From 903f11f78238fbb06abe6b83f243226104c1db3a Mon Sep 17 00:00:00 2001
From: TFCMarques <tiago.marques@elastic.co>
Date: Fri, 27 Mar 2026 16:40:32 +0000
Subject: [PATCH 1/5] fix missing highlights on logs profile

---
 .../components/summary_column/content.tsx     | 12 +++--
 .../summary_column/summary_column.tsx         |  5 +-
 .../escape_preserve_highlight_tags.test.ts    | 34 ++++++++++++--
 .../utils/escape_preserve_highlight_tags.ts   | 46 ++++++++++++++-----
 .../content_breakdown/content_breakdown.tsx   |  7 ++-
 5 files changed, 84 insertions(+), 20 deletions(-)

diff --git a/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/content.tsx b/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/content.tsx
index 1b39b8314bc23..a48855927796f 100644
--- a/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/content.tsx
+++ b/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/content.tsx
@@ -100,6 +100,7 @@ export const Content = ({
 }: ContentProps) => {
   // Use OTel fallback version that returns the actual field name used
   const { field, value } = getMessageFieldWithFallbacks(row.flattened);
+  const highlightSnippet = field ? row.raw.highlight?.[field]?.[0] : undefined;
 
   const { euiTheme } = useEuiTheme();
   const isDarkTheme = useKibanaIsDarkMode();
@@ -107,9 +108,14 @@ export const Content = ({
   const highlightedValue = useMemo(
     () =>
       value
-        ? getHighlightedMessage(escapeAndPreserveHighlightTags(value), row, euiTheme, isDarkTheme)
-        : value,
-    [value, row, euiTheme, isDarkTheme]
+        ? getHighlightedMessage(
+            escapeAndPreserveHighlightTags(highlightSnippet ?? value),
+            row,
+            euiTheme,
+            isDarkTheme
+          )
+        : undefined,
+    [value, highlightSnippet, row, euiTheme, isDarkTheme]
   );
 
   const shouldRenderContent = !!field && !!value && !!highlightedValue;
diff --git a/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/summary_column.tsx b/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/summary_column.tsx
index 02401aeb7c05c..6c39c5bb9b00d 100644
--- a/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/summary_column.tsx
+++ b/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/summary_column.tsx
@@ -166,11 +166,14 @@ export const SummaryCellPopover = (props: AllSummaryColumnProps) => {
   const { field, value, formattedValue } = getMessageFieldWithFallbacks(row.flattened, {
     includeFormattedValue: true,
   });
+  const highlightSnippet = field ? row.raw.highlight?.[field]?.[0] : undefined;
   const messageCodeBlockProps = formattedValue
     ? { language: 'json', children: formattedValue }
     : {
         language: 'txt',
-        dangerouslySetInnerHTML: { __html: escapeAndPreserveHighlightTags(value ?? '') },
+        dangerouslySetInnerHTML: {
+          __html: escapeAndPreserveHighlightTags(highlightSnippet ?? value ?? ''),
+        },
       };
   const shouldRenderContent = Boolean(field && value);
 
diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.test.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.test.ts
index ce6812ad357e1..3d8f16a866009 100644
--- a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.test.ts
+++ b/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.test.ts
@@ -13,6 +13,10 @@ import { escapeAndPreserveHighlightTags } from './escape_preserve_highlight_tags
 const PRE = '<mark class="ffSearch__highlight">';
 const POST = '</mark>';
 
+// Must match the tags defined in @kbn/field-formats-plugin (highlight_tags.ts)
+const ES_PRE = '@kibana-highlighted-field@';
+const ES_POST = '@/kibana-highlighted-field@';
+
 describe('escapeAndPreserveHighlightTags', () => {
   it('escapes HTML when there are no highlight tags', () => {
     expect(escapeAndPreserveHighlightTags('<hello>world</hello>')).toBe(
@@ -26,15 +30,39 @@ describe('escapeAndPreserveHighlightTags', () => {
     );
   });
 
-  it('returns only escaped text when there are multiple highlight regions', () => {
+  it('preserves multiple highlight regions', () => {
     expect(escapeAndPreserveHighlightTags(`${PRE}hello${POST} + ${PRE}world${POST}`)).toBe(
-      'hello + world'
+      `${PRE}hello${POST} + ${PRE}world${POST}`
     );
   });
 
