Calling the watcher Get watch API endpoint generate malformed json

[frconil]

Elasticsearch Version

8.6.1

Installed Plugins

No response

Java Version

bundled

OS Version

ESS

Problem Description

When using the Get watch API endpoint to export current watches, the JSON generated may not pass validation in either Dev Tools or the Kibana watcher UI.

In particular, this happens in triple quoted strings (e.g. """ delimited strings) terminated by a single ". For instance this is a line being generated by the API output:

"query_string": {
  "query": """("term" OR "myotherterm") AND "condition" AND NOT "othercondition""""
}

This line will trigger in error in both dev tools or the watcher interface reporting it as invalid json.

this fixed line works:

"query_string": {
  "query": """("term" OR "myotherterm") AND "condition" AND NOT "othercondition" """
}

Steps to Reproduce

Create a watch where the query is delimited by """. Export this watch with:

GET _watcher/watch/<watch_id>

Try and import the content of the _source object with PUT _watcher/watch/<watch_id> {<source>}.

Logs (if relevant)

[elasticsearchmachine]

Pinging @elastic/es-data-management (Team:Data Management)

[dakrone]

I've transferred this to the Kibana repository, as Elasticsearch itself does not generate any JSON using triple-quotes ("""). I suspect this is something related to the Dev Console within Kibana.

[elasticmachine]

Pinging @elastic/platform-deployment-management (Team:Deployment Management)

[ElenaStoeva]

Might be related to #13528

[elasticmachine]

Pinging @elastic/kibana-management (Team:Kibana Management)