Summary

@spong noticed a bug where when searching fields with escaped values, nothing would get returned: #42866

After playing with the query, I noticed Elasticsearch does not enjoy getting escaped values on strings.

This does not have matches:

"match_phrase": {
  "event.action": "Registry value set \\(rule\\: RegistryEvent\\)"
}

This has matches

"match_phrase": {
  "event.action": "Registry value set (rule: RegistryEvent)"
}

I fixed the bug by surrounding all strings in returned in escapeQueryValue with ". This way we only need to escape " and it eliminates the bugs we were seeing.

To test:
Check the following timeline links return results:

• http://localhost:5601/app/siem#/hosts/hosts?timelineId=f0d13910-ce80-11e9-9c4b-e130531cd89f&timerange=(global:(linkTo:!(),timerange:(from:1567451587597,fromStr:now-24h,kind:relative,to:1567537987597,toStr:now)),timeline:(linkTo:!(),timerange:(from:1566922636642,kind:absolute,to:1567009003400)))
• http://localhost:5601/app/siem#/hosts/events?timelineId='432c3ef0-ce66-11e9-80b7-df14a6ff3b4e'&timerange=(global:(linkTo:!(),timerange:(from:1567441462688,fromStr:now-24h,kind:relative,to:1567527862688,toStr:now)),timeline:(linkTo:!(),timerange:(from:1567008909275,kind:absolute,to:1567181717134)))

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• This was checked for cross-browser compatibility, including a check against IE11
• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for keyboard-only and screenreader accessibility

For maintainers

• This was checked for breaking API changes and was labeled appropriately
• This includes a feature addition or change that requires a release note and was labeled appropriately