   it('escapes plain <mark> tags that do not match the highlight format', () => {
     expect(escapeAndPreserveHighlightTags('<mark><hello></mark>')).toBe(
-      '&lt;mark&gt;&lt;hello&gt;'
+      '&lt;mark&gt;&lt;hello&gt;&lt;/mark&gt;'
+    );
+  });
+
+  it('converts ES highlight tags to HTML mark tags with a single match', () => {
+    expect(escapeAndPreserveHighlightTags(`This is a ${ES_PRE}test${ES_POST} message`)).toBe(
+      `This is a ${PRE}test${POST} message`
+    );
+  });
+
+  it('converts ES highlight tags to HTML mark tags with multiple matches', () => {
+    expect(
+      escapeAndPreserveHighlightTags(`${ES_PRE}hello${ES_POST} and ${ES_PRE}world${ES_POST}`)
+    ).toBe(`${PRE}hello${POST} and ${PRE}world${POST}`);
+  });
+
+  it('escapes HTML characters in non-highlighted text around ES tags', () => {
+    expect(escapeAndPreserveHighlightTags(`<b>${ES_PRE}test${ES_POST}</b>`)).toBe(
+      `&lt;b&gt;${PRE}test${POST}&lt;/b&gt;`
+    );
+  });
+
+  it('escapes HTML characters inside ES highlighted text', () => {
+    expect(escapeAndPreserveHighlightTags(`${ES_PRE}<script>${ES_POST}`)).toBe(
+      `${PRE}&lt;script&gt;${POST}`
     );
   });
 });
diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts
index 7187da27bd38d..36071ea8a43fc 100644
--- a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts
+++ b/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts
@@ -9,22 +9,46 @@
 
 import { escape } from 'lodash';
 
-// TODO: These constants are duplicated from @kbn/field-formats-plugin (html_tags.ts).
+// TODO: These constants are duplicated from @kbn/field-formats-plugin (html_tags.ts / highlight_tags.ts).
 // They are kept locally because packages cannot depend on plugins. This is a temporary
 // workaround until we reach an agreement on how to handle formatted/highlighted content
 // across packages and plugins.
-const HIGHLIGHT_PRE_TAG = '<mark class="ffSearch__highlight">';
-const HIGHLIGHT_POST_TAG = '</mark>';
-const HIGHLIGHT_TAGS_REGEX = new RegExp(`${HIGHLIGHT_PRE_TAG}|${HIGHLIGHT_POST_TAG}`, 'g');
+const HTML_HIGHLIGHT_PRE_TAG = '<mark class="ffSearch__highlight">';
+const HTML_HIGHLIGHT_POST_TAG = '</mark>';
+
+const ES_HIGHLIGHT_PRE_TAG = '@kibana-highlighted-field@';
+const ES_HIGHLIGHT_POST_TAG = '@/kibana-highlighted-field@';
+
+const escapeAndConvertHighlightTags = (value: string, preTag: string, postTag: string): string => {
+  return value
+    .split(preTag)
+    .map((segment, index) => {
+      // if first segment, escape it and return
+      if (index === 0) return escape(segment);
+
+      const postTagIndex = segment.indexOf(postTag);
+
+      // if post tag is not found, escape it and return
+      if (postTagIndex === -1) return escape(segment);
+
+      const highlightedSnippet = segment.substring(0, postTagIndex);
+      const rest = segment.substring(postTagIndex + postTag.length);
+
+      return (
+        HTML_HIGHLIGHT_PRE_TAG + escape(highlightedSnippet) + HTML_HIGHLIGHT_POST_TAG + escape(rest)
+      );
+    })
+    .join('');
+};
 
 export function escapeAndPreserveHighlightTags(value: string): string {
-  const markTags: string[] = [];
-  const cleanText = value.replace(HIGHLIGHT_TAGS_REGEX, (match) => {
-    markTags.push(match);
-    return '';
-  });
+  if (value.includes(ES_HIGHLIGHT_PRE_TAG)) {
+    return escapeAndConvertHighlightTags(value, ES_HIGHLIGHT_PRE_TAG, ES_HIGHLIGHT_POST_TAG);
+  }
 
-  const escapedText = escape(cleanText);
+  if (value.includes(HTML_HIGHLIGHT_PRE_TAG)) {
+    return escapeAndConvertHighlightTags(value, HTML_HIGHLIGHT_PRE_TAG, HTML_HIGHLIGHT_POST_TAG);
+  }
 
-  return markTags.length === 2 ? `${markTags[0]}${escapedText}${markTags[1]}` : escapedText;
+  return escape(value);
 }
diff --git a/src/platform/plugins/shared/unified_doc_viewer/public/components/doc_viewer_logs_overview/sub_components/content_breakdown/content_breakdown.tsx b/src/platform/plugins/shared/unified_doc_viewer/public/components/doc_viewer_logs_overview/sub_components/content_breakdown/content_breakdown.tsx
index 15bac72c24674..9624db0dad4a2 100644
--- a/src/platform/plugins/shared/unified_doc_viewer/public/components/doc_viewer_logs_overview/sub_components/content_breakdown/content_breakdown.tsx
+++ b/src/platform/plugins/shared/unified_doc_viewer/public/components/doc_viewer_logs_overview/sub_components/content_breakdown/content_breakdown.tsx
@@ -20,8 +20,8 @@ import {
   getMessageFieldWithFallbacks,
   type DataTableRecord,
   type LogDocumentOverview,
+  escapeAndPreserveHighlightTags,
 } from '@kbn/discover-utils';
-import { escapeAndPreserveHighlightTags } from '@kbn/discover-utils';
 import type { ObservabilityStreamsFeature } from '@kbn/discover-shared-plugin/public';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import { Badges } from '../badges/badges';
@@ -43,12 +43,15 @@ export const ContentBreakdown = ({
   });
 
   const rawFieldValue = hit && field ? hit.flattened[field] : undefined;
+  const highlightSnippet = field ? hit.raw.highlight?.[field]?.[0] : undefined;
 
   const messageCodeBlockProps = formattedValue
     ? { language: 'json', children: formattedValue }
     : {
         language: 'txt',
-        dangerouslySetInnerHTML: { __html: escapeAndPreserveHighlightTags(value ?? '') },
+        dangerouslySetInnerHTML: {
+          __html: escapeAndPreserveHighlightTags(highlightSnippet ?? value ?? ''),
+        },
       };
   const hasMessageField = field && value;
 

