EQL: Introduce like and regex keywords (#68791)

Built-in language support for wildcard and regex queries.
Both the case sensitive and insensitive queries are allowed:

field like "pattern*" // basic matching
field like~ "P?tTeRn*" // case-insensitive
field like ("a*", "b?", "cd" ) // multi argument
field like~ ("A", "B?", "C*d") // case-insensitive multi arg

field regex "[a-z]" // basic form
field regex~ "[A-z]" // case-insensitive
field regex ("[aA]a", "[Bb]b") // multi argument
field regex~ ("aA", "bB") // case-insensitive multi arg

Fix #68639

x-pack/plugin/eql/qa/common/src/main/resources/additional_test_queries.toml

@@ -131,46 +131,6 @@ name = "numberStringConversion5"
 query = 'any where number(string(serial_event_id), 16) == 17'
 expected_event_ids = [11]
 
-# [[queries]]
-# name = "matchWithCharacterClasses1"
-# expected_event_ids  = [98]
-# notes = "regexp doesn't support character classes"
-# query = '''
-# //
-# //                                """.*?net1\s+localgroup.*?""")
-# process where match(command_line, """.*?net1[ ]+localgroup.*?""")
-# '''
-#
-# [[queries]]
-# name = "matchLiteAdditional"
-# expected_event_ids  = [98]
-# query = '''
-# process where matchLite(command_line, """.*?net1.*?""")
-# '''
-#
-# [[queries]]
-# name = "matchWithCharacterClasses2"
-# expected_event_ids  = [98]
-# notes = "regexp doesn't support predefined character classes (like \\s)"
-# query = '''
-# //                                """.*?net1\s+\w{4,15}\s+.*?"""
-# process where match(command_line, """.*?net1[ ]+[a-z]{4,15}[ ]+.*?""")
-# '''
-#
-# [[queries]]
-# name = "multiPatternMatch"
-# expected_event_ids  = [50, 97, 98]
-# query = '''
-# process where match(command_line, ".*?net[1]?  localgroup.*?", ".*? myappserver.py .*?")
-# '''
-#
-# [[queries]]
-# name = "matchWithSubstring"
-# expected_event_ids  = [50, 98]
-# query = '''
-# process where match(substring(command_line, 5), ".*?net[1]?  localgroup.*?", ".*? myappserver.py .*?")
-# '''
-
 [[queries]]
 name = "moduloEqualsField"
 # Basic test for modulo function
@@ -355,3 +315,116 @@ query = '''
 file where file_name in~ ("winini*.exe", "lsass.e?e") and opcode == 2
 '''
 expected_event_ids  = []
+
+[[queries]]
+name = "likeWithScript"
+query = 'process where string(serial_event_id) like "1"'
+expected_event_ids  = [1]
+
+[[queries]]
+name = "likeScriptWithPattern"
+query = 'process where string(serial_event_id) like ("1*")'
+expected_event_ids  = [1, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19]
+
+[[queries]]
+name = "likeScriptWithQuestionPattern"
+query = 'process where string(serial_event_id) like ("1?")'
+expected_event_ids  = [10, 11, 12, 13, 14, 15, 16, 17, 18, 19]
+
+[[queries]]
+name = "likeMultipleArgs"
+query = '''
+file where file_name like ("wininit.exe", "lsass.exe") and opcode == 2
+'''
+expected_event_ids  = [65, 86]
+
+[[queries]]
+name = "likeMultipleArgsInsensitive"
+query = '''
+file where file_name like~ ("winInIT.exe", "lsASS.exe") and opcode == 2
+'''
+expected_event_ids  = [65, 86]
+
+[[queries]]
+name = "likeMultipleArgWithPattern"
+query = '''
+file where file_name like ("winini*.exe", "lsass.*") and opcode == 2
+'''
+expected_event_ids  = [65, 86]
+
+[[queries]]
+name = "likeMultipleArgWithPatternInsensitive"
+query = '''
+file where file_name like~ ("winIni*.exe", "lSaSs.*") and opcode == 2
+'''
+expected_event_ids  = [65, 86]
+
+[[queries]]
+name = "likeMultipleArgsWildcardPatternQuestionMark"
+query = '''
+file where file_name like ("winini?.exe", "lsass.e?e") and opcode == 2
+'''
+expected_event_ids  = [65, 86]
+
+[[queries]]
+name = "likeMultipleArgsWildcardPatternQuestionMarkInsensitive"
+query = '''
+file where file_name like~ ("winINI?.exE", "lSasS.E?E") and opcode == 2
+'''
+expected_event_ids  = [65, 86]
+
+[[queries]]
+name = "regexWOCharClasses"
+expected_event_ids  = [98]
+notes = "regexp doesn't support character classes"
+query = '''
+//
+//                                """.*?net1\s+localgroup.*?""")
+process where command_line regex """.*?net1[ ]+localgroup.*?"""
+'''
+
+[[queries]]
+name = "regexWOCharClasses-Insensitive"
+expected_event_ids  = [98]
+notes = "regexp doesn't support character classes"
+query = '''
+process where command_line regex~ """.*?net1[ ]+localgroup.*?"""
+'''
+
+[[queries]]
+name = "simpleRegex"
+expected_event_ids  = [98]
+query = '''
+process where command_line regex """.*?net1.*?"""
+'''
+
+[[queries]]
+name = "simpleRegexInsensitive"
+expected_event_ids  = [98]
+query = '''
+process where command_line regex~ """.*?net1.*?"""
+'''
+
+[[queries]]
+name = "regexWithCharacterClasses2"
+expected_event_ids  = [98]
+notes = "regexp doesn't support predefined character classes (like \\s)"
+query = '''
+//                                """.*?net1\s+\w{4,15}\s+.*?"""
+process where command_line regex  (""".*?net1[ ]+[a-z]{4,15}[ ]+.*?""")
+'''
+
+[[queries]]
+name = "regexMultiPatternMatch"
+expected_event_ids  = [50, 97, 98]
+query = '''
+process where command_line regex (".*?net[1]?  localgroup.*?", ".*? myappserver.py .*?")
+'''
+
+[[queries]]
+name = "regexWithSubstring"
+expected_event_ids  = [50, 98]
+query = '''
+process where substring(command_line, 5) regex (".*?net[1]?  localgroup.*?", ".*? myappserver.py .*?")
+'''
+

x-pack/plugin/eql/src/main/antlr/EqlBase.g4

@@ -101,8 +101,8 @@ operatorExpression
 //   https://github.com/antlr/antlr4/issues/781
 predicate
     : NOT? kind=(IN | IN_INSENSITIVE) LP expression (COMMA expression)* RP
-    | kind=SEQ constant
-    | kind=SEQ LP constant (COMMA constant)* RP
+    | kind=(SEQ | LIKE | LIKE_INSENSITIVE | REGEX | REGEX_INSENSITIVE) constant
+    | kind=(SEQ | LIKE | LIKE_INSENSITIVE | REGEX | REGEX_INSENSITIVE) LP constant (COMMA constant)* RP
     ;
 
 primaryExpression
@@ -165,11 +165,15 @@ FALSE: 'false';
 IN: 'in';
 IN_INSENSITIVE : 'in~';
 JOIN: 'join';
+LIKE: 'like';
+LIKE_INSENSITIVE: 'like~';
 MAXSPAN: 'maxspan';
 NOT: 'not';
 NULL: 'null';
 OF: 'of';
 OR: 'or';
+REGEX: 'regex';
+REGEX_INSENSITIVE: 'regex~';
 SEQUENCE: 'sequence';
 TRUE: 'true';
 UNTIL: 'until';

x-pack/plugin/eql/src/main/antlr/EqlBase.tokens

@@ -5,45 +5,49 @@ FALSE=4
 IN=5
 IN_INSENSITIVE=6
 JOIN=7
-MAXSPAN=8
-NOT=9
-NULL=10
-OF=11
-OR=12
-SEQUENCE=13
-TRUE=14
-UNTIL=15
-WHERE=16
-WITH=17
-SEQ=18
-ASGN=19
-EQ=20
-NEQ=21
-LT=22
-LTE=23
-GT=24
-GTE=25
-PLUS=26
-MINUS=27
-ASTERISK=28
-SLASH=29
-PERCENT=30
-DOT=31
-COMMA=32
-LB=33
-RB=34
-LP=35
-RP=36
-PIPE=37
-STRING=38
-INTEGER_VALUE=39
-DECIMAL_VALUE=40
-IDENTIFIER=41
-QUOTED_IDENTIFIER=42
-TILDE_IDENTIFIER=43
-LINE_COMMENT=44
-BRACKETED_COMMENT=45
-WS=46
+LIKE=8
+LIKE_INSENSITIVE=9
+MAXSPAN=10
+NOT=11
+NULL=12
+OF=13
+OR=14
+REGEX=15
+REGEX_INSENSITIVE=16
+SEQUENCE=17
+TRUE=18
+UNTIL=19
+WHERE=20
+WITH=21
+SEQ=22
+ASGN=23
+EQ=24
+NEQ=25
+LT=26
+LTE=27
+GT=28
+GTE=29
+PLUS=30
+MINUS=31
+ASTERISK=32
+SLASH=33
+PERCENT=34
+DOT=35
+COMMA=36
+LB=37
+RB=38
+LP=39
+RP=40
+PIPE=41
+STRING=42
+INTEGER_VALUE=43
+DECIMAL_VALUE=44
+IDENTIFIER=45
+QUOTED_IDENTIFIER=46
+TILDE_IDENTIFIER=47
+LINE_COMMENT=48
+BRACKETED_COMMENT=49
+WS=50
 'and'=1
 'any'=2
 'by'=3
@@ -51,33 +55,37 @@ WS=46
 'in'=5
 'in~'=6
 'join'=7
-'maxspan'=8
-'not'=9
-'null'=10
-'of'=11
-'or'=12
-'sequence'=13
-'true'=14
-'until'=15
-'where'=16
-'with'=17
-':'=18
-'='=19
-'=='=20
-'!='=21
-'<'=22
-'<='=23
-'>'=24
-'>='=25
-'+'=26
-'-'=27
-'*'=28
-'/'=29
-'%'=30
-'.'=31
-','=32
-'['=33
-']'=34
-'('=35
-')'=36
-'|'=37
+'like'=8
+'like~'=9
+'maxspan'=10
+'not'=11
+'null'=12
+'of'=13
+'or'=14
+'regex'=15
+'regex~'=16
+'sequence'=17
+'true'=18
+'until'=19
+'where'=20
+'with'=21
+':'=22
+'='=23
+'=='=24
+'!='=25
+'<'=26
+'<='=27
+'>'=28
+'>='=29
+'+'=30
+'-'=31
+'*'=32
+'/'=33
+'%'=34
+'.'=35
+','=36
+'['=37
+']'=38
+'('=39
+')'=40
+'|'=41

x-pack/plugin/eql/src/main/antlr/EqlBaseLexer.tokens

@@ -5,45 +5,49 @@ FALSE=4
 IN=5
 IN_INSENSITIVE=6
 JOIN=7
-MAXSPAN=8
-NOT=9
-NULL=10
-OF=11
-OR=12
-SEQUENCE=13
-TRUE=14
-UNTIL=15
-WHERE=16
-WITH=17
-SEQ=18
-ASGN=19
-EQ=20
-NEQ=21
-LT=22
-LTE=23
-GT=24
-GTE=25
-PLUS=26
-MINUS=27
-ASTERISK=28
-SLASH=29
-PERCENT=30
-DOT=31
-COMMA=32
-LB=33
-RB=34
-LP=35
-RP=36
-PIPE=37
-STRING=38
-INTEGER_VALUE=39
-DECIMAL_VALUE=40
-IDENTIFIER=41
-QUOTED_IDENTIFIER=42
-TILDE_IDENTIFIER=43
-LINE_COMMENT=44
-BRACKETED_COMMENT=45
-WS=46
+LIKE=8
+LIKE_INSENSITIVE=9
+MAXSPAN=10
+NOT=11
+NULL=12
+OF=13
+OR=14
+REGEX=15
+REGEX_INSENSITIVE=16
+SEQUENCE=17
+TRUE=18
+UNTIL=19
+WHERE=20
+WITH=21
+SEQ=22
+ASGN=23
+EQ=24
+NEQ=25
+LT=26
+LTE=27
+GT=28
+GTE=29
+PLUS=30
+MINUS=31
+ASTERISK=32
+SLASH=33
+PERCENT=34
+DOT=35
+COMMA=36
+LB=37
+RB=38
+LP=39
+RP=40
+PIPE=41
+STRING=42
+INTEGER_VALUE=43
+DECIMAL_VALUE=44
+IDENTIFIER=45
+QUOTED_IDENTIFIER=46
+TILDE_IDENTIFIER=47
+LINE_COMMENT=48
+BRACKETED_COMMENT=49
+WS=50
 'and'=1
 'any'=2
 'by'=3
@@ -51,33 +55,37 @@ WS=46
 'in'=5
 'in~'=6
 'join'=7
-'maxspan'=8
-'not'=9
-'null'=10
-'of'=11
-'or'=12
-'sequence'=13
-'true'=14
-'until'=15
-'where'=16
-'with'=17
-':'=18
-'='=19
-'=='=20
-'!='=21
-'<'=22
-'<='=23
-'>'=24
-'>='=25
-'+'=26
-'-'=27
-'*'=28
-'/'=29
-'%'=30
-'.'=31
-','=32
-'['=33
-']'=34
-'('=35
-')'=36
-'|'=37
+'like'=8
+'like~'=9
+'maxspan'=10
+'not'=11
+'null'=12
+'of'=13
+'or'=14
+'regex'=15
+'regex~'=16
+'sequence'=17
+'true'=18
+'until'=19
+'where'=20
+'with'=21
+':'=22
+'='=23
+'=='=24
+'!='=25
+'<'=26
+'<='=27
+'>'=28
+'>='=29
+'+'=30
+'-'=31
+'*'=32
+'/'=33
+'%'=34
+'.'=35
+','=36
+'['=37
+']'=38
+'('=39
+')'=40
+'|'=41

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/function/scalar/string/Match.java

@@ -35,25 +35,27 @@ public class Match extends BaseSurrogateFunction {
 
     private final Expression field;
     private final List<Expression> patterns;
+    private final boolean caseInsensitive;
 
-    public Match(Source source, Expression field, List<Expression> patterns) {
-        this(source, CollectionUtils.combine(singletonList(field), patterns));
+    public Match(Source source, Expression field, List<Expression> patterns, boolean caseInsensitive) {
+        this(source, CollectionUtils.combine(singletonList(field), patterns), caseInsensitive);
     }
 
-    private Match(Source source, List<Expression> children) {
+    private Match(Source source, List<Expression> children, boolean caseInsensitive) {
         super(source, children);
         this.field = children().get(0);
         this.patterns = children().subList(1, children().size());
+        this.caseInsensitive = caseInsensitive;
     }
 
     @Override
     protected NodeInfo<? extends Expression> info() {
-        return NodeInfo.create(this, Match::new, field, patterns);
+        return NodeInfo.create(this, Match::new, field, patterns, caseInsensitive);
     }
 
     @Override
     public Expression replaceChildren(List<Expression> newChildren) {
-        return new Match(source(), newChildren);
+        return new Match(source(), newChildren, caseInsensitive);
     }
 
     @Override
@@ -100,6 +102,6 @@ public class Match extends BaseSurrogateFunction {
             patternStrings.add(regex.fold().toString());
         }
 
-        return new RLike(source(), field, new RLikePattern(String.join("|", patternStrings)));
+        return new RLike(source(), field, new RLikePattern(String.join("|", patternStrings)), caseInsensitive);
     }
 }

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/optimizer/Optimizer.java

@@ -9,6 +9,7 @@ package org.elasticsearch.xpack.eql.optimizer;
 
 import org.elasticsearch.xpack.eql.EqlIllegalArgumentException;
 import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveBinaryComparison;
+import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveEquals;
 import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveWildcardEquals;
 import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveWildcardNotEquals;
 import org.elasticsearch.xpack.eql.plan.logical.Join;
@@ -34,6 +35,7 @@ import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.Binar
 import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.Equals;
 import org.elasticsearch.xpack.ql.expression.predicate.operator.comparison.NotEquals;
 import org.elasticsearch.xpack.ql.expression.predicate.regex.Like;
+import org.elasticsearch.xpack.ql.expression.predicate.regex.RegexMatch;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.BooleanFunctionEqualsElimination;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.BooleanLiteralsOnTheRight;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.BooleanSimplification;
@@ -43,10 +45,9 @@ import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.ConstantFolding;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.OptimizerRule;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.PropagateEquals;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.PruneLiteralsInOrderBy;
-import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.SimplifyComparisonsArithmetics;
-import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.ReplaceRegexMatch;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.ReplaceSurrogateFunction;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.SetAsOptimized;
+import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.SimplifyComparisonsArithmetics;
 import org.elasticsearch.xpack.ql.optimizer.OptimizerRules.TransformDirection;
 import org.elasticsearch.xpack.ql.plan.logical.Filter;
 import org.elasticsearch.xpack.ql.plan.logical.Limit;
@@ -196,6 +197,15 @@ public class Optimizer extends RuleExecutor<LogicalPlan> {
         }
     }
 
+    static class ReplaceRegexMatch extends org.elasticsearch.xpack.ql.optimizer.OptimizerRules.ReplaceRegexMatch {
+        @Override
+        protected Expression regexToEquals(RegexMatch<?> regexMatch, Literal literal) {
+            return regexMatch.caseInsensitive()
+                ? new InsensitiveEquals(regexMatch.source(), regexMatch.field(), literal, null)
+                : new Equals(regexMatch.source(), regexMatch.field(), literal);
+        }
+    }
+
     static class PruneFilters extends org.elasticsearch.xpack.ql.optimizer.OptimizerRules.PruneFilters {
 
