-            group: schema.maybe(schema.string()),
-            index: schema.maybe(schema.string()),
-            isMultiIndex: schema.maybe(schema.boolean()),
-            type: schema.maybe(schema.string()),
-            key: schema.maybe(schema.string()),
-            params: schema.maybe(schema.any()),
-            value: schema.maybe(schema.string()),
-            field: schema.maybe(schema.string()),
-            relation: schema.maybe(schema.oneOf([schema.literal('OR'), schema.literal('AND')])),
-          }),
-          $state: schema.maybe(
-            schema.object({
-              store: schema.oneOf([
-                schema.literal(FilterStateStore.APP_STATE), // change
-                schema.literal(FilterStateStore.GLOBAL_STATE), // change
-              ]),
-            })
-          ),
-        })
-      ),
+      filters: schema.arrayOf(storedFilterSchema),
       dsl: schema.string(), // change
     })
   ),
diff --git a/x-pack/platform/plugins/shared/alerting/tsconfig.json b/x-pack/platform/plugins/shared/alerting/tsconfig.json
index 7e562fa96c3fc..d701995f28b8c 100644
--- a/x-pack/platform/plugins/shared/alerting/tsconfig.json
+++ b/x-pack/platform/plugins/shared/alerting/tsconfig.json
@@ -74,6 +74,7 @@
     "@kbn/maintenance-windows-plugin",
     "@kbn/config",
     "@kbn/expect",
+    "@kbn/es-query-server",
   ],
   "exclude": ["target/**/*"]
 }

From 3ded8080fbac20c2aaf09e897cfc3634a7bf4312 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Tue, 17 Feb 2026 14:17:32 -0700
Subject: [PATCH 4/8] update typings

---
 .../kbn-es-query-server/src/stored_filter.ts       |  3 ++-
 .../src/filters/build_filters/types.ts             | 10 +++++++---
 .../query/filter_manager/lib/get_display_value.ts  | 14 +++-----------
 .../shared/data/server/query/route_types.ts        |  4 +---
 4 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts b/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
index 00c22fb5ea02d..56a21ea22ffca 100644
--- a/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
+++ b/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
@@ -44,7 +44,8 @@ export const storedFilterMetaSchema = schema.object(
     // This would require a more complex schema definition that can handle recursive types.
     // For now, we use `schema.any()` to allow flexibility in the params field.
     params: schema.maybe(schema.any()),
-    value: schema.maybe(schema.oneOf([schema.string(), schema.object({}, { unknowns: 'allow' })])),
+    // Typing as any since value is undocumented subset of FilterMetaParams
+    value: schema.maybe(schema.any()),
   },
   { unknowns: 'allow' }
 );
diff --git a/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts b/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
index ec9d68b475a58..742730a33cb69 100644
--- a/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
+++ b/src/platform/packages/shared/kbn-es-query/src/filters/build_filters/types.ts
@@ -8,10 +8,14 @@
  */
 
 import type { FilterStateStore } from '@kbn/es-query-constants';
-import type { SerializableRecord } from '@kbn/utility-types';
 import type { ExistsFilter } from './exists_filter';
 import type { PhrasesFilter, PhrasesFilterMeta } from './phrases_filter';
-import type { PhraseFilter, PhraseFilterMeta, PhraseFilterMetaParams } from './phrase_filter';
+import type {
+  PhraseFilter,
+  PhraseFilterMeta,
+  PhraseFilterMetaParams,
+  PhraseFilterValue,
+} from './phrase_filter';
 import type { RangeFilter, RangeFilterMeta, RangeFilterParams } from './range_filter';
 import type { MatchAllFilter, MatchAllFilterMeta } from './match_all_filter';
 
@@ -74,7 +78,7 @@ export type FilterMeta = {
   type?: string;
   key?: string;
   params?: FilterMetaParams;
-  value?: string | SerializableRecord;
+  value?: string | RangeFilterParams | PhraseFilterValue[];
 };
 
 // eslint-disable-next-line @typescript-eslint/consistent-type-definitions
diff --git a/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts b/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
index b91fad07072bf..0433d468fdcc6 100644
--- a/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
+++ b/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
@@ -66,17 +66,9 @@ export function getDisplayValueFromFilter(filter: Filter, indexPatterns: DataVie
 
   if (isPhraseFilter(filter) || isScriptedPhraseFilter(filter)) {
     return getPhraseDisplayValue(filter, valueFormatter, fieldType);
-  }
-
-  if (isPhrasesFilter(filter)) {
+  } else if (isPhrasesFilter(filter)) {
     return getPhrasesDisplayValue(filter, valueFormatter);
-  }
-
-  if (isRangeFilter(filter) || isScriptedRangeFilter(filter)) {
+  } else if (isRangeFilter(filter) || isScriptedRangeFilter(filter)) {
     return getRangeDisplayValue(filter, valueFormatter);
-  }
-
-  return filter.meta.value && typeof filter.meta.value === 'object'
-    ? JSON.stringify(filter.meta.value)
-    : filter.meta.value ?? '';
+  } else return String(filter.meta.value);
 }
diff --git a/src/platform/plugins/shared/data/server/query/route_types.ts b/src/platform/plugins/shared/data/server/query/route_types.ts
index bc7c849f0ed8a..c60e8ce8707de 100644
--- a/src/platform/plugins/shared/data/server/query/route_types.ts
+++ b/src/platform/plugins/shared/data/server/query/route_types.ts
@@ -74,7 +74,6 @@ interface QueryRestResponse {
   language: string;
 }
 
-// TODO - duplicate of FilterMeta type - remove this type
 // eslint-disable-next-line @typescript-eslint/consistent-type-definitions
 type FilterMetaRestResponse = {
   alias?: string | null;
@@ -90,12 +89,11 @@ type FilterMetaRestResponse = {
   type?: string;
   key?: string;
   params?: FilterMetaParamsRestResponse;
-  value?: string | SerializableRecord;
+  value?: string | RangeFilterParamsRestResponse | PhraseFilterValue[];
 };
 
 type FilterStateStoreRestResponse = 'appState' | 'globalState';
 
-// duplicate of Filter - remove this type
 // eslint-disable-next-line @typescript-eslint/consistent-type-definitions
 type FilterRestResponse = {
   $state?: {

From 9f67d9132da2d049be8034ba3407ecc1315ec568 Mon Sep 17 00:00:00 2001
From: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 17 Feb 2026 21:33:03 +0000
Subject: [PATCH 5/8] Changes from node scripts/regenerate_moon_projects.js
 --update

---
 x-pack/platform/plugins/shared/alerting/moon.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/x-pack/platform/plugins/shared/alerting/moon.yml b/x-pack/platform/plugins/shared/alerting/moon.yml
index d970296c35cb4..4ec476b9f3682 100644
--- a/x-pack/platform/plugins/shared/alerting/moon.yml
+++ b/x-pack/platform/plugins/shared/alerting/moon.yml
@@ -81,6 +81,7 @@ dependsOn:
   - '@kbn/maintenance-windows-plugin'
   - '@kbn/config'
   - '@kbn/expect'
+  - '@kbn/es-query-server'
 tags:
   - plugin
   - prod

From 9aec0114070967bc1793541f3d69b4600b85abf7 Mon Sep 17 00:00:00 2001
From: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 17 Feb 2026 21:33:55 +0000
Subject: [PATCH 6/8] Changes from node scripts/jest_integration -u
 src/core/server/integration_tests/ci_checks

