Skip to content

[KQL] Should wildcard queries default to case-insensitive search? #80591

@wylieconlon

Description

@wylieconlon

Starting in 7.10, Elasticsearch supports an option to set case_insensitive: true on the wildcard search query. This works internally by rewriting the searches to regular expressions that match upper and lower case characters.

Options for how to expose this

a. Set this flag to be the default in all KQL wildcard searches, without changing the KQL grammar. This has some potential performance issues as described in a comment by @markharwood in the related issue about wildcard fields:

For example - if they support a *foo* style query in the KQL bar and assume, like normal whole-term based queries, that can be run across multiple fields then it may result in slow results or timeouts. Wildcard fields will be fast but hitting other fields which are keyword will involve an expensive linear scan.

b. Only set this flag by default when the user is running wildcard query on wildcard type fields. This would be the most performant option, but it would potentially be confusing to have two different behaviors.

c. Add something to the KQL grammar, like this request to add an UPPER() function to KQL. This could let users enable case insensitive queries as needed. I don't have a proposed grammar.

cc @elastic/kibana-app-arch @markharwood

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature:KQLKQLFeature:SearchQuerying infrastructure in KibanaIceboxTeam:DataDiscoveryDiscover, search (data plugin and KQL), data views, saved searches. For ES|QL, use Team:ES|QL. t//discussenhancementNew value added to drive a business resultimpact:lowAddressing this issue will have a low level of impact on the quality/strength of our product.loe:needs-researchThis issue requires some research before it can be worked on or estimated

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions