[8.16] [ES|QL] Open bracket parsing bug (#196241) (#196892)

# Backport

This will backport the following commits from `main` to `8.16`:
- [[ES|QL] Open bracket parsing bug
(#196241)](https://github.com/elastic/kibana/pull/196241)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Vadim
Kibana","email":"82822460+vadimkibana@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-10-18T14:15:29Z","message":"[ES|QL]
Open bracket parsing bug (#196241)\n\n## Summary\r\n\r\nCloses
https://github.com/elastic/kibana/issues/191683\r\n\r\nGracefully
handles open square brackets in `FROM` command.\r\n\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [x] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)","sha":"3849d99a41e2e42c9a9e06b97c3affa2e75999d1","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","review","release_note:skip","v9.0.0","Feature:ES|QL","Team:ESQL","v8.16.0","backport:version","v8.17.0"],"title":"[ES|QL]
Open bracket parsing
bug","number":196241,"url":"https://github.com/elastic/kibana/pull/196241","mergeCommit":{"message":"[ES|QL]
Open bracket parsing bug (#196241)\n\n## Summary\r\n\r\nCloses
https://github.com/elastic/kibana/issues/191683\r\n\r\nGracefully
handles open square brackets in `FROM` command.\r\n\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [x] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)","sha":"3849d99a41e2e42c9a9e06b97c3affa2e75999d1"}},"sourceBranch":"main","suggestedTargetBranches":["8.16","8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/196241","number":196241,"mergeCommit":{"message":"[ES|QL]
Open bracket parsing bug (#196241)\n\n## Summary\r\n\r\nCloses
https://github.com/elastic/kibana/issues/191683\r\n\r\nGracefully
handles open square brackets in `FROM` command.\r\n\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [x] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)","sha":"3849d99a41e2e42c9a9e06b97c3affa2e75999d1"}},{"branch":"8.16","label":"v8.16.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.17.0","branchLabelMappingKey":"^v8.17.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Vadim Kibana <82822460+vadimkibana@users.noreply.github.com>

packages/kbn-esql-ast/src/parser/__tests__/from.test.ts

@@ -187,5 +187,21 @@ describe('FROM', () => {
 
       expect(errors.length > 0).toBe(true);
     });
+
+    it('when open square bracket "[" is entered', () => {
+      const text = 'FROM kibana_sample_data_logs [';
+      const { errors } = parse(text);
+
+      expect(errors.length > 0).toBe(true);
+      expect(errors[0].message.toLowerCase().includes('metadata')).toBe(true);
+    });
+
+    it('when close square bracket "]" is entered', () => {
+      const text = 'FROM kibana_sample_data_logs []';
+      const { errors } = parse(text);
+
+      expect(errors.length > 0).toBe(true);
+      expect(errors[0].message.toLowerCase().includes('metadata')).toBe(true);
+    });
   });
 });

packages/kbn-esql-ast/src/parser/esql_ast_builder_listener.ts

@@ -120,7 +120,7 @@ export class ESQLAstBuilderListener implements ESQLParserListener {
     const metadataContext = ctx.metadata();
     const metadataContent =
       metadataContext?.deprecated_metadata()?.metadataOption() || metadataContext?.metadataOption();
-    if (metadataContent) {
+    if (metadataContent && metadataContent.METADATA()) {
       const option = createOption(
         metadataContent.METADATA().getText().toLowerCase(),
         metadataContent

x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/hooks/use_esql_index.test.ts

@@ -27,8 +27,16 @@ describe('useEsqlIndex', () => {
     expect(result.current).toEqual([]);
   });
 
+  it('returns indices which appear in source before syntax error', async () => {
+    const typeErrorCausingQuery = 'from auditbeat* [, auditbeat2*';
+
+    const { result } = renderHook(() => useEsqlIndex(typeErrorCausingQuery, 'esql'));
+
+    expect(result.current).toEqual(['auditbeat*']);
+  });
+
   it('should return empty array if invalid query is causing a TypeError in ES|QL parser', async () => {
-    const typeErrorCausingQuery = 'from auditbeat* []';
+    const typeErrorCausingQuery = 'from []';
 
     const { result } = renderHook(() => useEsqlIndex(typeErrorCausingQuery, 'esql'));