[KQL] Generate expression string from AST node

[darnautov]

Describe the feature:

The @kbn/es-query KQL utilities currently exports these methods:

• fromKueryExpression: Receives a KQL expression and returns the generated KQL AST.
• toElasticsearchQuery: Receives KQL AST and returns the generated Elasticsearch query.

There is no current utility for taking KQL AST and generating the KQL expression (toKueryExpression).

Describe a specific use case for the feature:

In the ML plugin, we allow users to link anomaly records with the other Kibana pages by configuring custom URLs. Most of those URLs contain a kuery string to populate a KQL bar with a query on the target page. At the moment we parse a URL template, replace tokens with values from the anomaly record and generate a result query using regular expressions. With all possible special characters and escaping rules, the current solution has potential issues. Adjusting KueryNode and receiving a result kuery expression seems like a more robust solution in this case.

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)

[qn895]

Revisiting this issue and the ML team thinks that we should escalate the impact level to something higher. As integration between different teams increases, having a one source of truth to build and generate the query expressions will provide better consistency, reduce brittle code (e.g. regex expressions 👀 ), and lead to less potential bugs.

[Dosant]

impact:low was an integration issue. It was our default until triaged properly :(

Revisiting this issue and the ML team thinks that we should escalate the impact level to something higher. As integration between different teams increases, having a one source of truth to build and generate the query expressions will provide better consistency, reduce brittle code (e.g. regex expressions 👀 ), and lead to less potential bugs.

Could you point me to that code as an example please?

[qn895]

Hi @Dosant, an example of is in Machine Learning's Anomaly detection/alerts where we allow users to add custom url templates to different parts of Kibana (like Discover, Dashboard, Metrics, APM, etc.) I also want to clarify that this chunk of code was written a long time ago, so perhaps there are already better mechanisms in place to help achieve this functionality.

The url template looks something like:

dashboards#/view/351de820-f2bb-11ea-ab06-cb93221707e9?_a=(filters:!(),query:(language:kuery,query:'at@name:"$at@name$" and singlequote!'name:"$singlequote!'name$"'))&_g=(filters:!(),time:(from:'$earliest$',mode:absolute,to:'$latest$'))

Which we then substitute the tokens like $singlequote!'name$ or $earliest$ to real-time values at the time of which the url is opened. As you can see it can get pretty complicated to unpack when the query is complex. This gets extra complicated for us especially because kuery and lucene have different escaping rules for different special characters.

So just one use case but I bet there are other solutions who might benefit from the ability to build expressions from the nodes.

[ppisljar]

cc @vadimkibana i think for bulding custom url templates to different parts of kibana url locators should be used

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[darnautov]

many thanks @lukasolson 🎉