-
Notifications
You must be signed in to change notification settings - Fork 8.5k
[KQL] Should wildcard queries default to case-insensitive search? #80591
Copy link
Copy link
Closed as not planned
Closed as not planned
Copy link
Labels
Feature:KQLKQLKQLFeature:SearchQuerying infrastructure in KibanaQuerying infrastructure in KibanaIceboxTeam:DataDiscoveryDiscover, search (data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL. t//Discover, search (data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL. t//discussenhancementNew value added to drive a business resultNew value added to drive a business resultimpact:lowAddressing this issue will have a low level of impact on the quality/strength of our product.Addressing this issue will have a low level of impact on the quality/strength of our product.loe:needs-researchThis issue requires some research before it can be worked on or estimatedThis issue requires some research before it can be worked on or estimated
Metadata
Metadata
Assignees
Labels
Feature:KQLKQLKQLFeature:SearchQuerying infrastructure in KibanaQuerying infrastructure in KibanaIceboxTeam:DataDiscoveryDiscover, search (data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL. t//Discover, search (data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL. t//discussenhancementNew value added to drive a business resultNew value added to drive a business resultimpact:lowAddressing this issue will have a low level of impact on the quality/strength of our product.Addressing this issue will have a low level of impact on the quality/strength of our product.loe:needs-researchThis issue requires some research before it can be worked on or estimatedThis issue requires some research before it can be worked on or estimated
Type
Fields
Give feedbackNo fields configured for issues without a type.
Starting in 7.10, Elasticsearch supports an option to set
case_insensitive: trueon thewildcardsearch query. This works internally by rewriting the searches to regular expressions that match upper and lower case characters.Options for how to expose this
a. Set this flag to be the default in all KQL wildcard searches, without changing the KQL grammar. This has some potential performance issues as described in a comment by @markharwood in the related issue about
wildcardfields:b. Only set this flag by default when the user is running wildcard query on
wildcardtype fields. This would be the most performant option, but it would potentially be confusing to have two different behaviors.c. Add something to the KQL grammar, like this request to add an UPPER() function to KQL. This could let users enable case insensitive queries as needed. I don't have a proposed grammar.
cc @elastic/kibana-app-arch @markharwood