EQL: Fix syntax for event type (#63169)

Event type is actually a string value for event.category which can
contain any kind of characters, or start with a digit, which currently
is not supported, so we introduce the possibility to be able to use the
usual syntax of " and """ for strings and raw strings.

Make the grammar a bit cleaner by using the identifier only where it's
actually an identifier in terms of query scemantics.

Fixes: #62933

x-pack/plugin/eql/src/main/antlr/EqlBase.g4

@@ -67,7 +67,7 @@ eventQuery
     ;
 
 eventFilter
-    : (ANY | event=identifier) WHERE expression
+    : (ANY | event=eventValue) WHERE expression
     ;
 
 expression
@@ -110,7 +110,11 @@ primaryExpression
     ;
 
 functionExpression
-    : name=IDENTIFIER LP (expression (COMMA expression)*)? RP
+    : name=functionName LP (expression (COMMA expression)*)? RP
+    ;
+
+functionName
+    : IDENTIFIER
     ;
 
 constant
@@ -134,7 +138,7 @@ qualifiedName
 
 identifier
     : IDENTIFIER
-    | ESCAPED_IDENTIFIER
+    | QUOTED_IDENTIFIER
     ;
 
 timeUnit
@@ -192,11 +196,6 @@ LP: '(';
 RP: ')';
 PIPE: '|';
 
-
-ESCAPED_IDENTIFIER
-    : '`' ( ~'`' | '``' )* '`'
-    ;
-
 STRING
     : '\''  ('\\' [btnfr"'\\] | ~[\r\n'\\])* '\''
     | '"'   ('\\' [btnfr"'\\] | ~[\r\n"\\])* '"'
@@ -221,6 +220,15 @@ IDENTIFIER
     : (LETTER | '_' | '@') (LETTER | DIGIT | '_')*
     ;
 
+QUOTED_IDENTIFIER
+    : '`' ( ~'`' | '``' )* '`'
+    ;
+
+eventValue
+    : STRING
+    | IDENTIFIER
+    ;
+
 fragment EXPONENT
     : [Ee] [+-]? DIGIT+
     ;

x-pack/plugin/eql/src/main/antlr/EqlBase.tokens

@@ -34,11 +34,11 @@ RB=33
 LP=34
 RP=35
 PIPE=36
-ESCAPED_IDENTIFIER=37
-STRING=38
-INTEGER_VALUE=39
-DECIMAL_VALUE=40
-IDENTIFIER=41
+STRING=37
+INTEGER_VALUE=38
+DECIMAL_VALUE=39
+IDENTIFIER=40
+QUOTED_IDENTIFIER=41
 LINE_COMMENT=42
 BRACKETED_COMMENT=43
 WS=44

x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens

@@ -34,11 +34,11 @@ RB=33
 LP=34
 RP=35
 PIPE=36
-ESCAPED_IDENTIFIER=37
-STRING=38
-INTEGER_VALUE=39
-DECIMAL_VALUE=40
-IDENTIFIER=41
+STRING=37
+INTEGER_VALUE=38
+DECIMAL_VALUE=39
+IDENTIFIER=40
+QUOTED_IDENTIFIER=41
 LINE_COMMENT=42
 BRACKETED_COMMENT=43
 WS=44

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseBaseListener.java

@@ -371,6 +371,18 @@ class EqlBaseBaseListener implements EqlBaseListener {
    * <p>The default implementation does nothing.</p>
    */
   @Override public void exitFunctionExpression(EqlBaseParser.FunctionExpressionContext ctx) { }
+  /**
+   * {@inheritDoc}
+   *
+   * <p>The default implementation does nothing.</p>
+   */
+  @Override public void enterFunctionName(EqlBaseParser.FunctionNameContext ctx) { }
+  /**
+   * {@inheritDoc}
+   *
+   * <p>The default implementation does nothing.</p>
+   */
+  @Override public void exitFunctionName(EqlBaseParser.FunctionNameContext ctx) { }
   /**
    * {@inheritDoc}
    *
@@ -515,6 +527,18 @@ class EqlBaseBaseListener implements EqlBaseListener {
    * <p>The default implementation does nothing.</p>
    */
   @Override public void exitString(EqlBaseParser.StringContext ctx) { }
+  /**
+   * {@inheritDoc}
+   *
+   * <p>The default implementation does nothing.</p>
+   */
+  @Override public void enterEventValue(EqlBaseParser.EventValueContext ctx) { }
+  /**
+   * {@inheritDoc}
+   *
+   * <p>The default implementation does nothing.</p>
+   */
+  @Override public void exitEventValue(EqlBaseParser.EventValueContext ctx) { }
 
   /**
    * {@inheritDoc}

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseBaseVisitor.java

@@ -221,6 +221,13 @@ class EqlBaseBaseVisitor<T> extends AbstractParseTreeVisitor<T> implements EqlBa
    * {@link #visitChildren} on {@code ctx}.</p>
    */
   @Override public T visitFunctionExpression(EqlBaseParser.FunctionExpressionContext ctx) { return visitChildren(ctx); }
+  /**
+   * {@inheritDoc}
+   *
+   * <p>The default implementation returns the result of calling
+   * {@link #visitChildren} on {@code ctx}.</p>
+   */
+  @Override public T visitFunctionName(EqlBaseParser.FunctionNameContext ctx) { return visitChildren(ctx); }
   /**
    * {@inheritDoc}
    *
@@ -305,4 +312,11 @@ class EqlBaseBaseVisitor<T> extends AbstractParseTreeVisitor<T> implements EqlBa
    * {@link #visitChildren} on {@code ctx}.</p>
    */
   @Override public T visitString(EqlBaseParser.StringContext ctx) { return visitChildren(ctx); }
+  /**
+   * {@inheritDoc}
+   *
+   * <p>The default implementation returns the result of calling
+   * {@link #visitChildren} on {@code ctx}.</p>
+   */
+  @Override public T visitEventValue(EqlBaseParser.EventValueContext ctx) { return visitChildren(ctx); }
 }

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseLexer.java

@@ -21,8 +21,8 @@ class EqlBaseLexer extends Lexer {
     OR=11, SEQUENCE=12, TRUE=13, UNTIL=14, WHERE=15, WITH=16, SEQ=17, ASGN=18, 
     EQ=19, NEQ=20, LT=21, LTE=22, GT=23, GTE=24, PLUS=25, MINUS=26, ASTERISK=27, 
     SLASH=28, PERCENT=29, DOT=30, COMMA=31, LB=32, RB=33, LP=34, RP=35, PIPE=36, 
-    ESCAPED_IDENTIFIER=37, STRING=38, INTEGER_VALUE=39, DECIMAL_VALUE=40, 
-    IDENTIFIER=41, LINE_COMMENT=42, BRACKETED_COMMENT=43, WS=44;
+    STRING=37, INTEGER_VALUE=38, DECIMAL_VALUE=39, IDENTIFIER=40, QUOTED_IDENTIFIER=41, 
+    LINE_COMMENT=42, BRACKETED_COMMENT=43, WS=44;
   public static String[] modeNames = {
     "DEFAULT_MODE"
   };
@@ -31,9 +31,9 @@ class EqlBaseLexer extends Lexer {
     "AND", "ANY", "BY", "FALSE", "IN", "JOIN", "MAXSPAN", "NOT", "NULL", "OF", 
     "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", "EQ", 
     "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", 
-    "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "ESCAPED_IDENTIFIER", 
-    "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", "EXPONENT", 
-    "DIGIT", "LETTER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
+    "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", 
+    "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", "EXPONENT", "DIGIT", 
+    "LETTER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
   };
 
   private static final String[] _LITERAL_NAMES = {
@@ -47,9 +47,9 @@ class EqlBaseLexer extends Lexer {
     null, "AND", "ANY", "BY", "FALSE", "IN", "JOIN", "MAXSPAN", "NOT", "NULL", 
     "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", 
     "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", 
-    "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "ESCAPED_IDENTIFIER", 
-    "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", "LINE_COMMENT", 
-    "BRACKETED_COMMENT", "WS"
+    "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", 
+    "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", "LINE_COMMENT", "BRACKETED_COMMENT", 
+    "WS"
   };
   public static final Vocabulary VOCABULARY = new VocabularyImpl(_LITERAL_NAMES, _SYMBOLIC_NAMES);
 
@@ -120,123 +120,122 @@ class EqlBaseLexer extends Lexer {
     "\21\3\21\3\21\3\21\3\21\3\22\3\22\3\23\3\23\3\24\3\24\3\24\3\25\3\25\3"+
     "\25\3\26\3\26\3\27\3\27\3\27\3\30\3\30\3\31\3\31\3\31\3\32\3\32\3\33\3"+
     "\33\3\34\3\34\3\35\3\35\3\36\3\36\3\37\3\37\3 \3 \3!\3!\3\"\3\"\3#\3#"+
-    "\3$\3$\3%\3%\3&\3&\3&\3&\7&\u00e1\n&\f&\16&\u00e4\13&\3&\3&\3\'\3\'\3"+
-    "\'\3\'\7\'\u00ec\n\'\f\'\16\'\u00ef\13\'\3\'\3\'\3\'\3\'\3\'\7\'\u00f6"+
-    "\n\'\f\'\16\'\u00f9\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u0102\n\'\f\'"+
-    "\16\'\u0105\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u010e\n\'\f\'\16\'\u0111"+
-    "\13\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u0119\n\'\f\'\16\'\u011c\13\'\3\'\3"+
-    "\'\3\'\3\'\3\'\5\'\u0123\n\'\3\'\5\'\u0126\n\'\5\'\u0128\n\'\3(\6(\u012b"+
-    "\n(\r(\16(\u012c\3)\6)\u0130\n)\r)\16)\u0131\3)\3)\7)\u0136\n)\f)\16)"+
-    "\u0139\13)\3)\3)\6)\u013d\n)\r)\16)\u013e\3)\6)\u0142\n)\r)\16)\u0143"+
-    "\3)\3)\7)\u0148\n)\f)\16)\u014b\13)\5)\u014d\n)\3)\3)\3)\3)\6)\u0153\n"+
-    ")\r)\16)\u0154\3)\3)\5)\u0159\n)\3*\3*\5*\u015d\n*\3*\3*\3*\7*\u0162\n"+
-    "*\f*\16*\u0165\13*\3+\3+\5+\u0169\n+\3+\6+\u016c\n+\r+\16+\u016d\3,\3"+
-    ",\3-\3-\3.\3.\3.\3.\7.\u0178\n.\f.\16.\u017b\13.\3.\5.\u017e\n.\3.\5."+
-    "\u0181\n.\3.\3.\3/\3/\3/\3/\3/\7/\u018a\n/\f/\16/\u018d\13/\3/\3/\3/\3"+
-    "/\3/\3\60\6\60\u0195\n\60\r\60\16\60\u0196\3\60\3\60\4\u011a\u018b\2\61"+
-    "\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f\27\r\31\16\33\17\35\20"+
-    "\37\21!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63\33\65\34\67\359\36;\37"+
-    "= ?!A\"C#E$G%I&K\'M(O)Q*S+U\2W\2Y\2[,]-_.\3\2\17\3\2bb\n\2$$))^^ddhhp"+
-    "pttvv\6\2\f\f\17\17))^^\6\2\f\f\17\17$$^^\5\2\f\f\17\17$$\5\2\f\f\17\17"+
-    "))\4\2\f\f\17\17\4\2BBaa\4\2GGgg\4\2--//\3\2\62;\4\2C\\c|\5\2\13\f\17"+
-    "\17\"\"\u01be\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3\2\2\2\2\t\3\2\2\2\2\13\3\2"+
-    "\2\2\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3\2\2\2\2\23\3\2\2\2\2\25\3\2\2\2\2"+
-    "\27\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2\2\2\35\3\2\2\2\2\37\3\2\2\2\2!\3\2"+
-    "\2\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2\2\2\2)\3\2\2\2\2+\3\2\2\2\2-\3\2\2"+
-    "\2\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2\2\2\2\65\3\2\2\2\2\67\3\2\2\2\29\3"+
-    "\2\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2\2\2\2A\3\2\2\2\2C\3\2\2\2\2E\3\2\2"+
-    "\2\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2\2M\3\2\2\2\2O\3\2\2\2\2Q\3\2\2\2\2"+
-    "S\3\2\2\2\2[\3\2\2\2\2]\3\2\2\2\2_\3\2\2\2\3a\3\2\2\2\5e\3\2\2\2\7i\3"+
-    "\2\2\2\tl\3\2\2\2\13r\3\2\2\2\ru\3\2\2\2\17z\3\2\2\2\21\u0082\3\2\2\2"+
-    "\23\u0086\3\2\2\2\25\u008b\3\2\2\2\27\u008e\3\2\2\2\31\u0091\3\2\2\2\33"+
-    "\u009a\3\2\2\2\35\u009f\3\2\2\2\37\u00a5\3\2\2\2!\u00ab\3\2\2\2#\u00b0"+
-    "\3\2\2\2%\u00b2\3\2\2\2\'\u00b4\3\2\2\2)\u00b7\3\2\2\2+\u00ba\3\2\2\2"+
-    "-\u00bc\3\2\2\2/\u00bf\3\2\2\2\61\u00c1\3\2\2\2\63\u00c4\3\2\2\2\65\u00c6"+
-    "\3\2\2\2\67\u00c8\3\2\2\29\u00ca\3\2\2\2;\u00cc\3\2\2\2=\u00ce\3\2\2\2"+
-    "?\u00d0\3\2\2\2A\u00d2\3\2\2\2C\u00d4\3\2\2\2E\u00d6\3\2\2\2G\u00d8\3"+
-    "\2\2\2I\u00da\3\2\2\2K\u00dc\3\2\2\2M\u0127\3\2\2\2O\u012a\3\2\2\2Q\u0158"+
-    "\3\2\2\2S\u015c\3\2\2\2U\u0166\3\2\2\2W\u016f\3\2\2\2Y\u0171\3\2\2\2["+
-    "\u0173\3\2\2\2]\u0184\3\2\2\2_\u0194\3\2\2\2ab\7c\2\2bc\7p\2\2cd\7f\2"+
