This PR adds a new syntax to KQL for querying nested fields.
Nested fields can be queried in two different ways:
Parts of the query may only match a single nested doc (bool inside nested). This is what most people want when querying on a nested field.
Parts of the query may match different nested docs (nested inside bool). This is how a regular object field works but nested fields can be queried in the same way. Although generally less useful, there are occasions where one might want to query a nested field in this way.
The new KQL syntax supports both.
* Adds saved query docs to search section
* Adds Saved Queries docs to Discover search
* Makes changes requested by PR review
* Changes 'visualizations and dashboards' to 'Visualize and Dashboard', adds x-pack label back to Read only access section
* Changes some text
* Changes Saving searches section
* Rewords saved queries section
* Changes 'Saved search' to 'saved search', tweeks a few words
* Removes second sentence from intro to saved queries
* Changes save button text reference
* Updates screen shots
* Moves images around, adds a hover instruction to delete a query and adds a screen shot of the delete button
* Makes changes as requested
* Adding read-only mode section to Discover
* No more "mode" or "badge" terminology
* Putting newline back
* Adding "Saving" section for visualize
* Adding dashboard read only access section
* Timelion gets read-only documentation
* Adding read only access section to index patterns and advanced settings
* Adding graph read only access section
Makes our language updates more visible to users and removes mentions of Kuery as a separate language. Users still get the old lucene experience by default, but have the option to opt-in to "experimental query features" directly in the query bar. Goal is to get more feedback by making these new features more prominent and less of a jump from lucene.
This PR evolves Kuery into a simplified, more lucene-like language. In a follow up PR we plan on getting rid of the language switcher dropdown and instead add a checkbox that will allow users to opt-in to this syntax, which will feel less like a separate language and more like a set of enhancements to the existing lucene query syntax.
This PR also updates the simple grammar to solve the following:
* Wildcards in field names
* "is one of" shorthand (e.g. foo:(bar OR baz OR qux))
* Don't split on whitespace (require explicit AND/ORs, case insensitive)
* "exists" query (e.g. foo:*)
* Improved range query shorthands (e.g. foo <= 1)
* Wildcard queries
Since this new syntax is simpler and does not support every filter type like old Kuery did, this PR also brings back the filter bar when kuery is selected in the language picker.
See the documentation updates in this PR if you need an overview of the new syntax (and let us know if the documentation is lacking).
* Re-enable filter editor suggestions
* Use search instead of include
* Escape query
* Show spinner
* Use include rather than search
* Add additional regex and explanation for parameters
* Add suggestions API test
* Make sure test actually runs
* Use send instead of query
* Fix suggestions API test
Fixes#13563
Brings additional attention to the fact that Kuery uses implicit ANDs whereas Lucene query syntax uses implicit ORs, which could confuse users if they're not aware of the difference.
This overhaul of the docs structure puts Kibana's documentation more
inline with the structure that is used in Elasticsearch. This will help
us better organize the docs going forward as more docs are added.
This also includes a few necessary content changes for 5.0.
