Elasticsearch: Fix modify query with backslashes (#79430)

* Elasticsearch: Fix modify query with backslashes

* add test devenv

devenv/docker/blocks/elastic/data/data.js

@@ -149,7 +149,8 @@ function getRandomLogItem(counter, timestamp) {
     hostname: chooseRandomElement(['hostname1', 'hostname2', 'hostname3', 'hostname4', 'hostname5', 'hostname6']),
     value: counter,
     metric: chooseRandomElement(['cpu', 'memory', 'latency']),
-    description: "this is description"
+    description: "this is description",
+    slash: "Access to the path '\\\\tkasnpo\\KASNPO\\Files\\contacts.xml' is denied."
   };
 }
 

public/app/plugins/datasource/elasticsearch/modifyQuery.test.ts

@@ -126,4 +126,13 @@ describe('addStringFilterToQuery', () => {
     expect(addStringFilterToQuery('label:"value"', '"filter"')).toBe('label:"value" AND "\\"filter\\""');
     expect(addStringFilterToQuery('label:"value"', '"filter"', false)).toBe('label:"value" NOT "\\"filter\\""');
   });
+
+  it('should escape filter values with backslashes', () => {
+    expect(addStringFilterToQuery('label:"value"', '"filter with \\"')).toBe(
+      'label:"value" AND "\\"filter with \\\\\\""'
+    );
+    expect(addStringFilterToQuery('label:"value"', '"filter with \\"', false)).toBe(
+      'label:"value" NOT "\\"filter with \\\\\\""'
+    );
+  });
 });

public/app/plugins/datasource/elasticsearch/modifyQuery.ts

@@ -63,8 +63,8 @@ export function addFilterToQuery(query: string, key: string, value: string, modi
     return query;
   }
 
-  key = lucene.term.escape(key);
-  value = lucene.phrase.escape(value);
+  key = escapeFilter(key);
+  value = escapeFilterValue(value);
   const filter = `${modifier}${key}:"${value}"`;
 
   return concatenate(query, filter);
@@ -187,6 +187,7 @@ export function escapeFilter(value: string) {
  * Use this function to escape filter values.
  */
 export function escapeFilterValue(value: string) {
+  value = value.replace(/\\/g, '\\\\');
   return lucene.phrase.escape(value);
 }