         @Override

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseLexer.java

@@ -17,41 +17,42 @@ class EqlBaseLexer extends Lexer {
   protected static final PredictionContextCache _sharedContextCache =
     new PredictionContextCache();
   public static final int
-    AND=1, ANY=2, BY=3, FALSE=4, IN=5, IN_INSENSITIVE=6, JOIN=7, MAXSPAN=8, 
-    NOT=9, NULL=10, OF=11, OR=12, SEQUENCE=13, TRUE=14, UNTIL=15, WHERE=16, 
-    WITH=17, SEQ=18, ASGN=19, EQ=20, NEQ=21, LT=22, LTE=23, GT=24, GTE=25, 
-    PLUS=26, MINUS=27, ASTERISK=28, SLASH=29, PERCENT=30, DOT=31, COMMA=32, 
-    LB=33, RB=34, LP=35, RP=36, PIPE=37, STRING=38, INTEGER_VALUE=39, DECIMAL_VALUE=40, 
-    IDENTIFIER=41, QUOTED_IDENTIFIER=42, TILDE_IDENTIFIER=43, LINE_COMMENT=44, 
-    BRACKETED_COMMENT=45, WS=46;
+    AND=1, ANY=2, BY=3, FALSE=4, IN=5, IN_INSENSITIVE=6, JOIN=7, LIKE=8, LIKE_INSENSITIVE=9, 
+    MAXSPAN=10, NOT=11, NULL=12, OF=13, OR=14, REGEX=15, REGEX_INSENSITIVE=16, 
+    SEQUENCE=17, TRUE=18, UNTIL=19, WHERE=20, WITH=21, SEQ=22, ASGN=23, EQ=24, 
+    NEQ=25, LT=26, LTE=27, GT=28, GTE=29, PLUS=30, MINUS=31, ASTERISK=32, 
+    SLASH=33, PERCENT=34, DOT=35, COMMA=36, LB=37, RB=38, LP=39, RP=40, PIPE=41, 
+    STRING=42, INTEGER_VALUE=43, DECIMAL_VALUE=44, IDENTIFIER=45, QUOTED_IDENTIFIER=46, 
+    TILDE_IDENTIFIER=47, LINE_COMMENT=48, BRACKETED_COMMENT=49, WS=50;
   public static String[] modeNames = {
     "DEFAULT_MODE"
   };
 
   public static final String[] ruleNames = {
-    "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "MAXSPAN", 
-    "NOT", "NULL", "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", 
-    "SEQ", "ASGN", "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", 
-    "ASTERISK", "SLASH", "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", 
-    "PIPE", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", 
-    "TILDE_IDENTIFIER", "EXPONENT", "DIGIT", "LETTER", "LINE_COMMENT", "BRACKETED_COMMENT", 
-    "WS"
+    "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "LIKE", "LIKE_INSENSITIVE", 
+    "MAXSPAN", "NOT", "NULL", "OF", "OR", "REGEX", "REGEX_INSENSITIVE", "SEQUENCE", 
+    "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", "EQ", "NEQ", "LT", "LTE", 
+    "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", "PERCENT", "DOT", "COMMA", 
+    "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", 
+    "IDENTIFIER", "QUOTED_IDENTIFIER", "TILDE_IDENTIFIER", "EXPONENT", "DIGIT", 
+    "LETTER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
   };
 
   private static final String[] _LITERAL_NAMES = {
     null, "'and'", "'any'", "'by'", "'false'", "'in'", "'in~'", "'join'", 
-    "'maxspan'", "'not'", "'null'", "'of'", "'or'", "'sequence'", "'true'", 
-    "'until'", "'where'", "'with'", "':'", "'='", "'=='", "'!='", "'<'", "'<='", 
-    "'>'", "'>='", "'+'", "'-'", "'*'", "'/'", "'%'", "'.'", "','", "'['", 
-    "']'", "'('", "')'", "'|'"
+    "'like'", "'like~'", "'maxspan'", "'not'", "'null'", "'of'", "'or'", "'regex'", 
+    "'regex~'", "'sequence'", "'true'", "'until'", "'where'", "'with'", "':'", 
+    "'='", "'=='", "'!='", "'<'", "'<='", "'>'", "'>='", "'+'", "'-'", "'*'", 
+    "'/'", "'%'", "'.'", "','", "'['", "']'", "'('", "')'", "'|'"
   };
   private static final String[] _SYMBOLIC_NAMES = {
-    null, "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "MAXSPAN", 
-    "NOT", "NULL", "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", 
-    "SEQ", "ASGN", "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", 
-    "ASTERISK", "SLASH", "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", 
-    "PIPE", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", 
-    "TILDE_IDENTIFIER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
+    null, "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "LIKE", 
+    "LIKE_INSENSITIVE", "MAXSPAN", "NOT", "NULL", "OF", "OR", "REGEX", "REGEX_INSENSITIVE", 
+    "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", "EQ", "NEQ", 
+    "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", "PERCENT", 
+    "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", 
+    "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", "TILDE_IDENTIFIER", 
+    "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
   };
   public static final Vocabulary VOCABULARY = new VocabularyImpl(_LITERAL_NAMES, _SYMBOLIC_NAMES);
 
@@ -108,160 +109,170 @@ class EqlBaseLexer extends Lexer {
   public ATN getATN() { return _ATN; }
 