---
 .../saved_objects/check_registered_types.test.ts   | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts b/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
index 236c45a7e8c96..350231aa77328 100644
--- a/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
+++ b/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
@@ -60,7 +60,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "action": "f57d48f1be0e7895817648ecc89db8a5b594edc5185ad7c60b5ab743c960311b",
         "action_task_params": "6751dc8a4707a432bc9b90f5a025f183aefc84bca5ec26c29ce6939b24ea81e4",
         "ad_hoc_run_params": "9c372f2a8f8b468e9b699a6df633c7f14fab7f13216c9ec160813e75bae56098",
-        "alert": "119624b6025ea6794d2c33e2b41c2e4730d10446430b285691f7638ee6787af5",
+        "alert": "ab1ba850184da77f3736ad1386197d9da9e35b113c74592cae305b8e19d9699c",
         "alerting_rule_template": "a26521005d8a51af336ec95a2097c4bd073980c050e3c675cec3851acff78fd9",
         "api_key_pending_invalidation": "b5a0fe007bff147bbb0ef7d0393c976f777ccb470359090d79890a769baf3c68",
         "api_key_to_invalidate": "5add5ee737ccc61cc16bbf68423d634d1354971f20926b5ff465a2a853d1723a",
@@ -266,12 +266,12 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "alert|global: 8365bd1a75d780902feb5f272ed0d6c430d3d63f",
         "alert|mappings: 9a3a22a2bc7734d2ae1448ca90b305c9e730c456",
         "alert|schemas: da39a3ee5e6b4b0d3255bfef95601890afd80709",
-        "alert|10.8.0: 91693eaf0ae2bf94683360e53be98aaf77da29b4d5b6ed3839db40b7c13a4a33",
-        "alert|10.7.0: 7def9b639ae95ec88acf990d8ba9df2d517294b243241d6fa5bd61ae980e1f2c",
-        "alert|10.6.0: 320eda57bb8e4d268264fe105975074b65bab0e6a8d47acd489c8274fa0f3a19",
-        "alert|10.5.0: 614ec0e88e6f5b11f7b020b05ffd2e7155e4db4a7c6cb8cac8763bfb0eeb8fee",
-        "alert|10.4.0: b25a9b94b1a559b9101c122d3e803e078c51c359846118b77a987e423d59fc71",
-        "alert|10.3.0: 7be0ded70d4e87a4099d9e6eefe1790834dde50f9c4c2ff0135db9cf1ee5f45e",
+        "alert|10.8.0: 8784908e3456401018512116cf015abba640ea5fcab1f12f57487271348c591a",
+        "alert|10.7.0: 893888933c713eef218ddc92da4359f66d766fcc83d22ca014c90b7640357756",
+        "alert|10.6.0: 920bd30912560ba451ee7350b282e442789e2093f949230e5cb5f5c015e6ee6b",
+        "alert|10.5.0: e6a168ababf89f6a752cd103300603400a6c484da96f9e63a3412e857be67cf8",
+        "alert|10.4.0: 08803dce58e4512feed379b57e608ffebccd1d873af0e5eda0d0e1b281b05257",
+        "alert|10.3.0: 5599a13099cd58dd9d2edfec4887693b20d3f642cf4c7157e692fd10e6587d0a",
         "alert|10.2.0: 1ca5e6b281ab439aa6f6bea26ac02377d4c1b2029ecffd79df928d67e4a19a81",
         "alert|10.1.0: 89349b845c04e0e170e1280ac0ac1b58023240335b1c7859cd12c63cc5d6f8c5",
         "alert|8.8.0: c7c6c2b760dc7c6278c18d556de909c9f2170464",

From ba77037c36d764444cd3b87dc57d159d01f2f7fd Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Tue, 17 Feb 2026 16:19:24 -0700
Subject: [PATCH 7/8] revert changes to alert schema

