Fix issue with KQL wildcard queries not properly escaping backslashes (…

…elastic#174464) ## Summary Fixes elastic#169709. Prior to this PR, KQL queries against keyword fields would not properly handle escaped special characters (such as backslash). This PR fixes the behavior to properly re-escape special characters before sending them along to the wildcard query. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Release note KQL queries against wildcards now properly handle escaped special characters without requiring double-escaping. Co-authored-by: Kibana Machine <[email protected]>
nreese · Jan 10, 2024 · 0f8c7f9 · 0f8c7f9
1 parent 38a0b6c
commit 0f8c7f9
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 1 deletion.
diff --git a/packages/kbn-es-query/src/kuery/functions/is.test.ts b/packages/kbn-es-query/src/kuery/functions/is.test.ts
@@ -253,6 +253,29 @@ describe('kuery functions', () => {
         expect(result).toEqual(expected);
       });
 
+      test('should create a wildcard query with backslashes properly escaped', () => {
+        const expected = {
+          bool: {
+            should: [
+              {
+                wildcard: {
+                  'machine.os.keyword': { value: '*\\\\*' },
+                },
+              },
+            ],
+            minimum_should_match: 1,
+          },
+        };
+        const node = nodeTypes.function.buildNode(
+          'is',
+          'machine.os.keyword',
+          '*\\\\*'
+        ) as KqlIsFunctionNode;
+        const result = is.toElasticsearchQuery(node, indexPattern);
+
+        expect(result).toEqual(expected);
+      });
+
       test('should support scripted fields', () => {
         const node = nodeTypes.function.buildNode(
           'is',

diff --git a/packages/kbn-es-query/src/kuery/functions/is.ts b/packages/kbn-es-query/src/kuery/functions/is.ts
@@ -159,7 +159,7 @@ export function toElasticsearchQuery(
         ? {
             wildcard: {
               [field.name]: {
-                value,
+                value: wildcard.toQueryStringQuery(valueArg),
                 ...(typeof config.caseInsensitive === 'boolean' && {
                   case_insensitive: config.caseInsensitive,
                 }),