Inconsistent field display in visualization for ES|QL with custom timestamp

[behnam-ramouzeh]

Kibana version:
Kibana Demo 8.17.0

Describe the bug:

When running an ES|QL command without specifying a custom timestamp field, the visualization in Kibana shows one less field (host) compared to when a custom timestamp field is specified.

This inconsistency occurs despite the responses being the same, as the utc_time field is equal to the @timestamp field.

Steps to Reproduce

1. Go to https://demo.elastic.co/app/discover and click on Try ES|QL. Run the following ES|QL command without specifying a custom timestamp field:

   FROM kibana_sample_data_logs | STATS min_time = MIN(utc_time), max_time = MAX(utc_time) by host | EVAL delta = DATE_DIFF("minute", min_time, max_time)

   Request sent:

   POST /_query/async?drop_null_columns
   {
     "query": "FROM kibana_sample_data_logs | STATS min_time = MIN(utc_time), max_time = MAX(utc_time) by host | EVAL delta = DATE_DIFF(\"minute\", min_time, max_time) ",
     "locale": "en",
     "include_ccs_metadata": true,
     "filter": {
       "bool": {
         "must": [],
         "filter": [
           {
             "range": {
               "@timestamp": {
                 "format": "strict_date_optional_time",
                 "gte": "2025-01-09T15:40:55.978Z",
                 "lte": "2025-01-09T15:55:55.978Z"
               }
             }
           }
         ],
         "should": [],
         "must_not": []
       }
     }
   }

2. Observe the response:

   {
     "rawResponse": {
       "is_running": false,
       "took": 20,
       "all_columns": [
         {
           "name": "min_time",
           "type": "date"
         },
         {
           "name": "max_time",
           "type": "date"
         },
         {
           "name": "host",
           "type": "text"
         },
         {
           "name": "delta",
           "type": "integer"
         }
       ],
       "columns": [
         {
           "name": "min_time",
           "type": "date"
         },
         {
           "name": "max_time",
           "type": "date"
         },
         {
           "name": "host",
           "type": "text"
         },
         {
           "name": "delta",
           "type": "integer"
         }
       ],
       "values": [
         [
           "2025-01-09T15:49:16.516Z",
           "2025-01-09T15:49:16.516Z",
           "artifacts.elastic.co",
           0
         ],
         [
           "2025-01-09T15:44:22.843Z",
           "2025-01-09T15:55:50.611Z",
           "www.elastic.co",
           11
         ],
         [
           "2025-01-09T15:54:37.430Z",
           "2025-01-09T15:54:37.430Z",
           "cdn.elastic-elastic-elastic.org",
           0
         ]
       ]
     }
   }

3. Run the following ES|QL command specifying a custom timestamp field:

   FROM kibana_sample_data_logs | WHERE utc_time >= ?_tstart AND utc_time <= ?_tend | STATS min_time = MIN(utc_time), max_time = MAX(utc_time) by host | EVAL delta = DATE_DIFF("minute", min_time, max_time)

   Request sent:

   POST /_query/async?drop_null_columns
   {
     "query": "FROM kibana_sample_data_logs | WHERE utc_time >= ?_tstart AND utc_time <= ?_tend | STATS min_time = MIN(utc_time), max_time = MAX(utc_time) by host | EVAL delta = DATE_DIFF(\"minute\", min_time, max_time) ",
     "locale": "en",
     "include_ccs_metadata": true,
     "params": [
       {
         "_tstart": "2025-01-09T15:40:58.514Z"
       },
       {
         "_tend": "2025-01-09T15:55:58.515Z"
       }
     ],
     "filter": {
       "bool": {
         "must": [],
         "filter": [
           {
             "range": {
               "utc_time": {
                 "format": "strict_date_optional_time",
                 "gte": "2025-01-09T15:40:58.515Z",
                 "lte": "2025-01-09T15:55:58.515Z"
               }
             }
           }
         ],
         "should": [],
         "must_not": []
       }
     }
   }

4. Observe the response:

   {
     "rawResponse": {
       "is_running": false,
       "took": 12,
       "all_columns": [
         {
           "name": "min_time",
           "type": "date"
         },
         {
           "name": "max_time",
           "type": "date"
         },
         {
           "name": "host",
           "type": "text"
         },
         {
           "name": "delta",
           "type": "integer"
         }
       ],
       "columns": [
         {
           "name": "min_time",
           "type": "date"
         },
         {
           "name": "max_time",
           "type": "date"
         },
         {
           "name": "host",
           "type": "text"
         },
         {
           "name": "delta",
           "type": "integer"
         }
       ],
       "values": [
         [
           "2025-01-09T15:49:16.516Z",
           "2025-01-09T15:49:16.516Z",
           "artifacts.elastic.co",
           0
         ],
         [
           "2025-01-09T15:44:22.843Z",
           "2025-01-09T15:55:50.611Z",
           "www.elastic.co",
           11
         ],
         [
           "2025-01-09T15:54:37.430Z",
           "2025-01-09T15:54:37.430Z",
           "cdn.elastic-elastic-elastic.org",
           0
         ]
       ]
     }
   }

Expected Behavior

The visualization should display the same fields regardless of whether a custom timestamp field is specified, as the responses are identical.

Actual Behavior

The visualization shows one less field (host) when the custom timestamp field is specified.

Additional context

The utc_time field is equal to the @timestamp field in the dataset.

Video

ESQL.-.Issue.with.the.customized.timestamp.mp4