---
 .../check_registered_types.test.ts            | 14 ++++-----
 .../kbn-es-query-server/src/stored_filter.ts  |  2 +-
 .../platform/plugins/shared/alerting/moon.yml |  1 -
 .../lib/add_generated_action_values.ts        |  3 +-
 .../saved_objects/schemas/raw_rule/v3.ts      | 31 +++++++++++++++++--
 .../plugins/shared/alerting/tsconfig.json     |  1 -
 6 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts b/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
index 350231aa77328..236c45a7e8c96 100644
--- a/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
+++ b/src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts
@@ -60,7 +60,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "action": "f57d48f1be0e7895817648ecc89db8a5b594edc5185ad7c60b5ab743c960311b",
         "action_task_params": "6751dc8a4707a432bc9b90f5a025f183aefc84bca5ec26c29ce6939b24ea81e4",
         "ad_hoc_run_params": "9c372f2a8f8b468e9b699a6df633c7f14fab7f13216c9ec160813e75bae56098",
-        "alert": "ab1ba850184da77f3736ad1386197d9da9e35b113c74592cae305b8e19d9699c",
+        "alert": "119624b6025ea6794d2c33e2b41c2e4730d10446430b285691f7638ee6787af5",
         "alerting_rule_template": "a26521005d8a51af336ec95a2097c4bd073980c050e3c675cec3851acff78fd9",
         "api_key_pending_invalidation": "b5a0fe007bff147bbb0ef7d0393c976f777ccb470359090d79890a769baf3c68",
         "api_key_to_invalidate": "5add5ee737ccc61cc16bbf68423d634d1354971f20926b5ff465a2a853d1723a",
@@ -266,12 +266,12 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "alert|global: 8365bd1a75d780902feb5f272ed0d6c430d3d63f",
         "alert|mappings: 9a3a22a2bc7734d2ae1448ca90b305c9e730c456",
         "alert|schemas: da39a3ee5e6b4b0d3255bfef95601890afd80709",
-        "alert|10.8.0: 8784908e3456401018512116cf015abba640ea5fcab1f12f57487271348c591a",
-        "alert|10.7.0: 893888933c713eef218ddc92da4359f66d766fcc83d22ca014c90b7640357756",
-        "alert|10.6.0: 920bd30912560ba451ee7350b282e442789e2093f949230e5cb5f5c015e6ee6b",
-        "alert|10.5.0: e6a168ababf89f6a752cd103300603400a6c484da96f9e63a3412e857be67cf8",
-        "alert|10.4.0: 08803dce58e4512feed379b57e608ffebccd1d873af0e5eda0d0e1b281b05257",
-        "alert|10.3.0: 5599a13099cd58dd9d2edfec4887693b20d3f642cf4c7157e692fd10e6587d0a",
+        "alert|10.8.0: 91693eaf0ae2bf94683360e53be98aaf77da29b4d5b6ed3839db40b7c13a4a33",
+        "alert|10.7.0: 7def9b639ae95ec88acf990d8ba9df2d517294b243241d6fa5bd61ae980e1f2c",
+        "alert|10.6.0: 320eda57bb8e4d268264fe105975074b65bab0e6a8d47acd489c8274fa0f3a19",
+        "alert|10.5.0: 614ec0e88e6f5b11f7b020b05ffd2e7155e4db4a7c6cb8cac8763bfb0eeb8fee",
+        "alert|10.4.0: b25a9b94b1a559b9101c122d3e803e078c51c359846118b77a987e423d59fc71",
+        "alert|10.3.0: 7be0ded70d4e87a4099d9e6eefe1790834dde50f9c4c2ff0135db9cf1ee5f45e",
         "alert|10.2.0: 1ca5e6b281ab439aa6f6bea26ac02377d4c1b2029ecffd79df928d67e4a19a81",
         "alert|10.1.0: 89349b845c04e0e170e1280ac0ac1b58023240335b1c7859cd12c63cc5d6f8c5",
         "alert|8.8.0: c7c6c2b760dc7c6278c18d556de909c9f2170464",
diff --git a/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts b/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
index 56a21ea22ffca..15f93ee4e8f65 100644
--- a/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
+++ b/src/platform/packages/shared/kbn-es-query-server/src/stored_filter.ts
@@ -31,7 +31,7 @@ export const storedFilterMetaSchema = schema.object(
     group: schema.maybe(
       schema.string({ meta: { description: 'The group to which this filter belongs.' } })
     ),
-    relation: schema.maybe(schema.oneOf([schema.literal('OR'), schema.literal('AND')])),
+    relation: schema.maybe(schema.string()),
     // field is missing from the Filter type, but is stored in SerializedSearchSourceFields
     // see the todo in src/platform/packages/shared/kbn-es-query/src/filters/helpers/update_filter.ts
     field: schema.maybe(schema.string()),
diff --git a/x-pack/platform/plugins/shared/alerting/moon.yml b/x-pack/platform/plugins/shared/alerting/moon.yml
index 4ec476b9f3682..d970296c35cb4 100644
--- a/x-pack/platform/plugins/shared/alerting/moon.yml
+++ b/x-pack/platform/plugins/shared/alerting/moon.yml
@@ -81,7 +81,6 @@ dependsOn:
   - '@kbn/maintenance-windows-plugin'
   - '@kbn/config'
   - '@kbn/expect'
-  - '@kbn/es-query-server'
 tags:
   - plugin
   - prod
diff --git a/x-pack/platform/plugins/shared/alerting/server/rules_client/lib/add_generated_action_values.ts b/x-pack/platform/plugins/shared/alerting/server/rules_client/lib/add_generated_action_values.ts
index 77051c7330d7a..ad99855f0f112 100644
--- a/x-pack/platform/plugins/shared/alerting/server/rules_client/lib/add_generated_action_values.ts
+++ b/x-pack/platform/plugins/shared/alerting/server/rules_client/lib/add_generated_action_values.ts
@@ -17,6 +17,7 @@ import type {
   RulesClientContext,
 } from '..';
 import { getEsQueryConfig } from '../../lib/get_es_query_config';
+import type { RawRuleAlertsFilter } from '../../types';
 
