Skip to content

Expose all KqlQueryBuilder parameters in ES|QL KQL function #135823

@afoucret

Description

@afoucret

Context

  • Bug #135772 has been resolved, making the KQL function case sensitive by default (consistent with Kibana and documentation).
  • Some users may want to perform case-insensitive queries on keyword fields (see this comment).
  • The query DSL implementation of KQL supports multiple optional parameters (case_insensitive, default_field, time_zone, and boost).
  • The ES|QL kql function currently relies on the query DSL but these parameters are not exposed through the ES|QL function

Acceptance Criteria

  • Users can specify all KQL query parameters supported by the underlying KqlQueryBuilder in the ES|QL KQL function:
    • case_insensitive (boolean): Control case sensitivity for field names and keyword/text terms
    • default_field (string): Default field pattern when no field is specified in the query
    • time_zone (string): Time zone for interpreting date literals
    • boost (float): Query boost for relevance scoring
  • If parameters are not specified, the default behavior matches the underlying KqlQueryBuilder defaults
  • Documentation clearly explains all available parameters and their behavior
  • Parameter validation matches the query DSL implementation

Proposed Syntax

Allow optional named parameters for the function:

| WHERE KQL("title: value", {"case_insensitive": true})
| WHERE KQL("timeout", {"default_field": "logs.*", "time_zone": "Europe/Paris"})
| WHERE KQL("error", {"case_insensitive": true, "boost": 2.0})

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions