Adding field to Alerts view and sorting breaks table display.

[ajoliveira]

Kibana version: 8.15/8.16

Elasticsearch version: 8.15/8.16

Server OS version: Elastic Cloud

Browser version: Chrome - 130.0.6723.58 (Official Build) (x86_64)

Browser OS version: Mac OS Sonoma 14.7

Original install method (e.g. download page, yum, from source, etc.): Elastic Cloud

Describe the bug:
In our Alerts view (Security Solution or Stack Management), it is possible to choose and add other fields to the table/grid view. Unfortunately, if you choose to sort on this newly added field, there is no way to recover the table/grid without editing the 'Local Storage' settings in the browser.

Steps to reproduce:

1. Use field selector to pick a field (ex: cloud.availability_zone)
2. Click on field header in table/grid to sort on it
3. One of 2 things can/may happen:

• table/grid disappears and only see a 'No results match your search criteria' message
• pop-up in Kibana notes that your chosen field is not in the mapping and cannot be used for sorting

In both cases, at this point the 'sorting' request has been added to one of these 2 Browser Local Storage settings depending on which Alerts view you are working with:

Stack Management -> Alerts and Insights -> Alerts
stack-alerts-page-table

Security Solution -> Alerts
detection-engine-alert-table-securitySolution-alerts-page-gridView

In the case where the table/grid is still visible:

• removing the field does not remove it from the sorting option
• reloading the page or navigating away and back removes the table/grid completely

The only way to recover from this is to delete the Local Storage setting(s) noted above and reloading the Alerts page.

Expected behavior:

• A consistent friendly message that field cannot be used for sorting
• Allowing the headers and field selectors to remain visible so that the field can be removed
• Correctly removing the field from 'sort' option if it is removed from field list/columns

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)