kibana
kibana copied to clipboard
[UII] Allow free-form text in KQL searches (again)
Summary
Part of https://github.com/elastic/kibana/issues/171425.
This PR allows parsed KQL expressions that don't have a key/field. For example, the follow query expressions are now allowed when searching agents:
last_checkin_message.keyword : "Running" and Development
macbook
"8.15.0" and tags : "Development"
This PR also enables the flag enableStrictKQLValidation
now that both free-form text expressions are allowed and validation remains on expressions which specify a field.
Checklist
Delete any items that are not applicable to this PR.
- [x] Unit or functional tests were updated or added to match the most common scenarios