From a4a4e1233284f885cbb86b6b150c5c73f0c43504 Mon Sep 17 00:00:00 2001
From: TFCMarques <tiago.marques@elastic.co>
Date: Fri, 27 Mar 2026 18:50:51 +0000
Subject: [PATCH 2/5] address multiple highlights + rename file to something
 more accurate

---
 .../components/summary_column/content.tsx     |  8 +-
 .../summary_column/summary_column.tsx         |  6 +-
 .../shared/kbn-discover-utils/index.ts        |  1 +
 .../escape_preserve_highlight_tags.test.ts    | 68 -------------
 .../utils/escape_preserve_highlight_tags.ts   | 75 +++++++++-----
 .../src/utils/highlight_utils.test.ts         | 98 +++++++++++++++++++
 .../src/utils/highlight_utils.ts              | 83 ++++++++++++++++
 .../kbn-discover-utils/src/utils/index.ts     |  2 +-
 .../content_breakdown/content_breakdown.tsx   |  6 +-
 9 files changed, 246 insertions(+), 101 deletions(-)
 delete mode 100644 src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.test.ts
 create mode 100644 src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.test.ts
 create mode 100644 src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.ts

diff --git a/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/content.tsx b/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/content.tsx
index a48855927796f..98cfd012f827e 100644
--- a/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/content.tsx
+++ b/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/content.tsx
@@ -17,7 +17,7 @@ import {
   LOG_LEVEL_REGEX,
   OTEL_MESSAGE_FIELD,
 } from '@kbn/discover-utils';
-import { MESSAGE_FIELD, escapeAndPreserveHighlightTags } from '@kbn/discover-utils';
+import { MESSAGE_FIELD, getHighlightedFieldValue } from '@kbn/discover-utils';
 import type { EuiThemeComputed } from '@elastic/eui';
 import { makeHighContrastColor, useEuiTheme } from '@elastic/eui';
 import { useKibanaIsDarkMode } from '@kbn/react-kibana-context-theme';
@@ -100,7 +100,7 @@ export const Content = ({
 }: ContentProps) => {
   // Use OTel fallback version that returns the actual field name used
   const { field, value } = getMessageFieldWithFallbacks(row.flattened);
-  const highlightSnippet = field ? row.raw.highlight?.[field]?.[0] : undefined;
+  const highlights = field ? row.raw.highlight?.[field] : undefined;
 
   const { euiTheme } = useEuiTheme();
   const isDarkTheme = useKibanaIsDarkMode();
@@ -109,13 +109,13 @@ export const Content = ({
     () =>
       value
         ? getHighlightedMessage(
-            escapeAndPreserveHighlightTags(highlightSnippet ?? value),
+            getHighlightedFieldValue(value, highlights),
             row,
             euiTheme,
             isDarkTheme
           )
         : undefined,
-    [value, highlightSnippet, row, euiTheme, isDarkTheme]
+    [value, highlights, row, euiTheme, isDarkTheme]
   );
 
   const shouldRenderContent = !!field && !!value && !!highlightedValue;
diff --git a/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/summary_column.tsx b/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/summary_column.tsx
index 6c39c5bb9b00d..b35772f96d708 100644
--- a/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/summary_column.tsx
+++ b/src/platform/packages/shared/kbn-discover-contextual-components/src/data_types/logs/components/summary_column/summary_column.tsx
@@ -19,7 +19,7 @@ import {
   TRACE_FIELDS,
   getMessageFieldWithFallbacks,
 } from '@kbn/discover-utils';
-import { getAvailableTraceFields, escapeAndPreserveHighlightTags } from '@kbn/discover-utils';
+import { getAvailableTraceFields, getHighlightedFieldValue } from '@kbn/discover-utils';
 import { Resource } from './resource';
 import { Content } from './content';
 import {
@@ -166,13 +166,13 @@ export const SummaryCellPopover = (props: AllSummaryColumnProps) => {
   const { field, value, formattedValue } = getMessageFieldWithFallbacks(row.flattened, {
     includeFormattedValue: true,
   });
-  const highlightSnippet = field ? row.raw.highlight?.[field]?.[0] : undefined;
+  const highlights = field ? row.raw.highlight?.[field] : undefined;
   const messageCodeBlockProps = formattedValue
     ? { language: 'json', children: formattedValue }
     : {
         language: 'txt',
         dangerouslySetInnerHTML: {
-          __html: escapeAndPreserveHighlightTags(highlightSnippet ?? value ?? ''),
+          __html: getHighlightedFieldValue(value ?? '', highlights),
         },
       };
   const shouldRenderContent = Boolean(field && value);
diff --git a/src/platform/packages/shared/kbn-discover-utils/index.ts b/src/platform/packages/shared/kbn-discover-utils/index.ts
index b0f80e8306b7f..712cc55be45f3 100644
--- a/src/platform/packages/shared/kbn-discover-utils/index.ts
+++ b/src/platform/packages/shared/kbn-discover-utils/index.ts
@@ -74,6 +74,7 @@ export {
   getEsQuerySort,
   getTieBreakerFieldName,
   escapeAndPreserveHighlightTags,
+  getHighlightedFieldValue,
   severityOrder,
 } from './src';
 
diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.test.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.test.ts
deleted file mode 100644
index 3d8f16a866009..0000000000000
--- a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.test.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the "Elastic License
- * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
- * Public License v 1"; you may not use this file except in compliance with, at
- * your election, the "Elastic License 2.0", the "GNU Affero General Public
- * License v3.0 only", or the "Server Side Public License, v 1".
- */
-
-import { escapeAndPreserveHighlightTags } from './escape_preserve_highlight_tags';
-
-// Must match the html tags defined in @kbn/field-formats-plugin (html_tags.ts)
-const PRE = '<mark class="ffSearch__highlight">';
-const POST = '</mark>';
-
-// Must match the tags defined in @kbn/field-formats-plugin (highlight_tags.ts)
-const ES_PRE = '@kibana-highlighted-field@';
-const ES_POST = '@/kibana-highlighted-field@';
-
-describe('escapeAndPreserveHighlightTags', () => {
-  it('escapes HTML when there are no highlight tags', () => {
-    expect(escapeAndPreserveHighlightTags('<hello>world</hello>')).toBe(
-      '&lt;hello&gt;world&lt;/hello&gt;'
-    );
-  });
-
-  it('preserves highlight wrappers while escaping the content', () => {
-    expect(escapeAndPreserveHighlightTags(`${PRE}<hello>${POST}`)).toBe(
-      `${PRE}&lt;hello&gt;${POST}`
-    );
-  });
-
-  it('preserves multiple highlight regions', () => {
-    expect(escapeAndPreserveHighlightTags(`${PRE}hello${POST} + ${PRE}world${POST}`)).toBe(
-      `${PRE}hello${POST} + ${PRE}world${POST}`
-    );
-  });
-
-  it('escapes plain <mark> tags that do not match the highlight format', () => {
-    expect(escapeAndPreserveHighlightTags('<mark><hello></mark>')).toBe(
-      '&lt;mark&gt;&lt;hello&gt;&lt;/mark&gt;'
-    );
-  });
-
-  it('converts ES highlight tags to HTML mark tags with a single match', () => {
-    expect(escapeAndPreserveHighlightTags(`This is a ${ES_PRE}test${ES_POST} message`)).toBe(
-      `This is a ${PRE}test${POST} message`
-    );
-  });
-
-  it('converts ES highlight tags to HTML mark tags with multiple matches', () => {
-    expect(
-      escapeAndPreserveHighlightTags(`${ES_PRE}hello${ES_POST} and ${ES_PRE}world${ES_POST}`)
-    ).toBe(`${PRE}hello${POST} and ${PRE}world${POST}`);
-  });
-
-  it('escapes HTML characters in non-highlighted text around ES tags', () => {
-    expect(escapeAndPreserveHighlightTags(`<b>${ES_PRE}test${ES_POST}</b>`)).toBe(
-      `&lt;b&gt;${PRE}test${POST}&lt;/b&gt;`
-    );
-  });
-
-  it('escapes HTML characters inside ES highlighted text', () => {
-    expect(escapeAndPreserveHighlightTags(`${ES_PRE}<script>${ES_POST}`)).toBe(
-      `${PRE}&lt;script&gt;${POST}`
-    );
-  });
-});
diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts
index 36071ea8a43fc..df90ce4e82f50 100644
--- a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts
+++ b/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts
@@ -9,46 +9,77 @@
 
 import { escape } from 'lodash';
 
-// TODO: These constants are duplicated from @kbn/field-formats-plugin (html_tags.ts / highlight_tags.ts).
-// They are kept locally because packages cannot depend on plugins. This is a temporary
-// workaround until we reach an agreement on how to handle formatted/highlighted content
-// across packages and plugins.
+// TODO: Remove these utils once we have a proper way to access the highlight tags from the field formats plugin.
+
+// Duplicated from @kbn/field-formats-plugin because packages cannot depend on plugins.
 const HTML_HIGHLIGHT_PRE_TAG = '<mark class="ffSearch__highlight">';
 const HTML_HIGHLIGHT_POST_TAG = '</mark>';
 
 const ES_HIGHLIGHT_PRE_TAG = '@kibana-highlighted-field@';
 const ES_HIGHLIGHT_POST_TAG = '@/kibana-highlighted-field@';
 
