Fix issue with KQL wildcard queries not properly escaping backslashes (#174464)

## Summary

Fixes https://github.com/elastic/kibana/issues/169709.

Prior to this PR, KQL queries against keyword fields would not properly
handle escaped special characters (such as backslash). This PR fixes the
behavior to properly re-escape special characters before sending them
along to the wildcard query.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### Release note

KQL queries against wildcards now properly handle escaped special
characters without requiring double-escaping.

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Lukas Olson 2024-01-09 09:24:12 -07:00 committed by GitHub
parent 2e1a611798
commit 46fbfd3b13
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 1 deletions

View file

@ -253,6 +253,29 @@ describe('kuery functions', () => {
expect(result).toEqual(expected);
});
test('should create a wildcard query with backslashes properly escaped', () => {
const expected = {
bool: {
should: [
{
wildcard: {
'machine.os.keyword': { value: '*\\\\*' },
},
},
],
minimum_should_match: 1,
},
};
const node = nodeTypes.function.buildNode(
'is',
'machine.os.keyword',
'*\\\\*'
) as KqlIsFunctionNode;
const result = is.toElasticsearchQuery(node, indexPattern);
expect(result).toEqual(expected);
});
test('should support scripted fields', () => {
const node = nodeTypes.function.buildNode(
'is',

View file

@ -159,7 +159,7 @@ export function toElasticsearchQuery(
? {
wildcard: {
[field.name]: {
value,
value: wildcard.toQueryStringQuery(valueArg),
...(typeof config.caseInsensitive === 'boolean' && {
case_insensitive: config.caseInsensitive,
}),