   public static final String _serializedATN =
-    "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\2\60\u01ad\b\1\4\2"+
+    "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\2\64\u01cd\b\1\4\2"+
     "\t\2\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4"+
     "\13\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22"+
     "\t\22\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31"+
     "\t\31\4\32\t\32\4\33\t\33\4\34\t\34\4\35\t\35\4\36\t\36\4\37\t\37\4 \t"+
     " \4!\t!\4\"\t\"\4#\t#\4$\t$\4%\t%\4&\t&\4\'\t\'\4(\t(\4)\t)\4*\t*\4+\t"+
-    "+\4,\t,\4-\t-\4.\t.\4/\t/\4\60\t\60\4\61\t\61\4\62\t\62\3\2\3\2\3\2\3"+
-    "\2\3\3\3\3\3\3\3\3\3\4\3\4\3\4\3\5\3\5\3\5\3\5\3\5\3\5\3\6\3\6\3\6\3\7"+
-    "\3\7\3\7\3\7\3\b\3\b\3\b\3\b\3\b\3\t\3\t\3\t\3\t\3\t\3\t\3\t\3\t\3\n\3"+
-    "\n\3\n\3\n\3\13\3\13\3\13\3\13\3\13\3\f\3\f\3\f\3\r\3\r\3\r\3\16\3\16"+
-    "\3\16\3\16\3\16\3\16\3\16\3\16\3\16\3\17\3\17\3\17\3\17\3\17\3\20\3\20"+
-    "\3\20\3\20\3\20\3\20\3\21\3\21\3\21\3\21\3\21\3\21\3\22\3\22\3\22\3\22"+
-    "\3\22\3\23\3\23\3\24\3\24\3\25\3\25\3\25\3\26\3\26\3\26\3\27\3\27\3\30"+
-    "\3\30\3\30\3\31\3\31\3\32\3\32\3\32\3\33\3\33\3\34\3\34\3\35\3\35\3\36"+
-    "\3\36\3\37\3\37\3 \3 \3!\3!\3\"\3\"\3#\3#\3$\3$\3%\3%\3&\3&\3\'\3\'\3"+
-    "\'\3\'\7\'\u00e9\n\'\f\'\16\'\u00ec\13\'\3\'\3\'\3\'\3\'\3\'\7\'\u00f3"+
-    "\n\'\f\'\16\'\u00f6\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u00ff\n\'\f\'"+
-    "\16\'\u0102\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u010b\n\'\f\'\16\'\u010e"+
-    "\13\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u0116\n\'\f\'\16\'\u0119\13\'\3\'\3"+
-    "\'\3\'\3\'\3\'\5\'\u0120\n\'\3\'\5\'\u0123\n\'\5\'\u0125\n\'\3(\6(\u0128"+
-    "\n(\r(\16(\u0129\3)\6)\u012d\n)\r)\16)\u012e\3)\3)\7)\u0133\n)\f)\16)"+
-    "\u0136\13)\3)\3)\6)\u013a\n)\r)\16)\u013b\3)\6)\u013f\n)\r)\16)\u0140"+
-    "\3)\3)\7)\u0145\n)\f)\16)\u0148\13)\5)\u014a\n)\3)\3)\3)\3)\6)\u0150\n"+
-    ")\r)\16)\u0151\3)\3)\5)\u0156\n)\3*\3*\5*\u015a\n*\3*\3*\3*\7*\u015f\n"+
-    "*\f*\16*\u0162\13*\3+\3+\3+\3+\7+\u0168\n+\f+\16+\u016b\13+\3+\3+\3,\3"+
-    ",\3,\3,\7,\u0173\n,\f,\16,\u0176\13,\3,\3,\3-\3-\5-\u017c\n-\3-\6-\u017f"+
-    "\n-\r-\16-\u0180\3.\3.\3/\3/\3\60\3\60\3\60\3\60\7\60\u018b\n\60\f\60"+
-    "\16\60\u018e\13\60\3\60\5\60\u0191\n\60\3\60\5\60\u0194\n\60\3\60\3\60"+
-    "\3\61\3\61\3\61\3\61\3\61\7\61\u019d\n\61\f\61\16\61\u01a0\13\61\3\61"+
-    "\3\61\3\61\3\61\3\61\3\62\6\62\u01a8\n\62\r\62\16\62\u01a9\3\62\3\62\4"+
-    "\u0117\u019e\2\63\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f\27\r\31"+
-    "\16\33\17\35\20\37\21!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63\33\65"+
-    "\34\67\359\36;\37= ?!A\"C#E$G%I&K\'M(O)Q*S+U,W-Y\2[\2]\2_.a/c\60\3\2\17"+
-    "\n\2$$))^^ddhhppttvv\6\2\f\f\17\17))^^\6\2\f\f\17\17$$^^\5\2\f\f\17\17"+
-    "$$\5\2\f\f\17\17))\4\2\f\f\17\17\4\2BBaa\3\2bb\4\2GGgg\4\2--//\3\2\62"+
-    ";\4\2C\\c|\5\2\13\f\17\17\"\"\u01d4\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3\2\2"+
-    "\2\2\t\3\2\2\2\2\13\3\2\2\2\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3\2\2\2\2\23"+
-    "\3\2\2\2\2\25\3\2\2\2\2\27\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2\2\2\35\3\2"+
-    "\2\2\2\37\3\2\2\2\2!\3\2\2\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2\2\2\2)\3\2"+
-    "\2\2\2+\3\2\2\2\2-\3\2\2\2\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2\2\2\2\65\3"+
-    "\2\2\2\2\67\3\2\2\2\29\3\2\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2\2\2\2A\3\2"+
-    "\2\2\2C\3\2\2\2\2E\3\2\2\2\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2\2M\3\2\2\2"+
-    "\2O\3\2\2\2\2Q\3\2\2\2\2S\3\2\2\2\2U\3\2\2\2\2W\3\2\2\2\2_\3\2\2\2\2a"+
-    "\3\2\2\2\2c\3\2\2\2\3e\3\2\2\2\5i\3\2\2\2\7m\3\2\2\2\tp\3\2\2\2\13v\3"+
-    "\2\2\2\ry\3\2\2\2\17}\3\2\2\2\21\u0082\3\2\2\2\23\u008a\3\2\2\2\25\u008e"+
-    "\3\2\2\2\27\u0093\3\2\2\2\31\u0096\3\2\2\2\33\u0099\3\2\2\2\35\u00a2\3"+
-    "\2\2\2\37\u00a7\3\2\2\2!\u00ad\3\2\2\2#\u00b3\3\2\2\2%\u00b8\3\2\2\2\'"+
-    "\u00ba\3\2\2\2)\u00bc\3\2\2\2+\u00bf\3\2\2\2-\u00c2\3\2\2\2/\u00c4\3\2"+
-    "\2\2\61\u00c7\3\2\2\2\63\u00c9\3\2\2\2\65\u00cc\3\2\2\2\67\u00ce\3\2\2"+
-    "\29\u00d0\3\2\2\2;\u00d2\3\2\2\2=\u00d4\3\2\2\2?\u00d6\3\2\2\2A\u00d8"+
-    "\3\2\2\2C\u00da\3\2\2\2E\u00dc\3\2\2\2G\u00de\3\2\2\2I\u00e0\3\2\2\2K"+
-    "\u00e2\3\2\2\2M\u0124\3\2\2\2O\u0127\3\2\2\2Q\u0155\3\2\2\2S\u0159\3\2"+
-    "\2\2U\u0163\3\2\2\2W\u016e\3\2\2\2Y\u0179\3\2\2\2[\u0182\3\2\2\2]\u0184"+
-    "\3\2\2\2_\u0186\3\2\2\2a\u0197\3\2\2\2c\u01a7\3\2\2\2ef\7c\2\2fg\7p\2"+
-    "\2gh\7f\2\2h\4\3\2\2\2ij\7c\2\2jk\7p\2\2kl\7{\2\2l\6\3\2\2\2mn\7d\2\2"+
-    "no\7{\2\2o\b\3\2\2\2pq\7h\2\2qr\7c\2\2rs\7n\2\2st\7u\2\2tu\7g\2\2u\n\3"+
-    "\2\2\2vw\7k\2\2wx\7p\2\2x\f\3\2\2\2yz\7k\2\2z{\7p\2\2{|\7\u0080\2\2|\16"+
-    "\3\2\2\2}~\7l\2\2~\177\7q\2\2\177\u0080\7k\2\2\u0080\u0081\7p\2\2\u0081"+
-    "\20\3\2\2\2\u0082\u0083\7o\2\2\u0083\u0084\7c\2\2\u0084\u0085\7z\2\2\u0085"+
-    "\u0086\7u\2\2\u0086\u0087\7r\2\2\u0087\u0088\7c\2\2\u0088\u0089\7p\2\2"+
-    "\u0089\22\3\2\2\2\u008a\u008b\7p\2\2\u008b\u008c\7q\2\2\u008c\u008d\7"+
-    "v\2\2\u008d\24\3\2\2\2\u008e\u008f\7p\2\2\u008f\u0090\7w\2\2\u0090\u0091"+
-    "\7n\2\2\u0091\u0092\7n\2\2\u0092\26\3\2\2\2\u0093\u0094\7q\2\2\u0094\u0095"+
-    "\7h\2\2\u0095\30\3\2\2\2\u0096\u0097\7q\2\2\u0097\u0098\7t\2\2\u0098\32"+
-    "\3\2\2\2\u0099\u009a\7u\2\2\u009a\u009b\7g\2\2\u009b\u009c\7s\2\2\u009c"+
-    "\u009d\7w\2\2\u009d\u009e\7g\2\2\u009e\u009f\7p\2\2\u009f\u00a0\7e\2\2"+
-    "\u00a0\u00a1\7g\2\2\u00a1\34\3\2\2\2\u00a2\u00a3\7v\2\2\u00a3\u00a4\7"+
-    "t\2\2\u00a4\u00a5\7w\2\2\u00a5\u00a6\7g\2\2\u00a6\36\3\2\2\2\u00a7\u00a8"+
-    "\7w\2\2\u00a8\u00a9\7p\2\2\u00a9\u00aa\7v\2\2\u00aa\u00ab\7k\2\2\u00ab"+
-    "\u00ac\7n\2\2\u00ac \3\2\2\2\u00ad\u00ae\7y\2\2\u00ae\u00af\7j\2\2\u00af"+
-    "\u00b0\7g\2\2\u00b0\u00b1\7t\2\2\u00b1\u00b2\7g\2\2\u00b2\"\3\2\2\2\u00b3"+
-    "\u00b4\7y\2\2\u00b4\u00b5\7k\2\2\u00b5\u00b6\7v\2\2\u00b6\u00b7\7j\2\2"+
-    "\u00b7$\3\2\2\2\u00b8\u00b9\7<\2\2\u00b9&\3\2\2\2\u00ba\u00bb\7?\2\2\u00bb"+
-    "(\3\2\2\2\u00bc\u00bd\7?\2\2\u00bd\u00be\7?\2\2\u00be*\3\2\2\2\u00bf\u00c0"+
-    "\7#\2\2\u00c0\u00c1\7?\2\2\u00c1,\3\2\2\2\u00c2\u00c3\7>\2\2\u00c3.\3"+
-    "\2\2\2\u00c4\u00c5\7>\2\2\u00c5\u00c6\7?\2\2\u00c6\60\3\2\2\2\u00c7\u00c8"+
-    "\7@\2\2\u00c8\62\3\2\2\2\u00c9\u00ca\7@\2\2\u00ca\u00cb\7?\2\2\u00cb\64"+
-    "\3\2\2\2\u00cc\u00cd\7-\2\2\u00cd\66\3\2\2\2\u00ce\u00cf\7/\2\2\u00cf"+
-    "8\3\2\2\2\u00d0\u00d1\7,\2\2\u00d1:\3\2\2\2\u00d2\u00d3\7\61\2\2\u00d3"+
-    "<\3\2\2\2\u00d4\u00d5\7\'\2\2\u00d5>\3\2\2\2\u00d6\u00d7\7\60\2\2\u00d7"+
-    "@\3\2\2\2\u00d8\u00d9\7.\2\2\u00d9B\3\2\2\2\u00da\u00db\7]\2\2\u00dbD"+
-    "\3\2\2\2\u00dc\u00dd\7_\2\2\u00ddF\3\2\2\2\u00de\u00df\7*\2\2\u00dfH\3"+
-    "\2\2\2\u00e0\u00e1\7+\2\2\u00e1J\3\2\2\2\u00e2\u00e3\7~\2\2\u00e3L\3\2"+
-    "\2\2\u00e4\u00ea\7)\2\2\u00e5\u00e6\7^\2\2\u00e6\u00e9\t\2\2\2\u00e7\u00e9"+
-    "\n\3\2\2\u00e8\u00e5\3\2\2\2\u00e8\u00e7\3\2\2\2\u00e9\u00ec\3\2\2\2\u00ea"+
-    "\u00e8\3\2\2\2\u00ea\u00eb\3\2\2\2\u00eb\u00ed\3\2\2\2\u00ec\u00ea\3\2"+
-    "\2\2\u00ed\u0125\7)\2\2\u00ee\u00f4\7$\2\2\u00ef\u00f0\7^\2\2\u00f0\u00f3"+
-    "\t\2\2\2\u00f1\u00f3\n\4\2\2\u00f2\u00ef\3\2\2\2\u00f2\u00f1\3\2\2\2\u00f3"+
-    "\u00f6\3\2\2\2\u00f4\u00f2\3\2\2\2\u00f4\u00f5\3\2\2\2\u00f5\u00f7\3\2"+
-    "\2\2\u00f6\u00f4\3\2\2\2\u00f7\u0125\7$\2\2\u00f8\u00f9\7A\2\2\u00f9\u00fa"+
-    "\7$\2\2\u00fa\u0100\3\2\2\2\u00fb\u00fc\7^\2\2\u00fc\u00ff\7$\2\2\u00fd"+
-    "\u00ff\n\5\2\2\u00fe\u00fb\3\2\2\2\u00fe\u00fd\3\2\2\2\u00ff\u0102\3\2"+
-    "\2\2\u0100\u00fe\3\2\2\2\u0100\u0101\3\2\2\2\u0101\u0103\3\2\2\2\u0102"+
-    "\u0100\3\2\2\2\u0103\u0125\7$\2\2\u0104\u0105\7A\2\2\u0105\u0106\7)\2"+
-    "\2\u0106\u010c\3\2\2\2\u0107\u0108\7^\2\2\u0108\u010b\7)\2\2\u0109\u010b"+
-    "\n\6\2\2\u010a\u0107\3\2\2\2\u010a\u0109\3\2\2\2\u010b\u010e\3\2\2\2\u010c"+
-    "\u010a\3\2\2\2\u010c\u010d\3\2\2\2\u010d\u010f\3\2\2\2\u010e\u010c\3\2"+
-    "\2\2\u010f\u0125\7)\2\2\u0110\u0111\7$\2\2\u0111\u0112\7$\2\2\u0112\u0113"+
-    "\7$\2\2\u0113\u0117\3\2\2\2\u0114\u0116\n\7\2\2\u0115\u0114\3\2\2\2\u0116"+
-    "\u0119\3\2\2\2\u0117\u0118\3\2\2\2\u0117\u0115\3\2\2\2\u0118\u011a\3\2"+
-    "\2\2\u0119\u0117\3\2\2\2\u011a\u011b\7$\2\2\u011b\u011c\7$\2\2\u011c\u011d"+
-    "\7$\2\2\u011d\u011f\3\2\2\2\u011e\u0120\7$\2\2\u011f\u011e\3\2\2\2\u011f"+
-    "\u0120\3\2\2\2\u0120\u0122\3\2\2\2\u0121\u0123\7$\2\2\u0122\u0121\3\2"+
-    "\2\2\u0122\u0123\3\2\2\2\u0123\u0125\3\2\2\2\u0124\u00e4\3\2\2\2\u0124"+
-    "\u00ee\3\2\2\2\u0124\u00f8\3\2\2\2\u0124\u0104\3\2\2\2\u0124\u0110\3\2"+
-    "\2\2\u0125N\3\2\2\2\u0126\u0128\5[.\2\u0127\u0126\3\2\2\2\u0128\u0129"+
-    "\3\2\2\2\u0129\u0127\3\2\2\2\u0129\u012a\3\2\2\2\u012aP\3\2\2\2\u012b"+
-    "\u012d\5[.\2\u012c\u012b\3\2\2\2\u012d\u012e\3\2\2\2\u012e\u012c\3\2\2"+
-    "\2\u012e\u012f\3\2\2\2\u012f\u0130\3\2\2\2\u0130\u0134\5? \2\u0131\u0133"+
-    "\5[.\2\u0132\u0131\3\2\2\2\u0133\u0136\3\2\2\2\u0134\u0132\3\2\2\2\u0134"+
-    "\u0135\3\2\2\2\u0135\u0156\3\2\2\2\u0136\u0134\3\2\2\2\u0137\u0139\5?"+
-    " \2\u0138\u013a\5[.\2\u0139\u0138\3\2\2\2\u013a\u013b\3\2\2\2\u013b\u0139"+
-    "\3\2\2\2\u013b\u013c\3\2\2\2\u013c\u0156\3\2\2\2\u013d\u013f\5[.\2\u013e"+
-    "\u013d\3\2\2\2\u013f\u0140\3\2\2\2\u0140\u013e\3\2\2\2\u0140\u0141\3\2"+
-    "\2\2\u0141\u0149\3\2\2\2\u0142\u0146\5? \2\u0143\u0145\5[.\2\u0144\u0143"+
-    "\3\2\2\2\u0145\u0148\3\2\2\2\u0146\u0144\3\2\2\2\u0146\u0147\3\2\2\2\u0147"+
-    "\u014a\3\2\2\2\u0148\u0146\3\2\2\2\u0149\u0142\3\2\2\2\u0149\u014a\3\2"+
-    "\2\2\u014a\u014b\3\2\2\2\u014b\u014c\5Y-\2\u014c\u0156\3\2\2\2\u014d\u014f"+
-    "\5? \2\u014e\u0150\5[.\2\u014f\u014e\3\2\2\2\u0150\u0151\3\2\2\2\u0151"+
-    "\u014f\3\2\2\2\u0151\u0152\3\2\2\2\u0152\u0153\3\2\2\2\u0153\u0154\5Y"+
-    "-\2\u0154\u0156\3\2\2\2\u0155\u012c\3\2\2\2\u0155\u0137\3\2\2\2\u0155"+
-    "\u013e\3\2\2\2\u0155\u014d\3\2\2\2\u0156R\3\2\2\2\u0157\u015a\5]/\2\u0158"+
-    "\u015a\t\b\2\2\u0159\u0157\3\2\2\2\u0159\u0158\3\2\2\2\u015a\u0160\3\2"+
-    "\2\2\u015b\u015f\5]/\2\u015c\u015f\5[.\2\u015d\u015f\7a\2\2\u015e\u015b"+
-    "\3\2\2\2\u015e\u015c\3\2\2\2\u015e\u015d\3\2\2\2\u015f\u0162\3\2\2\2\u0160"+
-    "\u015e\3\2\2\2\u0160\u0161\3\2\2\2\u0161T\3\2\2\2\u0162\u0160\3\2\2\2"+
-    "\u0163\u0169\7b\2\2\u0164\u0168\n\t\2\2\u0165\u0166\7b\2\2\u0166\u0168"+
-    "\7b\2\2\u0167\u0164\3\2\2\2\u0167\u0165\3\2\2\2\u0168\u016b\3\2\2\2\u0169"+
-    "\u0167\3\2\2\2\u0169\u016a\3\2\2\2\u016a\u016c\3\2\2\2\u016b\u0169\3\2"+
-    "\2\2\u016c\u016d\7b\2\2\u016dV\3\2\2\2\u016e\u0174\5]/\2\u016f\u0173\5"+
-    "]/\2\u0170\u0173\5[.\2\u0171\u0173\7a\2\2\u0172\u016f\3\2\2\2\u0172\u0170"+
-    "\3\2\2\2\u0172\u0171\3\2\2\2\u0173\u0176\3\2\2\2\u0174\u0172\3\2\2\2\u0174"+
-    "\u0175\3\2\2\2\u0175\u0177\3\2\2\2\u0176\u0174\3\2\2\2\u0177\u0178\7\u0080"+
-    "\2\2\u0178X\3\2\2\2\u0179\u017b\t\n\2\2\u017a\u017c\t\13\2\2\u017b\u017a"+
-    "\3\2\2\2\u017b\u017c\3\2\2\2\u017c\u017e\3\2\2\2\u017d\u017f\5[.\2\u017e"+
-    "\u017d\3\2\2\2\u017f\u0180\3\2\2\2\u0180\u017e\3\2\2\2\u0180\u0181\3\2"+
-    "\2\2\u0181Z\3\2\2\2\u0182\u0183\t\f\2\2\u0183\\\3\2\2\2\u0184\u0185\t"+
-    "\r\2\2\u0185^\3\2\2\2\u0186\u0187\7\61\2\2\u0187\u0188\7\61\2\2\u0188"+
-    "\u018c\3\2\2\2\u0189\u018b\n\7\2\2\u018a\u0189\3\2\2\2\u018b\u018e\3\2"+
-    "\2\2\u018c\u018a\3\2\2\2\u018c\u018d\3\2\2\2\u018d\u0190\3\2\2\2\u018e"+
-    "\u018c\3\2\2\2\u018f\u0191\7\17\2\2\u0190\u018f\3\2\2\2\u0190\u0191\3"+
-    "\2\2\2\u0191\u0193\3\2\2\2\u0192\u0194\7\f\2\2\u0193\u0192\3\2\2\2\u0193"+
-    "\u0194\3\2\2\2\u0194\u0195\3\2\2\2\u0195\u0196\b\60\2\2\u0196`\3\2\2\2"+
-    "\u0197\u0198\7\61\2\2\u0198\u0199\7,\2\2\u0199\u019e\3\2\2\2\u019a\u019d"+
-    "\5a\61\2\u019b\u019d\13\2\2\2\u019c\u019a\3\2\2\2\u019c\u019b\3\2\2\2"+
-    "\u019d\u01a0\3\2\2\2\u019e\u019f\3\2\2\2\u019e\u019c\3\2\2\2\u019f\u01a1"+
-    "\3\2\2\2\u01a0\u019e\3\2\2\2\u01a1\u01a2\7,\2\2\u01a2\u01a3\7\61\2\2\u01a3"+
-    "\u01a4\3\2\2\2\u01a4\u01a5\b\61\2\2\u01a5b\3\2\2\2\u01a6\u01a8\t\16\2"+
-    "\2\u01a7\u01a6\3\2\2\2\u01a8\u01a9\3\2\2\2\u01a9\u01a7\3\2\2\2\u01a9\u01aa"+
-    "\3\2\2\2\u01aa\u01ab\3\2\2\2\u01ab\u01ac\b\62\2\2\u01acd\3\2\2\2\'\2\u00e8"+
-    "\u00ea\u00f2\u00f4\u00fe\u0100\u010a\u010c\u0117\u011f\u0122\u0124\u0129"+
-    "\u012e\u0134\u013b\u0140\u0146\u0149\u0151\u0155\u0159\u015e\u0160\u0167"+
-    "\u0169\u0172\u0174\u017b\u0180\u018c\u0190\u0193\u019c\u019e\u01a9\3\2"+
-    "\3\2";
+    "+\4,\t,\4-\t-\4.\t.\4/\t/\4\60\t\60\4\61\t\61\4\62\t\62\4\63\t\63\4\64"+
+    "\t\64\4\65\t\65\4\66\t\66\3\2\3\2\3\2\3\2\3\3\3\3\3\3\3\3\3\4\3\4\3\4"+
+    "\3\5\3\5\3\5\3\5\3\5\3\5\3\6\3\6\3\6\3\7\3\7\3\7\3\7\3\b\3\b\3\b\3\b\3"+
+    "\b\3\t\3\t\3\t\3\t\3\t\3\n\3\n\3\n\3\n\3\n\3\n\3\13\3\13\3\13\3\13\3\13"+
+    "\3\13\3\13\3\13\3\f\3\f\3\f\3\f\3\r\3\r\3\r\3\r\3\r\3\16\3\16\3\16\3\17"+
+    "\3\17\3\17\3\20\3\20\3\20\3\20\3\20\3\20\3\21\3\21\3\21\3\21\3\21\3\21"+
+    "\3\21\3\22\3\22\3\22\3\22\3\22\3\22\3\22\3\22\3\22\3\23\3\23\3\23\3\23"+
+    "\3\23\3\24\3\24\3\24\3\24\3\24\3\24\3\25\3\25\3\25\3\25\3\25\3\25\3\26"+
+    "\3\26\3\26\3\26\3\26\3\27\3\27\3\30\3\30\3\31\3\31\3\31\3\32\3\32\3\32"+
+    "\3\33\3\33\3\34\3\34\3\34\3\35\3\35\3\36\3\36\3\36\3\37\3\37\3 \3 \3!"+
+    "\3!\3\"\3\"\3#\3#\3$\3$\3%\3%\3&\3&\3\'\3\'\3(\3(\3)\3)\3*\3*\3+\3+\3"+
+    "+\3+\7+\u0109\n+\f+\16+\u010c\13+\3+\3+\3+\3+\3+\7+\u0113\n+\f+\16+\u0116"+
+    "\13+\3+\3+\3+\3+\3+\3+\3+\7+\u011f\n+\f+\16+\u0122\13+\3+\3+\3+\3+\3+"+
+    "\3+\3+\7+\u012b\n+\f+\16+\u012e\13+\3+\3+\3+\3+\3+\3+\7+\u0136\n+\f+\16"+
+    "+\u0139\13+\3+\3+\3+\3+\3+\5+\u0140\n+\3+\5+\u0143\n+\5+\u0145\n+\3,\6"+
+    ",\u0148\n,\r,\16,\u0149\3-\6-\u014d\n-\r-\16-\u014e\3-\3-\7-\u0153\n-"+
+    "\f-\16-\u0156\13-\3-\3-\6-\u015a\n-\r-\16-\u015b\3-\6-\u015f\n-\r-\16"+
+    "-\u0160\3-\3-\7-\u0165\n-\f-\16-\u0168\13-\5-\u016a\n-\3-\3-\3-\3-\6-"+
+    "\u0170\n-\r-\16-\u0171\3-\3-\5-\u0176\n-\3.\3.\5.\u017a\n.\3.\3.\3.\7"+
+    ".\u017f\n.\f.\16.\u0182\13.\3/\3/\3/\3/\7/\u0188\n/\f/\16/\u018b\13/\3"+
+    "/\3/\3\60\3\60\3\60\3\60\7\60\u0193\n\60\f\60\16\60\u0196\13\60\3\60\3"+
+    "\60\3\61\3\61\5\61\u019c\n\61\3\61\6\61\u019f\n\61\r\61\16\61\u01a0\3"+
+    "\62\3\62\3\63\3\63\3\64\3\64\3\64\3\64\7\64\u01ab\n\64\f\64\16\64\u01ae"+
+    "\13\64\3\64\5\64\u01b1\n\64\3\64\5\64\u01b4\n\64\3\64\3\64\3\65\3\65\3"+
+    "\65\3\65\3\65\7\65\u01bd\n\65\f\65\16\65\u01c0\13\65\3\65\3\65\3\65\3"+
+    "\65\3\65\3\66\6\66\u01c8\n\66\r\66\16\66\u01c9\3\66\3\66\4\u0137\u01be"+
+    "\2\67\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f\27\r\31\16\33\17\35"+
+    "\20\37\21!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63\33\65\34\67\359\36"+
+    ";\37= ?!A\"C#E$G%I&K\'M(O)Q*S+U,W-Y.[/]\60_\61a\2c\2e\2g\62i\63k\64\3"+
+    "\2\17\n\2$$))^^ddhhppttvv\6\2\f\f\17\17))^^\6\2\f\f\17\17$$^^\5\2\f\f"+
+    "\17\17$$\5\2\f\f\17\17))\4\2\f\f\17\17\4\2BBaa\3\2bb\4\2GGgg\4\2--//\3"+
+    "\2\62;\4\2C\\c|\5\2\13\f\17\17\"\"\u01f4\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3"+
+    "\2\2\2\2\t\3\2\2\2\2\13\3\2\2\2\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3\2\2\2"+
+    "\2\23\3\2\2\2\2\25\3\2\2\2\2\27\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2\2\2\35"+
+    "\3\2\2\2\2\37\3\2\2\2\2!\3\2\2\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2\2\2\2)"+
+    "\3\2\2\2\2+\3\2\2\2\2-\3\2\2\2\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2\2\2\2"+
+    "\65\3\2\2\2\2\67\3\2\2\2\29\3\2\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2\2\2\2"+
+    "A\3\2\2\2\2C\3\2\2\2\2E\3\2\2\2\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2\2M\3"+
+    "\2\2\2\2O\3\2\2\2\2Q\3\2\2\2\2S\3\2\2\2\2U\3\2\2\2\2W\3\2\2\2\2Y\3\2\2"+
+    "\2\2[\3\2\2\2\2]\3\2\2\2\2_\3\2\2\2\2g\3\2\2\2\2i\3\2\2\2\2k\3\2\2\2\3"+
+    "m\3\2\2\2\5q\3\2\2\2\7u\3\2\2\2\tx\3\2\2\2\13~\3\2\2\2\r\u0081\3\2\2\2"+
+    "\17\u0085\3\2\2\2\21\u008a\3\2\2\2\23\u008f\3\2\2\2\25\u0095\3\2\2\2\27"+
+    "\u009d\3\2\2\2\31\u00a1\3\2\2\2\33\u00a6\3\2\2\2\35\u00a9\3\2\2\2\37\u00ac"+
+    "\3\2\2\2!\u00b2\3\2\2\2#\u00b9\3\2\2\2%\u00c2\3\2\2\2\'\u00c7\3\2\2\2"+
+    ")\u00cd\3\2\2\2+\u00d3\3\2\2\2-\u00d8\3\2\2\2/\u00da\3\2\2\2\61\u00dc"+
+    "\3\2\2\2\63\u00df\3\2\2\2\65\u00e2\3\2\2\2\67\u00e4\3\2\2\29\u00e7\3\2"+
+    "\2\2;\u00e9\3\2\2\2=\u00ec\3\2\2\2?\u00ee\3\2\2\2A\u00f0\3\2\2\2C\u00f2"+
+    "\3\2\2\2E\u00f4\3\2\2\2G\u00f6\3\2\2\2I\u00f8\3\2\2\2K\u00fa\3\2\2\2M"+
+    "\u00fc\3\2\2\2O\u00fe\3\2\2\2Q\u0100\3\2\2\2S\u0102\3\2\2\2U\u0144\3\2"+
+    "\2\2W\u0147\3\2\2\2Y\u0175\3\2\2\2[\u0179\3\2\2\2]\u0183\3\2\2\2_\u018e"+
+    "\3\2\2\2a\u0199\3\2\2\2c\u01a2\3\2\2\2e\u01a4\3\2\2\2g\u01a6\3\2\2\2i"+
+    "\u01b7\3\2\2\2k\u01c7\3\2\2\2mn\7c\2\2no\7p\2\2op\7f\2\2p\4\3\2\2\2qr"+
+    "\7c\2\2rs\7p\2\2st\7{\2\2t\6\3\2\2\2uv\7d\2\2vw\7{\2\2w\b\3\2\2\2xy\7"+
+    "h\2\2yz\7c\2\2z{\7n\2\2{|\7u\2\2|}\7g\2\2}\n\3\2\2\2~\177\7k\2\2\177\u0080"+
+    "\7p\2\2\u0080\f\3\2\2\2\u0081\u0082\7k\2\2\u0082\u0083\7p\2\2\u0083\u0084"+
+    "\7\u0080\2\2\u0084\16\3\2\2\2\u0085\u0086\7l\2\2\u0086\u0087\7q\2\2\u0087"+
+    "\u0088\7k\2\2\u0088\u0089\7p\2\2\u0089\20\3\2\2\2\u008a\u008b\7n\2\2\u008b"+
+    "\u008c\7k\2\2\u008c\u008d\7m\2\2\u008d\u008e\7g\2\2\u008e\22\3\2\2\2\u008f"+
+    "\u0090\7n\2\2\u0090\u0091\7k\2\2\u0091\u0092\7m\2\2\u0092\u0093\7g\2\2"+
+    "\u0093\u0094\7\u0080\2\2\u0094\24\3\2\2\2\u0095\u0096\7o\2\2\u0096\u0097"+
+    "\7c\2\2\u0097\u0098\7z\2\2\u0098\u0099\7u\2\2\u0099\u009a\7r\2\2\u009a"+
+    "\u009b\7c\2\2\u009b\u009c\7p\2\2\u009c\26\3\2\2\2\u009d\u009e\7p\2\2\u009e"+
+    "\u009f\7q\2\2\u009f\u00a0\7v\2\2\u00a0\30\3\2\2\2\u00a1\u00a2\7p\2\2\u00a2"+
+    "\u00a3\7w\2\2\u00a3\u00a4\7n\2\2\u00a4\u00a5\7n\2\2\u00a5\32\3\2\2\2\u00a6"+
+    "\u00a7\7q\2\2\u00a7\u00a8\7h\2\2\u00a8\34\3\2\2\2\u00a9\u00aa\7q\2\2\u00aa"+
+    "\u00ab\7t\2\2\u00ab\36\3\2\2\2\u00ac\u00ad\7t\2\2\u00ad\u00ae\7g\2\2\u00ae"+
+    "\u00af\7i\2\2\u00af\u00b0\7g\2\2\u00b0\u00b1\7z\2\2\u00b1 \3\2\2\2\u00b2"+
+    "\u00b3\7t\2\2\u00b3\u00b4\7g\2\2\u00b4\u00b5\7i\2\2\u00b5\u00b6\7g\2\2"+
+    "\u00b6\u00b7\7z\2\2\u00b7\u00b8\7\u0080\2\2\u00b8\"\3\2\2\2\u00b9\u00ba"+
+    "\7u\2\2\u00ba\u00bb\7g\2\2\u00bb\u00bc\7s\2\2\u00bc\u00bd\7w\2\2\u00bd"+
+    "\u00be\7g\2\2\u00be\u00bf\7p\2\2\u00bf\u00c0\7e\2\2\u00c0\u00c1\7g\2\2"+
+    "\u00c1$\3\2\2\2\u00c2\u00c3\7v\2\2\u00c3\u00c4\7t\2\2\u00c4\u00c5\7w\2"+
+    "\2\u00c5\u00c6\7g\2\2\u00c6&\3\2\2\2\u00c7\u00c8\7w\2\2\u00c8\u00c9\7"+
+    "p\2\2\u00c9\u00ca\7v\2\2\u00ca\u00cb\7k\2\2\u00cb\u00cc\7n\2\2\u00cc("+
+    "\3\2\2\2\u00cd\u00ce\7y\2\2\u00ce\u00cf\7j\2\2\u00cf\u00d0\7g\2\2\u00d0"+
+    "\u00d1\7t\2\2\u00d1\u00d2\7g\2\2\u00d2*\3\2\2\2\u00d3\u00d4\7y\2\2\u00d4"+
+    "\u00d5\7k\2\2\u00d5\u00d6\7v\2\2\u00d6\u00d7\7j\2\2\u00d7,\3\2\2\2\u00d8"+
+    "\u00d9\7<\2\2\u00d9.\3\2\2\2\u00da\u00db\7?\2\2\u00db\60\3\2\2\2\u00dc"+
+    "\u00dd\7?\2\2\u00dd\u00de\7?\2\2\u00de\62\3\2\2\2\u00df\u00e0\7#\2\2\u00e0"+
+    "\u00e1\7?\2\2\u00e1\64\3\2\2\2\u00e2\u00e3\7>\2\2\u00e3\66\3\2\2\2\u00e4"+
+    "\u00e5\7>\2\2\u00e5\u00e6\7?\2\2\u00e68\3\2\2\2\u00e7\u00e8\7@\2\2\u00e8"+
+    ":\3\2\2\2\u00e9\u00ea\7@\2\2\u00ea\u00eb\7?\2\2\u00eb<\3\2\2\2\u00ec\u00ed"+
+    "\7-\2\2\u00ed>\3\2\2\2\u00ee\u00ef\7/\2\2\u00ef@\3\2\2\2\u00f0\u00f1\7"+
+    ",\2\2\u00f1B\3\2\2\2\u00f2\u00f3\7\61\2\2\u00f3D\3\2\2\2\u00f4\u00f5\7"+
+    "\'\2\2\u00f5F\3\2\2\2\u00f6\u00f7\7\60\2\2\u00f7H\3\2\2\2\u00f8\u00f9"+
+    "\7.\2\2\u00f9J\3\2\2\2\u00fa\u00fb\7]\2\2\u00fbL\3\2\2\2\u00fc\u00fd\7"+
+    "_\2\2\u00fdN\3\2\2\2\u00fe\u00ff\7*\2\2\u00ffP\3\2\2\2\u0100\u0101\7+"+
+    "\2\2\u0101R\3\2\2\2\u0102\u0103\7~\2\2\u0103T\3\2\2\2\u0104\u010a\7)\2"+
+    "\2\u0105\u0106\7^\2\2\u0106\u0109\t\2\2\2\u0107\u0109\n\3\2\2\u0108\u0105"+
+    "\3\2\2\2\u0108\u0107\3\2\2\2\u0109\u010c\3\2\2\2\u010a\u0108\3\2\2\2\u010a"+
+    "\u010b\3\2\2\2\u010b\u010d\3\2\2\2\u010c\u010a\3\2\2\2\u010d\u0145\7)"+
+    "\2\2\u010e\u0114\7$\2\2\u010f\u0110\7^\2\2\u0110\u0113\t\2\2\2\u0111\u0113"+
+    "\n\4\2\2\u0112\u010f\3\2\2\2\u0112\u0111\3\2\2\2\u0113\u0116\3\2\2\2\u0114"+
+    "\u0112\3\2\2\2\u0114\u0115\3\2\2\2\u0115\u0117\3\2\2\2\u0116\u0114\3\2"+
+    "\2\2\u0117\u0145\7$\2\2\u0118\u0119\7A\2\2\u0119\u011a\7$\2\2\u011a\u0120"+
+    "\3\2\2\2\u011b\u011c\7^\2\2\u011c\u011f\7$\2\2\u011d\u011f\n\5\2\2\u011e"+
+    "\u011b\3\2\2\2\u011e\u011d\3\2\2\2\u011f\u0122\3\2\2\2\u0120\u011e\3\2"+
+    "\2\2\u0120\u0121\3\2\2\2\u0121\u0123\3\2\2\2\u0122\u0120\3\2\2\2\u0123"+
+    "\u0145\7$\2\2\u0124\u0125\7A\2\2\u0125\u0126\7)\2\2\u0126\u012c\3\2\2"+
+    "\2\u0127\u0128\7^\2\2\u0128\u012b\7)\2\2\u0129\u012b\n\6\2\2\u012a\u0127"+
+    "\3\2\2\2\u012a\u0129\3\2\2\2\u012b\u012e\3\2\2\2\u012c\u012a\3\2\2\2\u012c"+
+    "\u012d\3\2\2\2\u012d\u012f\3\2\2\2\u012e\u012c\3\2\2\2\u012f\u0145\7)"+
+    "\2\2\u0130\u0131\7$\2\2\u0131\u0132\7$\2\2\u0132\u0133\7$\2\2\u0133\u0137"+
+    "\3\2\2\2\u0134\u0136\n\7\2\2\u0135\u0134\3\2\2\2\u0136\u0139\3\2\2\2\u0137"+
+    "\u0138\3\2\2\2\u0137\u0135\3\2\2\2\u0138\u013a\3\2\2\2\u0139\u0137\3\2"+