-const escapeAndConvertHighlightTags = (value: string, preTag: string, postTag: string): string => {
+/**
+ * Escapes HTML in a string while preserving field-format highlight <mark> tags.
+ * Used for values already processed by formatFieldValue / getHighlightHtml (e.g. resource badges).
+ */
+export function escapeAndPreserveHighlightTags(value: string): string {
+  if (!value.includes(HTML_HIGHLIGHT_PRE_TAG)) {
+    return escape(value);
+  }
+
   return value
-    .split(preTag)
+    .split(HTML_HIGHLIGHT_PRE_TAG)
     .map((segment, index) => {
-      // if first segment, escape it and return
       if (index === 0) return escape(segment);
 
-      const postTagIndex = segment.indexOf(postTag);
-
-      // if post tag is not found, escape it and return
+      const postTagIndex = segment.indexOf(HTML_HIGHLIGHT_POST_TAG);
       if (postTagIndex === -1) return escape(segment);
 
-      const highlightedSnippet = segment.substring(0, postTagIndex);
-      const rest = segment.substring(postTagIndex + postTag.length);
+      const highlighted = segment.substring(0, postTagIndex);
+      const rest = segment.substring(postTagIndex + HTML_HIGHLIGHT_POST_TAG.length);
 
-      return (
-        HTML_HIGHLIGHT_PRE_TAG + escape(highlightedSnippet) + HTML_HIGHLIGHT_POST_TAG + escape(rest)
-      );
+      return HTML_HIGHLIGHT_PRE_TAG + escape(highlighted) + HTML_HIGHLIGHT_POST_TAG + escape(rest);
     })
     .join('');
-};
+}
 
-export function escapeAndPreserveHighlightTags(value: string): string {
-  if (value.includes(ES_HIGHLIGHT_PRE_TAG)) {
-    return escapeAndConvertHighlightTags(value, ES_HIGHLIGHT_PRE_TAG, ES_HIGHLIGHT_POST_TAG);
+/**
+ * Merges ES highlight snippets into a field value, producing safe HTML with <mark> tags.
+ * Replicates the logic of getHighlightHtml from @kbn/field-formats-plugin, which packages
+ * cannot import directly.
+ *
+ * Each snippet in the highlights array is the full field value with ES highlight tags
+ * around matched terms. The function iterates over all snippets (handling multi-valued
+ * fields), strips the ES tags to find the matching text, and replaces those occurrences
+ * in the escaped field value with properly tagged <mark> elements.
+ */
+export function getHighlightedFieldValue(
+  fieldValue: string,
+  highlights: string[] | undefined
+): string {
+  if (!highlights?.length) {
+    return escape(fieldValue);
   }
 
-  if (value.includes(HTML_HIGHLIGHT_PRE_TAG)) {
-    return escapeAndConvertHighlightTags(value, HTML_HIGHLIGHT_PRE_TAG, HTML_HIGHLIGHT_POST_TAG);
+  let result = escape(fieldValue);
+
+  for (const highlight of highlights) {
+    const escapedHighlight = escape(highlight);
+
+    const untaggedHighlight = escapedHighlight
+      .split(ES_HIGHLIGHT_PRE_TAG)
+      .join('')
+      .split(ES_HIGHLIGHT_POST_TAG)
+      .join('');
+
+    const taggedHighlight = escapedHighlight
+      .split(ES_HIGHLIGHT_PRE_TAG)
+      .join(HTML_HIGHLIGHT_PRE_TAG)
+      .split(ES_HIGHLIGHT_POST_TAG)
+      .join(HTML_HIGHLIGHT_POST_TAG);
+
+    result = result.split(untaggedHighlight).join(taggedHighlight);
   }
 
