ESQL: whitespaces in quoted index expressions in FROM are parsed wrongly

[alex-spies]

Example:

FROM "index1, index2"

->

{"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index [ index2]"...

To avoid, one has to write

FROM "index1,index2"

which is unexpected as the whitespace is fine when not using quotes at all, i.e. FROM index1, index2.

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[alex-spies]

Note: a whitespace is not an allowed index name character, so it's not like FROM " index " should be different from FROM "index" (with stripped spaces). Not generally true, see below. Literal spaces are forbidden, but there are other kinds of white spaces, too.

(On index creation, using a literal space, i.e. %20, leads to Invalid index name [ idx], must not contain the following characters [' ','\"','*',',','/','<','>','?','\\','|'])

[alex-spies]

Seems like whitespace chars can generally be used in index names except for the literal space %20:

Horizontal tab = %09 = \t

curl -u elastic:password -H "Content-Type: application/json" "127.0.0.1:9200/test%09/_doc" -XPOST -d '{
  "field":"foo"
}'

curl -u elastic:password -X POST 'localhost:9200/_query?format=txt' -H 'Content-Type: application/json' '-d
{
  "query": "FROM \"test\t\""    
}
'

Using the horizontal tab literally raises Illegal unquoted character, but only because we need to escape it in the JSON.

[alex-spies]

When fixing this, we should also make sure to account for white spaces in the parts of patterns, e.g. FROM "remote : idx" and FROM """idx :: failures""".

[alex-spies]

I don't think this is a bug anymore - relabeling as enhancement.

The reason is that current behavior is consistent with _search, which will also allow spaces in the index pattern but then treat spaces as part of the pattern rather than separator, as in

POST es.url/idx1,%20idx2/_search