Currently EQL requests use rule to specify a query - this should be aligned with the existing terminology and be renamed to query for consistency with the rest of the APIs, while the existing query param, used for passing a query dsl for filtering, renamed to filter.