-  return escape(value);
+  return result;
 }
diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.test.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.test.ts
new file mode 100644
index 0000000000000..f7ce241ff5499
--- /dev/null
+++ b/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.test.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import {
+  escapeAndPreserveHighlightTags,
+  getHighlightedFieldValue,
+} from './highlight_utils';
+
+// Must match the html tags defined in @kbn/field-formats-plugin (html_tags.ts)
+const PRE = '<mark class="ffSearch__highlight">';
+const POST = '</mark>';
+
+// Must match the tags defined in @kbn/field-formats-plugin (highlight_tags.ts)
+const ES_PRE = '@kibana-highlighted-field@';
+const ES_POST = '@/kibana-highlighted-field@';
+
+describe('escapeAndPreserveHighlightTags', () => {
+  it('escapes HTML when there are no highlight tags', () => {
+    expect(escapeAndPreserveHighlightTags('<hello>world</hello>')).toBe(
+      '&lt;hello&gt;world&lt;/hello&gt;'
+    );
+  });
+
+  it('preserves highlight wrappers while escaping the content', () => {
+    expect(escapeAndPreserveHighlightTags(`${PRE}<hello>${POST}`)).toBe(
+      `${PRE}&lt;hello&gt;${POST}`
+    );
+  });
+
+  it('preserves multiple highlight regions', () => {
+    expect(escapeAndPreserveHighlightTags(`${PRE}hello${POST} + ${PRE}world${POST}`)).toBe(
+      `${PRE}hello${POST} + ${PRE}world${POST}`
+    );
+  });
+
+  it('escapes plain <mark> tags that do not match the highlight format', () => {
+    expect(escapeAndPreserveHighlightTags('<mark><hello></mark>')).toBe(
+      '&lt;mark&gt;&lt;hello&gt;&lt;/mark&gt;'
+    );
+  });
+
+  it('escapes ES highlight tags as plain text (not converted)', () => {
+    expect(escapeAndPreserveHighlightTags(`${ES_PRE}test${ES_POST}`)).toBe(
+      `${ES_PRE}test${ES_POST}`
+    );
+  });
+});
+
+describe('getHighlightedFieldValue', () => {
+  it('escapes the field value when no highlights are provided', () => {
+    expect(getHighlightedFieldValue('<hello>', undefined)).toBe('&lt;hello&gt;');
+  });
+
+  it('escapes the field value when highlights is an empty array', () => {
+    expect(getHighlightedFieldValue('<hello>', [])).toBe('&lt;hello&gt;');
+  });
+
+  it('replaces matching text with highlighted version from a single snippet', () => {
+    expect(
+      getHighlightedFieldValue('This is a test message', [
+        `This is a ${ES_PRE}test${ES_POST} message`,
+      ])
+    ).toBe(`This is a ${PRE}test${POST} message`);
+  });
+
+  it('handles multiple highlight regions within a single snippet', () => {
+    expect(
+      getHighlightedFieldValue('hello world', [`${ES_PRE}hello${ES_POST} ${ES_PRE}world${ES_POST}`])
+    ).toBe(`${PRE}hello${POST} ${PRE}world${POST}`);
+  });
+
+  it('applies highlights from multiple snippets for multi-valued fields', () => {
+    expect(
+      getHighlightedFieldValue('error in service A, warning in service B', [
+        `${ES_PRE}error${ES_POST} in service A`,
+        `${ES_PRE}warning${ES_POST} in service B`,
+      ])
+    ).toBe(`${PRE}error${POST} in service A, ${PRE}warning${POST} in service B`);
+  });
+
+  it('escapes HTML in the field value while preserving highlight tags', () => {
+    expect(
+      getHighlightedFieldValue('<b>test</b>', [`${ES_PRE}<b>test</b>${ES_POST}`])
+    ).toBe(`${PRE}&lt;b&gt;test&lt;/b&gt;${POST}`);
+  });
+
+  it('returns escaped value when highlights do not match field text', () => {
+    expect(
+      getHighlightedFieldValue('no match here', [`${ES_PRE}other text${ES_POST}`])
+    ).toBe('no match here');
+  });
+});
diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.ts
new file mode 100644
index 0000000000000..9eaf794d52d59
--- /dev/null
+++ b/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.ts
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { escape } from 'lodash';
+
+// Duplicated from @kbn/field-formats-plugin because packages cannot depend on plugins.
+const HTML_HIGHLIGHT_PRE_TAG = '<mark class="ffSearch__highlight">';
+const HTML_HIGHLIGHT_POST_TAG = '</mark>';
+
+const ES_HIGHLIGHT_PRE_TAG = '@kibana-highlighted-field@';
+const ES_HIGHLIGHT_POST_TAG = '@/kibana-highlighted-field@';
+
+/**
+ * Escapes HTML in a string while preserving field-format highlight <mark> tags.
+ * Used for values already processed by formatFieldValue / getHighlightHtml (e.g. resource badges).
+ */
+export function escapeAndPreserveHighlightTags(value: string): string {
+  if (!value.includes(HTML_HIGHLIGHT_PRE_TAG)) {
+    return escape(value);
+  }
+
+  return value
+    .split(HTML_HIGHLIGHT_PRE_TAG)
+    .map((segment, index) => {
+      if (index === 0) return escape(segment);
+
+      const postTagIndex = segment.indexOf(HTML_HIGHLIGHT_POST_TAG);
+      if (postTagIndex === -1) return escape(segment);
+
+      const highlighted = segment.substring(0, postTagIndex);
+      const rest = segment.substring(postTagIndex + HTML_HIGHLIGHT_POST_TAG.length);
+
+      return HTML_HIGHLIGHT_PRE_TAG + escape(highlighted) + HTML_HIGHLIGHT_POST_TAG + escape(rest);
+    })
+    .join('');
+}
+
+/**
+ * Merges ES highlight snippets into a field value, producing safe HTML with <mark> tags.
+ * Replicates the logic of getHighlightHtml from @kbn/field-formats-plugin, which packages
+ * cannot import directly.
+ *
+ * Each snippet in the highlights array is the full field value with ES highlight tags
+ * around matched terms. The function iterates over all snippets (handling multi-valued
+ * fields), strips the ES tags to find the matching text, and replaces those occurrences
+ * in the escaped field value with properly tagged <mark> elements.
+ */
+export function getHighlightedFieldValue(
+  fieldValue: string,
+  highlights: string[] | undefined
+): string {
+  if (!highlights?.length) {
+    return escape(fieldValue);
+  }
+
+  let result = escape(fieldValue);
+
+  for (const highlight of highlights) {
+    const escapedHighlight = escape(highlight);
+
+    const untaggedHighlight = escapedHighlight
+      .split(ES_HIGHLIGHT_PRE_TAG)
+      .join('')
+      .split(ES_HIGHLIGHT_POST_TAG)
+      .join('');
+
+    const taggedHighlight = escapedHighlight
+      .split(ES_HIGHLIGHT_PRE_TAG)
+      .join(HTML_HIGHLIGHT_PRE_TAG)
+      .split(ES_HIGHLIGHT_POST_TAG)
+      .join(HTML_HIGHLIGHT_POST_TAG);
+
+    result = result.split(untaggedHighlight).join(taggedHighlight);
+  }
+
+  return result;
+}
diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/index.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/index.ts
index 70f074d60303a..564b07ce2832d 100644
--- a/src/platform/packages/shared/kbn-discover-utils/src/utils/index.ts
+++ b/src/platform/packages/shared/kbn-discover-utils/src/utils/index.ts
@@ -27,7 +27,7 @@ export * from './nested_fields';
 export * from './get_field_value';
 export * from './get_visible_columns';
 export * from './convert_value_to_string';
-export * from './escape_preserve_highlight_tags';
+export * from './highlight_utils';
 export * from './sorting';
 export { DiscoverFlyouts, dismissAllFlyoutsExceptFor, dismissFlyouts } from './dismiss_flyouts';
 export { prepareDataViewForEditing } from './prepare_data_view_for_editing';
diff --git a/src/platform/plugins/shared/unified_doc_viewer/public/components/doc_viewer_logs_overview/sub_components/content_breakdown/content_breakdown.tsx b/src/platform/plugins/shared/unified_doc_viewer/public/components/doc_viewer_logs_overview/sub_components/content_breakdown/content_breakdown.tsx
index 9624db0dad4a2..294058760cea4 100644
--- a/src/platform/plugins/shared/unified_doc_viewer/public/components/doc_viewer_logs_overview/sub_components/content_breakdown/content_breakdown.tsx
+++ b/src/platform/plugins/shared/unified_doc_viewer/public/components/doc_viewer_logs_overview/sub_components/content_breakdown/content_breakdown.tsx
@@ -20,7 +20,7 @@ import {
   getMessageFieldWithFallbacks,
   type DataTableRecord,
   type LogDocumentOverview,
-  escapeAndPreserveHighlightTags,
+  getHighlightedFieldValue,
 } from '@kbn/discover-utils';
 import type { ObservabilityStreamsFeature } from '@kbn/discover-shared-plugin/public';
 import type { DataView } from '@kbn/data-views-plugin/common';
@@ -43,14 +43,14 @@ export const ContentBreakdown = ({
   });
 
   const rawFieldValue = hit && field ? hit.flattened[field] : undefined;
-  const highlightSnippet = field ? hit.raw.highlight?.[field]?.[0] : undefined;
+  const highlights = field ? hit.raw.highlight?.[field] : undefined;
 
   const messageCodeBlockProps = formattedValue
     ? { language: 'json', children: formattedValue }
     : {
         language: 'txt',
         dangerouslySetInnerHTML: {
-          __html: escapeAndPreserveHighlightTags(highlightSnippet ?? value ?? ''),
+          __html: getHighlightedFieldValue(value ?? '', highlights),
         },
       };
   const hasMessageField = field && value;

From f8a7d63ff80294858097bfa037710b1c597c0b35 Mon Sep 17 00:00:00 2001
From: TFCMarques <tiago.marques@elastic.co>
Date: Fri, 27 Mar 2026 18:57:39 +0000
Subject: [PATCH 3/5] lint

---
 .../src/utils/highlight_utils.test.ts           | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.test.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.test.ts
index f7ce241ff5499..5032abc067463 100644
--- a/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.test.ts
+++ b/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.test.ts
@@ -7,10 +7,7 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-import {
-  escapeAndPreserveHighlightTags,
-  getHighlightedFieldValue,
-} from './highlight_utils';
+import { escapeAndPreserveHighlightTags, getHighlightedFieldValue } from './highlight_utils';
 
 // Must match the html tags defined in @kbn/field-formats-plugin (html_tags.ts)
 const PRE = '<mark class="ffSearch__highlight">';
@@ -85,14 +82,14 @@ describe('getHighlightedFieldValue', () => {
   });
 
   it('escapes HTML in the field value while preserving highlight tags', () => {
-    expect(
-      getHighlightedFieldValue('<b>test</b>', [`${ES_PRE}<b>test</b>${ES_POST}`])
-    ).toBe(`${PRE}&lt;b&gt;test&lt;/b&gt;${POST}`);
+    expect(getHighlightedFieldValue('<b>test</b>', [`${ES_PRE}<b>test</b>${ES_POST}`])).toBe(
+      `${PRE}&lt;b&gt;test&lt;/b&gt;${POST}`
+    );
   });
 
   it('returns escaped value when highlights do not match field text', () => {
-    expect(
-      getHighlightedFieldValue('no match here', [`${ES_PRE}other text${ES_POST}`])
-    ).toBe('no match here');
+    expect(getHighlightedFieldValue('no match here', [`${ES_PRE}other text${ES_POST}`])).toBe(
+      'no match here'
+    );
   });
 });

