Open
Description
ES allows parentheses in index names, eg. foo) is a valid index name.
ES|QL allows parentheses in both quoted and unquoted index names, eg. both the following are valid and equivalent
FROM foo)
FROM "foo)"
ES|QL also uses parentheses to define subqueries.
The combination of parentheses inside index names and for subqueries can lead to inconsistencies:
FROM index | FORK ( ENRICH a_policy ) ( WHERE foo > 0 )
// works fine
FROM index | FORK ( ENRICH a_policy) ( WHERE foo > 0 )
// ^
// |
// no space between
// policy name and parenthesis
// Throws parsing_exception, as "a_policy)" is considered, as a whole, the policy name
FROM index | FORK ( ENRICH "a_policy") ( WHERE foo > 0 )
// works fine, thanks to quoting
The problem for now only happens in FORK (and EXPLAIN, that is snapshot only), but in the near future it will most likely impact other commands.
EXPLAIN (FROM index ) // works fine
EXPLAIN (FROM index) // parsing exception
To make things more consistent, we should disallow parentheses in unquoted index/policy names:
FROM index) // throw parsing exception
FROM "index)" // valid