[Discover] Ensure fields prefixed with 'log.' are ignored in log docu…

…ment profile resolution if their values are null (elastic#190184)

## Summary

This PR fixes an issue where non-log ES|QL results were being recognized
as logs and showing the log overview doc viewer tab for mixed index
patterns like `FROM logs-synth-default,metrics-*`. This is because they
technically have `log.` prefixed fields in the returned ES|QL results,
but the values are always null.

### Checklist

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

src/plugins/discover/public/context_awareness/profile_providers/log_document_profile/profile.test.ts

@@ -39,7 +39,7 @@ describe('logDocumentProfileProvider', () => {
       logDocumentProfileProvider.resolve({
         rootContext: ROOT_CONTEXT,
         dataSourceContext: DATA_SOURCE_CONTEXT,
-        record: buildMockRecord('logs-2000-01-01', {
+        record: buildMockRecord('another-index', {
           'data_stream.type': ['logs'],
         }),
       })
@@ -51,13 +51,26 @@ describe('logDocumentProfileProvider', () => {
       logDocumentProfileProvider.resolve({
         rootContext: ROOT_CONTEXT,
         dataSourceContext: DATA_SOURCE_CONTEXT,
-        record: buildMockRecord('logs-2000-01-01', {
+        record: buildMockRecord('another-index', {
           'log.level': ['INFO'],
         }),
       })
     ).toEqual(RESOLUTION_MATCH);
   });
 
+  it('does not match records where fields prefixed with "log." are null', () => {
+    expect(
+      logDocumentProfileProvider.resolve({
+        rootContext: ROOT_CONTEXT,
+        dataSourceContext: DATA_SOURCE_CONTEXT,
+        record: buildMockRecord('another-index', {
+          'log.level': null,
+          'log.other': undefined,
+        }),
+      })
+    ).toEqual(RESOLUTION_MISMATCH);
+  });
+
   it('matches records with indices matching the allowed pattern', () => {
     expect(
       logDocumentProfileProvider.resolve({
@@ -112,7 +125,7 @@ describe('logDocumentProfileProvider', () => {
   });
 });
 
-const buildMockRecord = (index: string, fields: Record<string, unknown[]> = {}) =>
+const buildMockRecord = (index: string, fields: Record<string, unknown> = {}) =>
   buildDataTableRecord({
     _id: '',
     _index: index,

src/plugins/discover/public/context_awareness/profile_providers/log_document_profile/profile.tsx

@@ -56,5 +56,7 @@ const getDataStreamType = getFieldValues('data_stream.type');
 const getIndices = getFieldValues('_index');
 
 const hasFieldsWithPrefix = (prefix: string) => (record: DataTableRecord) => {
-  return Object.keys(record.flattened).some((field) => field.startsWith(prefix));
+  return Object.keys(record.flattened).some(
+    (field) => field.startsWith(prefix) && record.flattened[field] != null
+  );
 };