-    "\2d\4\3\2\2\2ef\7c\2\2fg\7p\2\2gh\7{\2\2h\6\3\2\2\2ij\7d\2\2jk\7{\2\2"+
-    "k\b\3\2\2\2lm\7h\2\2mn\7c\2\2no\7n\2\2op\7u\2\2pq\7g\2\2q\n\3\2\2\2rs"+
-    "\7k\2\2st\7p\2\2t\f\3\2\2\2uv\7l\2\2vw\7q\2\2wx\7k\2\2xy\7p\2\2y\16\3"+
-    "\2\2\2z{\7o\2\2{|\7c\2\2|}\7z\2\2}~\7u\2\2~\177\7r\2\2\177\u0080\7c\2"+
-    "\2\u0080\u0081\7p\2\2\u0081\20\3\2\2\2\u0082\u0083\7p\2\2\u0083\u0084"+
-    "\7q\2\2\u0084\u0085\7v\2\2\u0085\22\3\2\2\2\u0086\u0087\7p\2\2\u0087\u0088"+
-    "\7w\2\2\u0088\u0089\7n\2\2\u0089\u008a\7n\2\2\u008a\24\3\2\2\2\u008b\u008c"+
-    "\7q\2\2\u008c\u008d\7h\2\2\u008d\26\3\2\2\2\u008e\u008f\7q\2\2\u008f\u0090"+
-    "\7t\2\2\u0090\30\3\2\2\2\u0091\u0092\7u\2\2\u0092\u0093\7g\2\2\u0093\u0094"+
-    "\7s\2\2\u0094\u0095\7w\2\2\u0095\u0096\7g\2\2\u0096\u0097\7p\2\2\u0097"+
-    "\u0098\7e\2\2\u0098\u0099\7g\2\2\u0099\32\3\2\2\2\u009a\u009b\7v\2\2\u009b"+
-    "\u009c\7t\2\2\u009c\u009d\7w\2\2\u009d\u009e\7g\2\2\u009e\34\3\2\2\2\u009f"+
-    "\u00a0\7w\2\2\u00a0\u00a1\7p\2\2\u00a1\u00a2\7v\2\2\u00a2\u00a3\7k\2\2"+
-    "\u00a3\u00a4\7n\2\2\u00a4\36\3\2\2\2\u00a5\u00a6\7y\2\2\u00a6\u00a7\7"+
-    "j\2\2\u00a7\u00a8\7g\2\2\u00a8\u00a9\7t\2\2\u00a9\u00aa\7g\2\2\u00aa "+
-    "\3\2\2\2\u00ab\u00ac\7y\2\2\u00ac\u00ad\7k\2\2\u00ad\u00ae\7v\2\2\u00ae"+
-    "\u00af\7j\2\2\u00af\"\3\2\2\2\u00b0\u00b1\7<\2\2\u00b1$\3\2\2\2\u00b2"+
-    "\u00b3\7?\2\2\u00b3&\3\2\2\2\u00b4\u00b5\7?\2\2\u00b5\u00b6\7?\2\2\u00b6"+
-    "(\3\2\2\2\u00b7\u00b8\7#\2\2\u00b8\u00b9\7?\2\2\u00b9*\3\2\2\2\u00ba\u00bb"+
-    "\7>\2\2\u00bb,\3\2\2\2\u00bc\u00bd\7>\2\2\u00bd\u00be\7?\2\2\u00be.\3"+
-    "\2\2\2\u00bf\u00c0\7@\2\2\u00c0\60\3\2\2\2\u00c1\u00c2\7@\2\2\u00c2\u00c3"+
-    "\7?\2\2\u00c3\62\3\2\2\2\u00c4\u00c5\7-\2\2\u00c5\64\3\2\2\2\u00c6\u00c7"+
-    "\7/\2\2\u00c7\66\3\2\2\2\u00c8\u00c9\7,\2\2\u00c98\3\2\2\2\u00ca\u00cb"+
-    "\7\61\2\2\u00cb:\3\2\2\2\u00cc\u00cd\7\'\2\2\u00cd<\3\2\2\2\u00ce\u00cf"+
-    "\7\60\2\2\u00cf>\3\2\2\2\u00d0\u00d1\7.\2\2\u00d1@\3\2\2\2\u00d2\u00d3"+
-    "\7]\2\2\u00d3B\3\2\2\2\u00d4\u00d5\7_\2\2\u00d5D\3\2\2\2\u00d6\u00d7\7"+
-    "*\2\2\u00d7F\3\2\2\2\u00d8\u00d9\7+\2\2\u00d9H\3\2\2\2\u00da\u00db\7~"+
-    "\2\2\u00dbJ\3\2\2\2\u00dc\u00e2\7b\2\2\u00dd\u00e1\n\2\2\2\u00de\u00df"+
-    "\7b\2\2\u00df\u00e1\7b\2\2\u00e0\u00dd\3\2\2\2\u00e0\u00de\3\2\2\2\u00e1"+
-    "\u00e4\3\2\2\2\u00e2\u00e0\3\2\2\2\u00e2\u00e3\3\2\2\2\u00e3\u00e5\3\2"+
-    "\2\2\u00e4\u00e2\3\2\2\2\u00e5\u00e6\7b\2\2\u00e6L\3\2\2\2\u00e7\u00ed"+
-    "\7)\2\2\u00e8\u00e9\7^\2\2\u00e9\u00ec\t\3\2\2\u00ea\u00ec\n\4\2\2\u00eb"+
-    "\u00e8\3\2\2\2\u00eb\u00ea\3\2\2\2\u00ec\u00ef\3\2\2\2\u00ed\u00eb\3\2"+
-    "\2\2\u00ed\u00ee\3\2\2\2\u00ee\u00f0\3\2\2\2\u00ef\u00ed\3\2\2\2\u00f0"+
-    "\u0128\7)\2\2\u00f1\u00f7\7$\2\2\u00f2\u00f3\7^\2\2\u00f3\u00f6\t\3\2"+
-    "\2\u00f4\u00f6\n\5\2\2\u00f5\u00f2\3\2\2\2\u00f5\u00f4\3\2\2\2\u00f6\u00f9"+
-    "\3\2\2\2\u00f7\u00f5\3\2\2\2\u00f7\u00f8\3\2\2\2\u00f8\u00fa\3\2\2\2\u00f9"+
-    "\u00f7\3\2\2\2\u00fa\u0128\7$\2\2\u00fb\u00fc\7A\2\2\u00fc\u00fd\7$\2"+
-    "\2\u00fd\u0103\3\2\2\2\u00fe\u00ff\7^\2\2\u00ff\u0102\7$\2\2\u0100\u0102"+
-    "\n\6\2\2\u0101\u00fe\3\2\2\2\u0101\u0100\3\2\2\2\u0102\u0105\3\2\2\2\u0103"+
-    "\u0101\3\2\2\2\u0103\u0104\3\2\2\2\u0104\u0106\3\2\2\2\u0105\u0103\3\2"+
-    "\2\2\u0106\u0128\7$\2\2\u0107\u0108\7A\2\2\u0108\u0109\7)\2\2\u0109\u010f"+
-    "\3\2\2\2\u010a\u010b\7^\2\2\u010b\u010e\7)\2\2\u010c\u010e\n\7\2\2\u010d"+
-    "\u010a\3\2\2\2\u010d\u010c\3\2\2\2\u010e\u0111\3\2\2\2\u010f\u010d\3\2"+
-    "\2\2\u010f\u0110\3\2\2\2\u0110\u0112\3\2\2\2\u0111\u010f\3\2\2\2\u0112"+
-    "\u0128\7)\2\2\u0113\u0114\7$\2\2\u0114\u0115\7$\2\2\u0115\u0116\7$\2\2"+
-    "\u0116\u011a\3\2\2\2\u0117\u0119\n\b\2\2\u0118\u0117\3\2\2\2\u0119\u011c"+
-    "\3\2\2\2\u011a\u011b\3\2\2\2\u011a\u0118\3\2\2\2\u011b\u011d\3\2\2\2\u011c"+
-    "\u011a\3\2\2\2\u011d\u011e\7$\2\2\u011e\u011f\7$\2\2\u011f\u0120\7$\2"+
-    "\2\u0120\u0122\3\2\2\2\u0121\u0123\7$\2\2\u0122\u0121\3\2\2\2\u0122\u0123"+
-    "\3\2\2\2\u0123\u0125\3\2\2\2\u0124\u0126\7$\2\2\u0125\u0124\3\2\2\2\u0125"+
-    "\u0126\3\2\2\2\u0126\u0128\3\2\2\2\u0127\u00e7\3\2\2\2\u0127\u00f1\3\2"+
-    "\2\2\u0127\u00fb\3\2\2\2\u0127\u0107\3\2\2\2\u0127\u0113\3\2\2\2\u0128"+