 export async function addGeneratedActionValues(
   actions: NormalizedAlertAction[] = [],
@@ -55,7 +56,7 @@ export async function addGeneratedActionValues(
                       dsl: generateDSL(alertsFilter.query.kql, alertsFilter.query.filters) ?? '',
                     }
                   : undefined,
-              },
+              } as RawRuleAlertsFilter,
             }
           : {}),
       };
diff --git a/x-pack/platform/plugins/shared/alerting/server/saved_objects/schemas/raw_rule/v3.ts b/x-pack/platform/plugins/shared/alerting/server/saved_objects/schemas/raw_rule/v3.ts
index d2bced6b16971..2e07c73e1537a 100644
--- a/x-pack/platform/plugins/shared/alerting/server/saved_objects/schemas/raw_rule/v3.ts
+++ b/x-pack/platform/plugins/shared/alerting/server/saved_objects/schemas/raw_rule/v3.ts
@@ -6,7 +6,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { storedFilterSchema } from '@kbn/es-query-server';
+import { FilterStateStore } from '@kbn/es-query';
 import {
   RuleExecutionStatusErrorReasons,
   RuleExecutionStatusWarningReasons,
@@ -164,7 +164,34 @@ export const rawRuleAlertsFilterSchema = schema.object({
   query: schema.maybe(
     schema.object({
       kql: schema.string(),
-      filters: schema.arrayOf(storedFilterSchema),
+      filters: schema.arrayOf(
+        schema.object({
+          query: schema.maybe(schema.recordOf(schema.string(), schema.any())),
+          meta: schema.object({
+            alias: schema.maybe(schema.nullable(schema.string())),
+            disabled: schema.maybe(schema.boolean()),
+            negate: schema.maybe(schema.boolean()),
+            controlledBy: schema.maybe(schema.string()),
+            group: schema.maybe(schema.string()),
+            index: schema.maybe(schema.string()),
+            isMultiIndex: schema.maybe(schema.boolean()),
+            type: schema.maybe(schema.string()),
+            key: schema.maybe(schema.string()),
+            params: schema.maybe(schema.any()),
+            value: schema.maybe(schema.string()),
+            field: schema.maybe(schema.string()),
+            relation: schema.maybe(schema.oneOf([schema.literal('OR'), schema.literal('AND')])),
+          }),
+          $state: schema.maybe(
+            schema.object({
+              store: schema.oneOf([
+                schema.literal(FilterStateStore.APP_STATE), // change
+                schema.literal(FilterStateStore.GLOBAL_STATE), // change
+              ]),
+            })
+          ),
+        })
+      ),
       dsl: schema.string(), // change
     })
   ),
diff --git a/x-pack/platform/plugins/shared/alerting/tsconfig.json b/x-pack/platform/plugins/shared/alerting/tsconfig.json
index d701995f28b8c..7e562fa96c3fc 100644
--- a/x-pack/platform/plugins/shared/alerting/tsconfig.json
+++ b/x-pack/platform/plugins/shared/alerting/tsconfig.json
@@ -74,7 +74,6 @@
     "@kbn/maintenance-windows-plugin",
     "@kbn/config",
     "@kbn/expect",
-    "@kbn/es-query-server",
   ],
   "exclude": ["target/**/*"]
 }

From 69e970edb594f9ddcb7339a82ff1da171a9bb4a9 Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@gmail.com>
Date: Tue, 17 Feb 2026 20:59:20 -0700
Subject: [PATCH 8/8] fix functional test

---
 .../data/public/query/filter_manager/lib/get_display_value.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts b/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
index 0433d468fdcc6..f4a1da093ef1f 100644
--- a/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
+++ b/src/platform/plugins/shared/data/public/query/filter_manager/lib/get_display_value.ts
@@ -70,5 +70,5 @@ export function getDisplayValueFromFilter(filter: Filter, indexPatterns: DataVie
     return getPhrasesDisplayValue(filter, valueFormatter);
   } else if (isRangeFilter(filter) || isScriptedRangeFilter(filter)) {
     return getRangeDisplayValue(filter, valueFormatter);
-  } else return String(filter.meta.value);
+  } else return String(filter.meta.value ?? '');
 }