[BUG] Expanded query result not matching query list view when searching with WHERE NOT clause

[brijos]

What is the bug?
When searching for a particular field using a WHERE NOT clause, the query executes successfully and the results list shows up as expected. However, when the user expands a query result to either the table or JSON view, the field results do not match what is shown in the list view.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Go to Observability Log Explorer
2. Select index
3. Add Query such as source = opensearch_dashboards_sample_data_flights | where NOT Carrier = "BeatsWest"
4. Expand a query result and observe that the expanded results doesn't match what is shown on the list view.

What is the expected behavior?
The results list summary is the same as what is shown in the expanded view.

What is your host/environment?

• OS: 2.15
• Plugins: Observability/PPL

Do you have any screenshots?
None that can be shared.

[dblock]

[Catch All Triage - 1, 2, 3]