-    "N\3\2\2\2\u0129\u012b\5W,\2\u012a\u0129\3\2\2\2\u012b\u012c\3\2\2\2\u012c"+
-    "\u012a\3\2\2\2\u012c\u012d\3\2\2\2\u012dP\3\2\2\2\u012e\u0130\5W,\2\u012f"+
-    "\u012e\3\2\2\2\u0130\u0131\3\2\2\2\u0131\u012f\3\2\2\2\u0131\u0132\3\2"+
-    "\2\2\u0132\u0133\3\2\2\2\u0133\u0137\5=\37\2\u0134\u0136\5W,\2\u0135\u0134"+
-    "\3\2\2\2\u0136\u0139\3\2\2\2\u0137\u0135\3\2\2\2\u0137\u0138\3\2\2\2\u0138"+
-    "\u0159\3\2\2\2\u0139\u0137\3\2\2\2\u013a\u013c\5=\37\2\u013b\u013d\5W"+
-    ",\2\u013c\u013b\3\2\2\2\u013d\u013e\3\2\2\2\u013e\u013c\3\2\2\2\u013e"+
-    "\u013f\3\2\2\2\u013f\u0159\3\2\2\2\u0140\u0142\5W,\2\u0141\u0140\3\2\2"+
-    "\2\u0142\u0143\3\2\2\2\u0143\u0141\3\2\2\2\u0143\u0144\3\2\2\2\u0144\u014c"+
-    "\3\2\2\2\u0145\u0149\5=\37\2\u0146\u0148\5W,\2\u0147\u0146\3\2\2\2\u0148"+
-    "\u014b\3\2\2\2\u0149\u0147\3\2\2\2\u0149\u014a\3\2\2\2\u014a\u014d\3\2"+
-    "\2\2\u014b\u0149\3\2\2\2\u014c\u0145\3\2\2\2\u014c\u014d\3\2\2\2\u014d"+
-    "\u014e\3\2\2\2\u014e\u014f\5U+\2\u014f\u0159\3\2\2\2\u0150\u0152\5=\37"+
-    "\2\u0151\u0153\5W,\2\u0152\u0151\3\2\2\2\u0153\u0154\3\2\2\2\u0154\u0152"+
-    "\3\2\2\2\u0154\u0155\3\2\2\2\u0155\u0156\3\2\2\2\u0156\u0157\5U+\2\u0157"+
-    "\u0159\3\2\2\2\u0158\u012f\3\2\2\2\u0158\u013a\3\2\2\2\u0158\u0141\3\2"+
-    "\2\2\u0158\u0150\3\2\2\2\u0159R\3\2\2\2\u015a\u015d\5Y-\2\u015b\u015d"+
-    "\t\t\2\2\u015c\u015a\3\2\2\2\u015c\u015b\3\2\2\2\u015d\u0163\3\2\2\2\u015e"+
-    "\u0162\5Y-\2\u015f\u0162\5W,\2\u0160\u0162\7a\2\2\u0161\u015e\3\2\2\2"+
-    "\u0161\u015f\3\2\2\2\u0161\u0160\3\2\2\2\u0162\u0165\3\2\2\2\u0163\u0161"+
-    "\3\2\2\2\u0163\u0164\3\2\2\2\u0164T\3\2\2\2\u0165\u0163\3\2\2\2\u0166"+
-    "\u0168\t\n\2\2\u0167\u0169\t\13\2\2\u0168\u0167\3\2\2\2\u0168\u0169\3"+
-    "\2\2\2\u0169\u016b\3\2\2\2\u016a\u016c\5W,\2\u016b\u016a\3\2\2\2\u016c"+
-    "\u016d\3\2\2\2\u016d\u016b\3\2\2\2\u016d\u016e\3\2\2\2\u016eV\3\2\2\2"+
-    "\u016f\u0170\t\f\2\2\u0170X\3\2\2\2\u0171\u0172\t\r\2\2\u0172Z\3\2\2\2"+
-    "\u0173\u0174\7\61\2\2\u0174\u0175\7\61\2\2\u0175\u0179\3\2\2\2\u0176\u0178"+
-    "\n\b\2\2\u0177\u0176\3\2\2\2\u0178\u017b\3\2\2\2\u0179\u0177\3\2\2\2\u0179"+
+    "\3$\3$\3%\3%\3&\3&\3&\3&\7&\u00e1\n&\f&\16&\u00e4\13&\3&\3&\3&\3&\3&\7"+
+    "&\u00eb\n&\f&\16&\u00ee\13&\3&\3&\3&\3&\3&\3&\3&\7&\u00f7\n&\f&\16&\u00fa"+
+    "\13&\3&\3&\3&\3&\3&\3&\3&\7&\u0103\n&\f&\16&\u0106\13&\3&\3&\3&\3&\3&"+
+    "\3&\7&\u010e\n&\f&\16&\u0111\13&\3&\3&\3&\3&\3&\5&\u0118\n&\3&\5&\u011b"+
+    "\n&\5&\u011d\n&\3\'\6\'\u0120\n\'\r\'\16\'\u0121\3(\6(\u0125\n(\r(\16"+
+    "(\u0126\3(\3(\7(\u012b\n(\f(\16(\u012e\13(\3(\3(\6(\u0132\n(\r(\16(\u0133"+
+    "\3(\6(\u0137\n(\r(\16(\u0138\3(\3(\7(\u013d\n(\f(\16(\u0140\13(\5(\u0142"+
+    "\n(\3(\3(\3(\3(\6(\u0148\n(\r(\16(\u0149\3(\3(\5(\u014e\n(\3)\3)\5)\u0152"+
+    "\n)\3)\3)\3)\7)\u0157\n)\f)\16)\u015a\13)\3*\3*\3*\3*\7*\u0160\n*\f*\16"+
+    "*\u0163\13*\3*\3*\3+\3+\5+\u0169\n+\3+\6+\u016c\n+\r+\16+\u016d\3,\3,"+
+    "\3-\3-\3.\3.\3.\3.\7.\u0178\n.\f.\16.\u017b\13.\3.\5.\u017e\n.\3.\5.\u0181"+
+    "\n.\3.\3.\3/\3/\3/\3/\3/\7/\u018a\n/\f/\16/\u018d\13/\3/\3/\3/\3/\3/\3"+
+    "\60\6\60\u0195\n\60\r\60\16\60\u0196\3\60\3\60\4\u010f\u018b\2\61\3\3"+
+    "\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f\27\r\31\16\33\17\35\20\37\21"+
+    "!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63\33\65\34\67\359\36;\37= ?!"+
+    "A\"C#E$G%I&K\'M(O)Q*S+U\2W\2Y\2[,]-_.\3\2\17\n\2$$))^^ddhhppttvv\6\2\f"+
+    "\f\17\17))^^\6\2\f\f\17\17$$^^\5\2\f\f\17\17$$\5\2\f\f\17\17))\4\2\f\f"+
+    "\17\17\4\2BBaa\3\2bb\4\2GGgg\4\2--//\3\2\62;\4\2C\\c|\5\2\13\f\17\17\""+
+    "\"\u01be\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3\2\2\2\2\t\3\2\2\2\2\13\3\2\2\2"+
+    "\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3\2\2\2\2\23\3\2\2\2\2\25\3\2\2\2\2\27"+
+    "\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2\2\2\35\3\2\2\2\2\37\3\2\2\2\2!\3\2\2"+
+    "\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2\2\2\2)\3\2\2\2\2+\3\2\2\2\2-\3\2\2\2"+
+    "\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2\2\2\2\65\3\2\2\2\2\67\3\2\2\2\29\3\2"+
+    "\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2\2\2\2A\3\2\2\2\2C\3\2\2\2\2E\3\2\2\2"+