From c26f565269cf2c81784035e8f936e2bafd0c939b Mon Sep 17 00:00:00 2001
From: TFCMarques <tiago.marques@elastic.co>
Date: Fri, 27 Mar 2026 19:03:52 +0000
Subject: [PATCH 4/5] remove old file

---
 .../utils/escape_preserve_highlight_tags.ts   | 85 -------------------
 1 file changed, 85 deletions(-)
 delete mode 100644 src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts

diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts
deleted file mode 100644
index df90ce4e82f50..0000000000000
--- a/src/platform/packages/shared/kbn-discover-utils/src/utils/escape_preserve_highlight_tags.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the "Elastic License
- * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
- * Public License v 1"; you may not use this file except in compliance with, at
- * your election, the "Elastic License 2.0", the "GNU Affero General Public
- * License v3.0 only", or the "Server Side Public License, v 1".
- */
-
-import { escape } from 'lodash';
-
-// TODO: Remove these utils once we have a proper way to access the highlight tags from the field formats plugin.
-
-// Duplicated from @kbn/field-formats-plugin because packages cannot depend on plugins.
-const HTML_HIGHLIGHT_PRE_TAG = '<mark class="ffSearch__highlight">';
-const HTML_HIGHLIGHT_POST_TAG = '</mark>';
-
-const ES_HIGHLIGHT_PRE_TAG = '@kibana-highlighted-field@';
-const ES_HIGHLIGHT_POST_TAG = '@/kibana-highlighted-field@';
-
-/**
- * Escapes HTML in a string while preserving field-format highlight <mark> tags.
- * Used for values already processed by formatFieldValue / getHighlightHtml (e.g. resource badges).
- */
-export function escapeAndPreserveHighlightTags(value: string): string {
-  if (!value.includes(HTML_HIGHLIGHT_PRE_TAG)) {
-    return escape(value);
-  }
-
-  return value
-    .split(HTML_HIGHLIGHT_PRE_TAG)
-    .map((segment, index) => {
-      if (index === 0) return escape(segment);
-
-      const postTagIndex = segment.indexOf(HTML_HIGHLIGHT_POST_TAG);
-      if (postTagIndex === -1) return escape(segment);
-
-      const highlighted = segment.substring(0, postTagIndex);
-      const rest = segment.substring(postTagIndex + HTML_HIGHLIGHT_POST_TAG.length);
-
-      return HTML_HIGHLIGHT_PRE_TAG + escape(highlighted) + HTML_HIGHLIGHT_POST_TAG + escape(rest);
-    })
-    .join('');
-}
-
-/**
- * Merges ES highlight snippets into a field value, producing safe HTML with <mark> tags.
- * Replicates the logic of getHighlightHtml from @kbn/field-formats-plugin, which packages
- * cannot import directly.
- *
- * Each snippet in the highlights array is the full field value with ES highlight tags
- * around matched terms. The function iterates over all snippets (handling multi-valued
- * fields), strips the ES tags to find the matching text, and replaces those occurrences
- * in the escaped field value with properly tagged <mark> elements.
- */
-export function getHighlightedFieldValue(
-  fieldValue: string,
-  highlights: string[] | undefined
-): string {
-  if (!highlights?.length) {
-    return escape(fieldValue);
-  }
-
-  let result = escape(fieldValue);
-
-  for (const highlight of highlights) {
-    const escapedHighlight = escape(highlight);
-
-    const untaggedHighlight = escapedHighlight
-      .split(ES_HIGHLIGHT_PRE_TAG)
-      .join('')
-      .split(ES_HIGHLIGHT_POST_TAG)
-      .join('');
-
-    const taggedHighlight = escapedHighlight
-      .split(ES_HIGHLIGHT_PRE_TAG)
-      .join(HTML_HIGHLIGHT_PRE_TAG)
-      .split(ES_HIGHLIGHT_POST_TAG)
-      .join(HTML_HIGHLIGHT_POST_TAG);
-
-    result = result.split(untaggedHighlight).join(taggedHighlight);
-  }
-
-  return result;
-}

From 1e16540983f22590a7507688a394087f2c5c25ec Mon Sep 17 00:00:00 2001
From: TFCMarques <tiago.marques@elastic.co>
Date: Mon, 30 Mar 2026 12:13:16 +0100
Subject: [PATCH 5/5] add todo

---
 .../shared/kbn-discover-utils/src/utils/highlight_utils.ts    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.ts b/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.ts
index 9eaf794d52d59..8e57b08527726 100644
--- a/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.ts
+++ b/src/platform/packages/shared/kbn-discover-utils/src/utils/highlight_utils.ts
@@ -9,6 +9,10 @@
 
 import { escape } from 'lodash';
 
+// TODO: Remove these duplicated utils when we have a proper way to access the highlight tags
+// or when we have a proper HTML field formatters
+// Related issue for field formatters: https://github.com/elastic/kibana/issues/259286
+
 // Duplicated from @kbn/field-formats-plugin because packages cannot depend on plugins.
 const HTML_HIGHLIGHT_PRE_TAG = '<mark class="ffSearch__highlight">';
 const HTML_HIGHLIGHT_POST_TAG = '</mark>';