From db7fa30384a95ab258c9136883cdd038ad23c488 Mon Sep 17 00:00:00 2001
From: Sven Grossmann <sven.grossmann@grafana.com>
Date: Wed, 13 Dec 2023 14:07:46 +0100
Subject: [PATCH] Elasticsearch: Fix modify query with backslashes (#79430)

* Elasticsearch: Fix modify query with backslashes

* add test devenv
---
 devenv/docker/blocks/elastic/data/data.js                | 3 ++-
 .../plugins/datasource/elasticsearch/modifyQuery.test.ts | 9 +++++++++
 .../app/plugins/datasource/elasticsearch/modifyQuery.ts  | 5 +++--
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/devenv/docker/blocks/elastic/data/data.js b/devenv/docker/blocks/elastic/data/data.js
index 908cc4ee044..eb3b8c3d624 100644
--- a/devenv/docker/blocks/elastic/data/data.js
+++ b/devenv/docker/blocks/elastic/data/data.js
@@ -149,7 +149,8 @@ function getRandomLogItem(counter, timestamp) {
     hostname: chooseRandomElement(['hostname1', 'hostname2', 'hostname3', 'hostname4', 'hostname5', 'hostname6']),
     value: counter,
     metric: chooseRandomElement(['cpu', 'memory', 'latency']),
-    description: "this is description"
+    description: "this is description",
+    slash: "Access to the path '\\\\tkasnpo\\KASNPO\\Files\\contacts.xml' is denied."
   };
 }
 
diff --git a/public/app/plugins/datasource/elasticsearch/modifyQuery.test.ts b/public/app/plugins/datasource/elasticsearch/modifyQuery.test.ts
index a4c7898c58a..6138f620cbf 100644
--- a/public/app/plugins/datasource/elasticsearch/modifyQuery.test.ts
+++ b/public/app/plugins/datasource/elasticsearch/modifyQuery.test.ts
@@ -126,4 +126,13 @@ describe('addStringFilterToQuery', () => {
     expect(addStringFilterToQuery('label:"value"', '"filter"')).toBe('label:"value" AND "\\"filter\\""');
     expect(addStringFilterToQuery('label:"value"', '"filter"', false)).toBe('label:"value" NOT "\\"filter\\""');
   });
+
+  it('should escape filter values with backslashes', () => {
+    expect(addStringFilterToQuery('label:"value"', '"filter with \\"')).toBe(
+      'label:"value" AND "\\"filter with \\\\\\""'
+    );
+    expect(addStringFilterToQuery('label:"value"', '"filter with \\"', false)).toBe(
+      'label:"value" NOT "\\"filter with \\\\\\""'
+    );
+  });
 });
diff --git a/public/app/plugins/datasource/elasticsearch/modifyQuery.ts b/public/app/plugins/datasource/elasticsearch/modifyQuery.ts
index f565d2e5cbe..c9d98fcfb7a 100644
--- a/public/app/plugins/datasource/elasticsearch/modifyQuery.ts
+++ b/public/app/plugins/datasource/elasticsearch/modifyQuery.ts
@@ -63,8 +63,8 @@ export function addFilterToQuery(query: string, key: string, value: string, modi
     return query;
   }
 
-  key = lucene.term.escape(key);
-  value = lucene.phrase.escape(value);
+  key = escapeFilter(key);
+  value = escapeFilterValue(value);
   const filter = `${modifier}${key}:"${value}"`;
 
   return concatenate(query, filter);
@@ -187,6 +187,7 @@ export function escapeFilter(value: string) {
  * Use this function to escape filter values.
  */
 export function escapeFilterValue(value: string) {
+  value = value.replace(/\\/g, '\\\\');
   return lucene.phrase.escape(value);
 }