+    "\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2\2M\3\2\2\2\2O\3\2\2\2\2Q\3\2\2\2\2S"+
+    "\3\2\2\2\2[\3\2\2\2\2]\3\2\2\2\2_\3\2\2\2\3a\3\2\2\2\5e\3\2\2\2\7i\3\2"+
+    "\2\2\tl\3\2\2\2\13r\3\2\2\2\ru\3\2\2\2\17z\3\2\2\2\21\u0082\3\2\2\2\23"+
+    "\u0086\3\2\2\2\25\u008b\3\2\2\2\27\u008e\3\2\2\2\31\u0091\3\2\2\2\33\u009a"+
+    "\3\2\2\2\35\u009f\3\2\2\2\37\u00a5\3\2\2\2!\u00ab\3\2\2\2#\u00b0\3\2\2"+
+    "\2%\u00b2\3\2\2\2\'\u00b4\3\2\2\2)\u00b7\3\2\2\2+\u00ba\3\2\2\2-\u00bc"+
+    "\3\2\2\2/\u00bf\3\2\2\2\61\u00c1\3\2\2\2\63\u00c4\3\2\2\2\65\u00c6\3\2"+
+    "\2\2\67\u00c8\3\2\2\29\u00ca\3\2\2\2;\u00cc\3\2\2\2=\u00ce\3\2\2\2?\u00d0"+
+    "\3\2\2\2A\u00d2\3\2\2\2C\u00d4\3\2\2\2E\u00d6\3\2\2\2G\u00d8\3\2\2\2I"+
+    "\u00da\3\2\2\2K\u011c\3\2\2\2M\u011f\3\2\2\2O\u014d\3\2\2\2Q\u0151\3\2"+
+    "\2\2S\u015b\3\2\2\2U\u0166\3\2\2\2W\u016f\3\2\2\2Y\u0171\3\2\2\2[\u0173"+
+    "\3\2\2\2]\u0184\3\2\2\2_\u0194\3\2\2\2ab\7c\2\2bc\7p\2\2cd\7f\2\2d\4\3"+
+    "\2\2\2ef\7c\2\2fg\7p\2\2gh\7{\2\2h\6\3\2\2\2ij\7d\2\2jk\7{\2\2k\b\3\2"+
+    "\2\2lm\7h\2\2mn\7c\2\2no\7n\2\2op\7u\2\2pq\7g\2\2q\n\3\2\2\2rs\7k\2\2"+
+    "st\7p\2\2t\f\3\2\2\2uv\7l\2\2vw\7q\2\2wx\7k\2\2xy\7p\2\2y\16\3\2\2\2z"+
+    "{\7o\2\2{|\7c\2\2|}\7z\2\2}~\7u\2\2~\177\7r\2\2\177\u0080\7c\2\2\u0080"+
+    "\u0081\7p\2\2\u0081\20\3\2\2\2\u0082\u0083\7p\2\2\u0083\u0084\7q\2\2\u0084"+
+    "\u0085\7v\2\2\u0085\22\3\2\2\2\u0086\u0087\7p\2\2\u0087\u0088\7w\2\2\u0088"+
+    "\u0089\7n\2\2\u0089\u008a\7n\2\2\u008a\24\3\2\2\2\u008b\u008c\7q\2\2\u008c"+
+    "\u008d\7h\2\2\u008d\26\3\2\2\2\u008e\u008f\7q\2\2\u008f\u0090\7t\2\2\u0090"+
+    "\30\3\2\2\2\u0091\u0092\7u\2\2\u0092\u0093\7g\2\2\u0093\u0094\7s\2\2\u0094"+
+    "\u0095\7w\2\2\u0095\u0096\7g\2\2\u0096\u0097\7p\2\2\u0097\u0098\7e\2\2"+
+    "\u0098\u0099\7g\2\2\u0099\32\3\2\2\2\u009a\u009b\7v\2\2\u009b\u009c\7"+
+    "t\2\2\u009c\u009d\7w\2\2\u009d\u009e\7g\2\2\u009e\34\3\2\2\2\u009f\u00a0"+
+    "\7w\2\2\u00a0\u00a1\7p\2\2\u00a1\u00a2\7v\2\2\u00a2\u00a3\7k\2\2\u00a3"+
+    "\u00a4\7n\2\2\u00a4\36\3\2\2\2\u00a5\u00a6\7y\2\2\u00a6\u00a7\7j\2\2\u00a7"+
+    "\u00a8\7g\2\2\u00a8\u00a9\7t\2\2\u00a9\u00aa\7g\2\2\u00aa \3\2\2\2\u00ab"+
+    "\u00ac\7y\2\2\u00ac\u00ad\7k\2\2\u00ad\u00ae\7v\2\2\u00ae\u00af\7j\2\2"+
+    "\u00af\"\3\2\2\2\u00b0\u00b1\7<\2\2\u00b1$\3\2\2\2\u00b2\u00b3\7?\2\2"+
+    "\u00b3&\3\2\2\2\u00b4\u00b5\7?\2\2\u00b5\u00b6\7?\2\2\u00b6(\3\2\2\2\u00b7"+
+    "\u00b8\7#\2\2\u00b8\u00b9\7?\2\2\u00b9*\3\2\2\2\u00ba\u00bb\7>\2\2\u00bb"+
+    ",\3\2\2\2\u00bc\u00bd\7>\2\2\u00bd\u00be\7?\2\2\u00be.\3\2\2\2\u00bf\u00c0"+
+    "\7@\2\2\u00c0\60\3\2\2\2\u00c1\u00c2\7@\2\2\u00c2\u00c3\7?\2\2\u00c3\62"+
+    "\3\2\2\2\u00c4\u00c5\7-\2\2\u00c5\64\3\2\2\2\u00c6\u00c7\7/\2\2\u00c7"+
+    "\66\3\2\2\2\u00c8\u00c9\7,\2\2\u00c98\3\2\2\2\u00ca\u00cb\7\61\2\2\u00cb"+
+    ":\3\2\2\2\u00cc\u00cd\7\'\2\2\u00cd<\3\2\2\2\u00ce\u00cf\7\60\2\2\u00cf"+
+    ">\3\2\2\2\u00d0\u00d1\7.\2\2\u00d1@\3\2\2\2\u00d2\u00d3\7]\2\2\u00d3B"+
+    "\3\2\2\2\u00d4\u00d5\7_\2\2\u00d5D\3\2\2\2\u00d6\u00d7\7*\2\2\u00d7F\3"+
+    "\2\2\2\u00d8\u00d9\7+\2\2\u00d9H\3\2\2\2\u00da\u00db\7~\2\2\u00dbJ\3\2"+
+    "\2\2\u00dc\u00e2\7)\2\2\u00dd\u00de\7^\2\2\u00de\u00e1\t\2\2\2\u00df\u00e1"+
+    "\n\3\2\2\u00e0\u00dd\3\2\2\2\u00e0\u00df\3\2\2\2\u00e1\u00e4\3\2\2\2\u00e2"+
+    "\u00e0\3\2\2\2\u00e2\u00e3\3\2\2\2\u00e3\u00e5\3\2\2\2\u00e4\u00e2\3\2"+
+    "\2\2\u00e5\u011d\7)\2\2\u00e6\u00ec\7$\2\2\u00e7\u00e8\7^\2\2\u00e8\u00eb"+
+    "\t\2\2\2\u00e9\u00eb\n\4\2\2\u00ea\u00e7\3\2\2\2\u00ea\u00e9\3\2\2\2\u00eb"+
+    "\u00ee\3\2\2\2\u00ec\u00ea\3\2\2\2\u00ec\u00ed\3\2\2\2\u00ed\u00ef\3\2"+
+    "\2\2\u00ee\u00ec\3\2\2\2\u00ef\u011d\7$\2\2\u00f0\u00f1\7A\2\2\u00f1\u00f2"+
+    "\7$\2\2\u00f2\u00f8\3\2\2\2\u00f3\u00f4\7^\2\2\u00f4\u00f7\7$\2\2\u00f5"+
+    "\u00f7\n\5\2\2\u00f6\u00f3\3\2\2\2\u00f6\u00f5\3\2\2\2\u00f7\u00fa\3\2"+
+    "\2\2\u00f8\u00f6\3\2\2\2\u00f8\u00f9\3\2\2\2\u00f9\u00fb\3\2\2\2\u00fa"+
+    "\u00f8\3\2\2\2\u00fb\u011d\7$\2\2\u00fc\u00fd\7A\2\2\u00fd\u00fe\7)\2"+
+    "\2\u00fe\u0104\3\2\2\2\u00ff\u0100\7^\2\2\u0100\u0103\7)\2\2\u0101\u0103"+
+    "\n\6\2\2\u0102\u00ff\3\2\2\2\u0102\u0101\3\2\2\2\u0103\u0106\3\2\2\2\u0104"+
+    "\u0102\3\2\2\2\u0104\u0105\3\2\2\2\u0105\u0107\3\2\2\2\u0106\u0104\3\2"+
