Expose Elasticsearch case insensitivity in EQL/KQL

[rwaight]

Describe the feature: Add an option in Kibana to enable case_insensitive searches (added to Elasticsearch in 7.10, see elastic/elasticsearch#61546) for both KQL and EQL. This option would be available throughout Kibana, not only in Discover.

Describe a specific use case for the feature: In a security use case, we should enable security analysts to determine if their queries should be "case insensitive" or not, see elastic/ecs#1837 (comment) for additional information.

Also, I did not find any way to enable the case_insensitive option in Kibana except by using the "Edit as Query DSL" feature.

Other notes

I also looked at currently open issues in the Kibana repo. This request is not the same as the following:

• The add support for case-insensitive searches issue, as that issue is "requesting the implementation of an UPPER() function in KQL"
• The should wildcard queries default to case-insensitive search issue, as that issue is asking to enable case insensitive searches by default to wildcard queries.

[elasticmachine]

Pinging @elastic/kibana-app-services (Team:AppServicesSv)

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[lukasolson]

The work for KQL is tracked in a separate issue here: #55378

I'll re-label so this issue can relate to EQL only.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[rwaight]

@lukasolson this request is not specific to EQL. The request is for:

Add an option in Kibana to enable case_insensitive searches (added to Elasticsearch in 7.10, see elastic/elasticsearch#61546) for both KQL and EQL. This option would be available throughout Kibana, not only in Discover.

Regarding the KQL issue you referenced, is the scope of #55378 changing? The request states:

Requesting the implementation of an UPPER() function in KQL to be applied to fields, converting the record content to all uppercase.

[lukasolson]

@rwaight Yes, the scope is changing, I will update the linked issue. We just added support in the underlying package (kbn-es-query) for creating case-insensitive KQL queries, but this is currently not exposed. In the near future, we will expose this as either a parameter sent to the search bar, or an advanced setting (this still needs to be decided). Do you have a preference on how this parameter is exposed?

[legrego]

@lukasolson I see the kibana platform security team was tagged here -- how can we help with this?

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[lukasolson]

@legrego Sorry, wrong tag, thanks for pointing this out!