+    "\2\2\u0107\u011d\7)\2\2\u0108\u0109\7$\2\2\u0109\u010a\7$\2\2\u010a\u010b"+
+    "\7$\2\2\u010b\u010f\3\2\2\2\u010c\u010e\n\7\2\2\u010d\u010c\3\2\2\2\u010e"+
+    "\u0111\3\2\2\2\u010f\u0110\3\2\2\2\u010f\u010d\3\2\2\2\u0110\u0112\3\2"+
+    "\2\2\u0111\u010f\3\2\2\2\u0112\u0113\7$\2\2\u0113\u0114\7$\2\2\u0114\u0115"+
+    "\7$\2\2\u0115\u0117\3\2\2\2\u0116\u0118\7$\2\2\u0117\u0116\3\2\2\2\u0117"+
+    "\u0118\3\2\2\2\u0118\u011a\3\2\2\2\u0119\u011b\7$\2\2\u011a\u0119\3\2"+
+    "\2\2\u011a\u011b\3\2\2\2\u011b\u011d\3\2\2\2\u011c\u00dc\3\2\2\2\u011c"+
+    "\u00e6\3\2\2\2\u011c\u00f0\3\2\2\2\u011c\u00fc\3\2\2\2\u011c\u0108\3\2"+
+    "\2\2\u011dL\3\2\2\2\u011e\u0120\5W,\2\u011f\u011e\3\2\2\2\u0120\u0121"+
+    "\3\2\2\2\u0121\u011f\3\2\2\2\u0121\u0122\3\2\2\2\u0122N\3\2\2\2\u0123"+
+    "\u0125\5W,\2\u0124\u0123\3\2\2\2\u0125\u0126\3\2\2\2\u0126\u0124\3\2\2"+
+    "\2\u0126\u0127\3\2\2\2\u0127\u0128\3\2\2\2\u0128\u012c\5=\37\2\u0129\u012b"+
+    "\5W,\2\u012a\u0129\3\2\2\2\u012b\u012e\3\2\2\2\u012c\u012a\3\2\2\2\u012c"+
+    "\u012d\3\2\2\2\u012d\u014e\3\2\2\2\u012e\u012c\3\2\2\2\u012f\u0131\5="+
+    "\37\2\u0130\u0132\5W,\2\u0131\u0130\3\2\2\2\u0132\u0133\3\2\2\2\u0133"+
+    "\u0131\3\2\2\2\u0133\u0134\3\2\2\2\u0134\u014e\3\2\2\2\u0135\u0137\5W"+
+    ",\2\u0136\u0135\3\2\2\2\u0137\u0138\3\2\2\2\u0138\u0136\3\2\2\2\u0138"+
+    "\u0139\3\2\2\2\u0139\u0141\3\2\2\2\u013a\u013e\5=\37\2\u013b\u013d\5W"+
+    ",\2\u013c\u013b\3\2\2\2\u013d\u0140\3\2\2\2\u013e\u013c\3\2\2\2\u013e"+
+    "\u013f\3\2\2\2\u013f\u0142\3\2\2\2\u0140\u013e\3\2\2\2\u0141\u013a\3\2"+
+    "\2\2\u0141\u0142\3\2\2\2\u0142\u0143\3\2\2\2\u0143\u0144\5U+\2\u0144\u014e"+
+    "\3\2\2\2\u0145\u0147\5=\37\2\u0146\u0148\5W,\2\u0147\u0146\3\2\2\2\u0148"+
+    "\u0149\3\2\2\2\u0149\u0147\3\2\2\2\u0149\u014a\3\2\2\2\u014a\u014b\3\2"+
+    "\2\2\u014b\u014c\5U+\2\u014c\u014e\3\2\2\2\u014d\u0124\3\2\2\2\u014d\u012f"+
+    "\3\2\2\2\u014d\u0136\3\2\2\2\u014d\u0145\3\2\2\2\u014eP\3\2\2\2\u014f"+
+    "\u0152\5Y-\2\u0150\u0152\t\b\2\2\u0151\u014f\3\2\2\2\u0151\u0150\3\2\2"+
+    "\2\u0152\u0158\3\2\2\2\u0153\u0157\5Y-\2\u0154\u0157\5W,\2\u0155\u0157"+
+    "\7a\2\2\u0156\u0153\3\2\2\2\u0156\u0154\3\2\2\2\u0156\u0155\3\2\2\2\u0157"+
+    "\u015a\3\2\2\2\u0158\u0156\3\2\2\2\u0158\u0159\3\2\2\2\u0159R\3\2\2\2"+
+    "\u015a\u0158\3\2\2\2\u015b\u0161\7b\2\2\u015c\u0160\n\t\2\2\u015d\u015e"+
+    "\7b\2\2\u015e\u0160\7b\2\2\u015f\u015c\3\2\2\2\u015f\u015d\3\2\2\2\u0160"+
+    "\u0163\3\2\2\2\u0161\u015f\3\2\2\2\u0161\u0162\3\2\2\2\u0162\u0164\3\2"+
+    "\2\2\u0163\u0161\3\2\2\2\u0164\u0165\7b\2\2\u0165T\3\2\2\2\u0166\u0168"+
+    "\t\n\2\2\u0167\u0169\t\13\2\2\u0168\u0167\3\2\2\2\u0168\u0169\3\2\2\2"+
+    "\u0169\u016b\3\2\2\2\u016a\u016c\5W,\2\u016b\u016a\3\2\2\2\u016c\u016d"+
+    "\3\2\2\2\u016d\u016b\3\2\2\2\u016d\u016e\3\2\2\2\u016eV\3\2\2\2\u016f"+
+    "\u0170\t\f\2\2\u0170X\3\2\2\2\u0171\u0172\t\r\2\2\u0172Z\3\2\2\2\u0173"+
+    "\u0174\7\61\2\2\u0174\u0175\7\61\2\2\u0175\u0179\3\2\2\2\u0176\u0178\n"+
+    "\7\2\2\u0177\u0176\3\2\2\2\u0178\u017b\3\2\2\2\u0179\u0177\3\2\2\2\u0179"+
     "\u017a\3\2\2\2\u017a\u017d\3\2\2\2\u017b\u0179\3\2\2\2\u017c\u017e\7\17"+
     "\2\2\u017d\u017c\3\2\2\2\u017d\u017e\3\2\2\2\u017e\u0180\3\2\2\2\u017f"+
     "\u0181\7\f\2\2\u0180\u017f\3\2\2\2\u0180\u0181\3\2\2\2\u0181\u0182\3\2"+
@@ -247,9 +246,9 @@ class EqlBaseLexer extends Lexer {
     "\u018f\7,\2\2\u018f\u0190\7\61\2\2\u0190\u0191\3\2\2\2\u0191\u0192\b/"+
     "\2\2\u0192^\3\2\2\2\u0193\u0195\t\16\2\2\u0194\u0193\3\2\2\2\u0195\u0196"+
     "\3\2\2\2\u0196\u0194\3\2\2\2\u0196\u0197\3\2\2\2\u0197\u0198\3\2\2\2\u0198"+
-    "\u0199\b\60\2\2\u0199`\3\2\2\2%\2\u00e0\u00e2\u00eb\u00ed\u00f5\u00f7"+
-    "\u0101\u0103\u010d\u010f\u011a\u0122\u0125\u0127\u012c\u0131\u0137\u013e"+
-    "\u0143\u0149\u014c\u0154\u0158\u015c\u0161\u0163\u0168\u016d\u0179\u017d"+
+    "\u0199\b\60\2\2\u0199`\3\2\2\2%\2\u00e0\u00e2\u00ea\u00ec\u00f6\u00f8"+
+    "\u0102\u0104\u010f\u0117\u011a\u011c\u0121\u0126\u012c\u0133\u0138\u013e"+
+    "\u0141\u0149\u014d\u0151\u0156\u0158\u015f\u0161\u0168\u016d\u0179\u017d"+
     "\u0180\u0189\u018b\u0196\3\2\3\2";
   public static final ATN _ATN =
     new ATNDeserializer().deserialize(_serializedATN.toCharArray());

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseListener.java

@@ -333,6 +333,16 @@ interface EqlBaseListener extends ParseTreeListener {
    * @param ctx the parse tree
    */
   void exitFunctionExpression(EqlBaseParser.FunctionExpressionContext ctx);
+  /**
+   * Enter a parse tree produced by {@link EqlBaseParser#functionName}.
+   * @param ctx the parse tree
+   */
+  void enterFunctionName(EqlBaseParser.FunctionNameContext ctx);
+  /**
+   * Exit a parse tree produced by {@link EqlBaseParser#functionName}.
+   * @param ctx the parse tree
+   */
+  void exitFunctionName(EqlBaseParser.FunctionNameContext ctx);
   /**
    * Enter a parse tree produced by the {@code nullLiteral}
    * labeled alternative in {@link EqlBaseParser#constant}.
@@ -465,4 +475,14 @@ interface EqlBaseListener extends ParseTreeListener {
    * @param ctx the parse tree
    */
   void exitString(EqlBaseParser.StringContext ctx);
+  /**
+   * Enter a parse tree produced by {@link EqlBaseParser#eventValue}.
+   * @param ctx the parse tree
+   */
+  void enterEventValue(EqlBaseParser.EventValueContext ctx);
+  /**
+   * Exit a parse tree produced by {@link EqlBaseParser#eventValue}.
+   * @param ctx the parse tree
+   */
+  void exitEventValue(EqlBaseParser.EventValueContext ctx);
 }

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseVisitor.java

@@ -203,6 +203,12 @@ interface EqlBaseVisitor<T> extends ParseTreeVisitor<T> {
    * @return the visitor result
    */
   T visitFunctionExpression(EqlBaseParser.FunctionExpressionContext ctx);
+  /**
+   * Visit a parse tree produced by {@link EqlBaseParser#functionName}.
+   * @param ctx the parse tree
+   * @return the visitor result
+   */
+  T visitFunctionName(EqlBaseParser.FunctionNameContext ctx);
   /**
    * Visit a parse tree produced by the {@code nullLiteral}
    * labeled alternative in {@link EqlBaseParser#constant}.
@@ -281,4 +287,10 @@ interface EqlBaseVisitor<T> extends ParseTreeVisitor<T> {
    * @return the visitor result
    */
   T visitString(EqlBaseParser.StringContext ctx);
+  /**
+   * Visit a parse tree produced by {@link EqlBaseParser#eventValue}.
+   * @param ctx the parse tree
+   * @return the visitor result
+   */
+  T visitEventValue(EqlBaseParser.EventValueContext ctx);
 }

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/LogicalPlanBuilder.java

@@ -152,7 +152,10 @@ public abstract class LogicalPlanBuilder extends ExpressionBuilder {
 
         if (ctx.event != null) {
             Source eventSource = source(ctx.event);
-            String eventName = visitIdentifier(ctx.event);
+            String eventName = ctx.event.getText();
+            if (eventName.startsWith("\"") || eventName.startsWith("'") || eventName.startsWith("?")) {
+                eventName = unquoteString(source(ctx.event));
+            }
             Literal eventValue = new Literal(eventSource, eventName, DataTypes.KEYWORD);
 
             UnresolvedAttribute eventField = new UnresolvedAttribute(eventSource, params.fieldEventCategory());

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/analysis/VerifierTests.java

@@ -73,7 +73,6 @@ public class VerifierTests extends ESTestCase {
 
     public void testQueryStartsWithNumber() {
         assertEquals("1:1: no viable alternative at input '42'", errorParsing("42 where true"));
-        assertEquals("1:1: no viable alternative at input '\"42\"'", errorParsing("\"42\" where true"));
     }
 
     public void testMissingColumn() {

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/parser/LogicalPlanTests.java

@@ -23,6 +23,8 @@ import org.elasticsearch.xpack.ql.expression.Order;
 import org.elasticsearch.xpack.ql.expression.Order.NullsPosition;
 import org.elasticsearch.xpack.ql.expression.Order.OrderDirection;
 import org.elasticsearch.xpack.ql.expression.UnresolvedAttribute;
+import org.elasticsearch.xpack.ql.expression.predicate.logical.And;
+import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.Equals;
 import org.elasticsearch.xpack.ql.plan.logical.Filter;
 import org.elasticsearch.xpack.ql.plan.logical.LogicalPlan;
 import org.elasticsearch.xpack.ql.plan.logical.OrderBy;
@@ -74,15 +76,6 @@ public class LogicalPlanTests extends ESTestCase {
         assertEquals(wrapFilter(fullExpression), fullQuery);
     }
 
-
-    private LogicalPlan wrapFilter(Expression exp) {
-        LogicalPlan filter = new Filter(Source.EMPTY, relation(), exp);
-        Order order = new Order(Source.EMPTY, timestamp(), OrderDirection.ASC, NullsPosition.FIRST);
-        LogicalPlan sorted = new OrderBy(Source.EMPTY, filter, singletonList(order));
-        LogicalPlan head = new Head(Source.EMPTY, new Literal(Source.EMPTY, RequestDefaults.SIZE, DataTypes.INTEGER), sorted);
-        return head;
-    }
-    
     public void testJoinPlan() {
         LogicalPlan plan = parser.createStatement(
                 "join by pid " +
@@ -112,10 +105,8 @@ public class LogicalPlanTests extends ESTestCase {
         key = keys.get(0);
         assertEquals(UnresolvedAttribute.class, key.getClass());
         assertEquals("pid", ((UnresolvedAttribute) key).name());
-
     }
     
-    
     public void testSequencePlan() {
         LogicalPlan plan = parser.createStatement(
                 "sequence by pid with maxspan=2s " +
@@ -137,12 +128,62 @@ public class LogicalPlanTests extends ESTestCase {
         List<? extends NamedExpression> keys = kf.keys();
         NamedExpression key = keys.get(0);
         assertEquals(UnresolvedAttribute.class, key.getClass());
-        assertEquals("pid", ((UnresolvedAttribute) key).name());
+        assertEquals("pid", key.name());
+
+        TimeValue maxSpan = seq.maxSpan();
+        assertEquals(new TimeValue(2, TimeUnit.SECONDS), maxSpan);
+    }
+
+    public void testQuotedEventType() {
+        LogicalPlan plan = parser.createStatement(
+                "sequence by pid with maxspan=2s " +
+                        "    [\"12\\\"34!@#$\" where process_name == \"test.exe\" ] " +
+                        "    [\"\"\"!@#$%test\"\"\\)(*&^\"\"\" where file_path == \"test.exe\"]");
+
+        plan = defaultPipes(plan);
+        assertEquals(Sequence.class, plan.getClass());
+        Sequence seq = (Sequence) plan;
+        assertEquals(KeyedFilter.class, seq.until().getClass());
+        assertEquals(LocalRelation.class, seq.until().child().getClass());
+
+        List<? extends LogicalPlan> queries = seq.queries();
+        assertEquals(2, queries.size());
+
+        LogicalPlan query1 = queries.get(0);
+        assertEquals(KeyedFilter.class, query1.getClass());
+        KeyedFilter kf = (KeyedFilter) query1;
+        assertEquals(Filter.class, kf.child().getClass());
+        Filter f = (Filter) kf.child();
+        assertEquals(And.class, f.condition().getClass());
+        assertEquals(Equals.class, ((And) f.condition()).left().getClass());
+        Equals eq = (Equals) ((And) f.condition()).left();
+        assertEquals("12\"34!@#$", eq.right().fold());
+
+        LogicalPlan query2 = queries.get(1);
+        assertEquals(KeyedFilter.class, query2.getClass());
+        kf = (KeyedFilter) query2;
+        assertEquals(Filter.class, kf.child().getClass());
+        f = (Filter) kf.child();
+        assertEquals(And.class, f.condition().getClass());
+        assertEquals(Equals.class, ((And) f.condition()).left().getClass());
+        eq = (Equals) ((And) f.condition()).left();
+        assertEquals("!@#$%test\"\"\\)(*&^", eq.right().fold());
+
+        List<? extends NamedExpression> keys = kf.keys();
+        NamedExpression key = keys.get(0);
+        assertEquals(UnresolvedAttribute.class, key.getClass());
+        assertEquals("pid", key.name());
 
         TimeValue maxSpan = seq.maxSpan();
         assertEquals(new TimeValue(2, TimeUnit.SECONDS), maxSpan);
     }
 
+    private LogicalPlan wrapFilter(Expression exp) {
+        LogicalPlan filter = new Filter(Source.EMPTY, relation(), exp);
+        Order order = new Order(Source.EMPTY, timestamp(), OrderDirection.ASC, NullsPosition.FIRST);
+        LogicalPlan sorted = new OrderBy(Source.EMPTY, filter, singletonList(order));
+        return new Head(Source.EMPTY, new Literal(Source.EMPTY, RequestDefaults.SIZE, DataTypes.INTEGER), sorted);
+    }
 
     private LogicalPlan defaultPipes(LogicalPlan plan) {
         assertTrue(plan instanceof LimitWithOffset);

x-pack/plugin/eql/src/test/resources/queries-supported.eql

@@ -687,3 +687,21 @@ process where fake_field != "*"
 
 process where not (fake_field : "*")
 | head 4;
+
+
+// eventType values
+"123" where process_name == "svchost.exe";
+
+"!#$%^&!#$\"123*&^%$()" where process_name == "svchost.exe";
+
+"""""!#$%^&!""#$\"123*""&^%$()""""" where process_name == "svchost.exe";
+
+"\".  ..\"   .. \"" where process_name == "svchost.exe";
+
+""""".  ..   .. """"" where process_name == "svchost.exe";
+
+sequence
+  ["!#$134" where serial_event_id<3] by unique_pid1
+  ["""!#@$%12345)(*&%^%#$@""" where true] by unique_ppid2
+| tail 1
+;