+    "\2\2\u013a\u013b\7$\2\2\u013b\u013c\7$\2\2\u013c\u013d\7$\2\2\u013d\u013f"+
+    "\3\2\2\2\u013e\u0140\7$\2\2\u013f\u013e\3\2\2\2\u013f\u0140\3\2\2\2\u0140"+
+    "\u0142\3\2\2\2\u0141\u0143\7$\2\2\u0142\u0141\3\2\2\2\u0142\u0143\3\2"+
+    "\2\2\u0143\u0145\3\2\2\2\u0144\u0104\3\2\2\2\u0144\u010e\3\2\2\2\u0144"+
+    "\u0118\3\2\2\2\u0144\u0124\3\2\2\2\u0144\u0130\3\2\2\2\u0145V\3\2\2\2"+
+    "\u0146\u0148\5c\62\2\u0147\u0146\3\2\2\2\u0148\u0149\3\2\2\2\u0149\u0147"+
+    "\3\2\2\2\u0149\u014a\3\2\2\2\u014aX\3\2\2\2\u014b\u014d\5c\62\2\u014c"+
+    "\u014b\3\2\2\2\u014d\u014e\3\2\2\2\u014e\u014c\3\2\2\2\u014e\u014f\3\2"+
+    "\2\2\u014f\u0150\3\2\2\2\u0150\u0154\5G$\2\u0151\u0153\5c\62\2\u0152\u0151"+
+    "\3\2\2\2\u0153\u0156\3\2\2\2\u0154\u0152\3\2\2\2\u0154\u0155\3\2\2\2\u0155"+
+    "\u0176\3\2\2\2\u0156\u0154\3\2\2\2\u0157\u0159\5G$\2\u0158\u015a\5c\62"+
+    "\2\u0159\u0158\3\2\2\2\u015a\u015b\3\2\2\2\u015b\u0159\3\2\2\2\u015b\u015c"+
+    "\3\2\2\2\u015c\u0176\3\2\2\2\u015d\u015f\5c\62\2\u015e\u015d\3\2\2\2\u015f"+
+    "\u0160\3\2\2\2\u0160\u015e\3\2\2\2\u0160\u0161\3\2\2\2\u0161\u0169\3\2"+
+    "\2\2\u0162\u0166\5G$\2\u0163\u0165\5c\62\2\u0164\u0163\3\2\2\2\u0165\u0168"+
+    "\3\2\2\2\u0166\u0164\3\2\2\2\u0166\u0167\3\2\2\2\u0167\u016a\3\2\2\2\u0168"+
+    "\u0166\3\2\2\2\u0169\u0162\3\2\2\2\u0169\u016a\3\2\2\2\u016a\u016b\3\2"+
+    "\2\2\u016b\u016c\5a\61\2\u016c\u0176\3\2\2\2\u016d\u016f\5G$\2\u016e\u0170"+
+    "\5c\62\2\u016f\u016e\3\2\2\2\u0170\u0171\3\2\2\2\u0171\u016f\3\2\2\2\u0171"+
+    "\u0172\3\2\2\2\u0172\u0173\3\2\2\2\u0173\u0174\5a\61\2\u0174\u0176\3\2"+
+    "\2\2\u0175\u014c\3\2\2\2\u0175\u0157\3\2\2\2\u0175\u015e\3\2\2\2\u0175"+
+    "\u016d\3\2\2\2\u0176Z\3\2\2\2\u0177\u017a\5e\63\2\u0178\u017a\t\b\2\2"+
+    "\u0179\u0177\3\2\2\2\u0179\u0178\3\2\2\2\u017a\u0180\3\2\2\2\u017b\u017f"+
+    "\5e\63\2\u017c\u017f\5c\62\2\u017d\u017f\7a\2\2\u017e\u017b\3\2\2\2\u017e"+
+    "\u017c\3\2\2\2\u017e\u017d\3\2\2\2\u017f\u0182\3\2\2\2\u0180\u017e\3\2"+
+    "\2\2\u0180\u0181\3\2\2\2\u0181\\\3\2\2\2\u0182\u0180\3\2\2\2\u0183\u0189"+
+    "\7b\2\2\u0184\u0188\n\t\2\2\u0185\u0186\7b\2\2\u0186\u0188\7b\2\2\u0187"+
+    "\u0184\3\2\2\2\u0187\u0185\3\2\2\2\u0188\u018b\3\2\2\2\u0189\u0187\3\2"+
+    "\2\2\u0189\u018a\3\2\2\2\u018a\u018c\3\2\2\2\u018b\u0189\3\2\2\2\u018c"+
+    "\u018d\7b\2\2\u018d^\3\2\2\2\u018e\u0194\5e\63\2\u018f\u0193\5e\63\2\u0190"+
+    "\u0193\5c\62\2\u0191\u0193\7a\2\2\u0192\u018f\3\2\2\2\u0192\u0190\3\2"+
+    "\2\2\u0192\u0191\3\2\2\2\u0193\u0196\3\2\2\2\u0194\u0192\3\2\2\2\u0194"+
+    "\u0195\3\2\2\2\u0195\u0197\3\2\2\2\u0196\u0194\3\2\2\2\u0197\u0198\7\u0080"+
+    "\2\2\u0198`\3\2\2\2\u0199\u019b\t\n\2\2\u019a\u019c\t\13\2\2\u019b\u019a"+
+    "\3\2\2\2\u019b\u019c\3\2\2\2\u019c\u019e\3\2\2\2\u019d\u019f\5c\62\2\u019e"+
+    "\u019d\3\2\2\2\u019f\u01a0\3\2\2\2\u01a0\u019e\3\2\2\2\u01a0\u01a1\3\2"+
+    "\2\2\u01a1b\3\2\2\2\u01a2\u01a3\t\f\2\2\u01a3d\3\2\2\2\u01a4\u01a5\t\r"+
+    "\2\2\u01a5f\3\2\2\2\u01a6\u01a7\7\61\2\2\u01a7\u01a8\7\61\2\2\u01a8\u01ac"+
+    "\3\2\2\2\u01a9\u01ab\n\7\2\2\u01aa\u01a9\3\2\2\2\u01ab\u01ae\3\2\2\2\u01ac"+
+    "\u01aa\3\2\2\2\u01ac\u01ad\3\2\2\2\u01ad\u01b0\3\2\2\2\u01ae\u01ac\3\2"+
+    "\2\2\u01af\u01b1\7\17\2\2\u01b0\u01af\3\2\2\2\u01b0\u01b1\3\2\2\2\u01b1"+
+    "\u01b3\3\2\2\2\u01b2\u01b4\7\f\2\2\u01b3\u01b2\3\2\2\2\u01b3\u01b4\3\2"+
+    "\2\2\u01b4\u01b5\3\2\2\2\u01b5\u01b6\b\64\2\2\u01b6h\3\2\2\2\u01b7\u01b8"+
+    "\7\61\2\2\u01b8\u01b9\7,\2\2\u01b9\u01be\3\2\2\2\u01ba\u01bd\5i\65\2\u01bb"+
+    "\u01bd\13\2\2\2\u01bc\u01ba\3\2\2\2\u01bc\u01bb\3\2\2\2\u01bd\u01c0\3"+
+    "\2\2\2\u01be\u01bf\3\2\2\2\u01be\u01bc\3\2\2\2\u01bf\u01c1\3\2\2\2\u01c0"+
+    "\u01be\3\2\2\2\u01c1\u01c2\7,\2\2\u01c2\u01c3\7\61\2\2\u01c3\u01c4\3\2"+
+    "\2\2\u01c4\u01c5\b\65\2\2\u01c5j\3\2\2\2\u01c6\u01c8\t\16\2\2\u01c7\u01c6"+
+    "\3\2\2\2\u01c8\u01c9\3\2\2\2\u01c9\u01c7\3\2\2\2\u01c9\u01ca\3\2\2\2\u01ca"+
+    "\u01cb\3\2\2\2\u01cb\u01cc\b\66\2\2\u01ccl\3\2\2\2\'\2\u0108\u010a\u0112"+
+    "\u0114\u011e\u0120\u012a\u012c\u0137\u013f\u0142\u0144\u0149\u014e\u0154"+
+    "\u015b\u0160\u0166\u0169\u0171\u0175\u0179\u017e\u0180\u0187\u0189\u0192"+
+    "\u0194\u019b\u01a0\u01ac\u01b0\u01b3\u01bc\u01be\u01c9\3\2\3\2";
   public static final ATN _ATN =
     new ATNDeserializer().deserialize(_serializedATN.toCharArray());
   static {

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseParser.java

@@ -1,13 +1,27 @@
 // ANTLR GENERATED CODE: DO NOT EDIT
 package org.elasticsearch.xpack.eql.parser;
-import org.antlr.v4.runtime.atn.*;
+
+import org.antlr.v4.runtime.FailedPredicateException;
+import org.antlr.v4.runtime.NoViableAltException;
+import org.antlr.v4.runtime.Parser;
+import org.antlr.v4.runtime.ParserRuleContext;
+import org.antlr.v4.runtime.RecognitionException;
+import org.antlr.v4.runtime.RuleContext;
+import org.antlr.v4.runtime.RuntimeMetaData;
+import org.antlr.v4.runtime.Token;
+import org.antlr.v4.runtime.TokenStream;
+import org.antlr.v4.runtime.Vocabulary;
+import org.antlr.v4.runtime.VocabularyImpl;
+import org.antlr.v4.runtime.atn.ATN;
+import org.antlr.v4.runtime.atn.ATNDeserializer;
+import org.antlr.v4.runtime.atn.ParserATNSimulator;
+import org.antlr.v4.runtime.atn.PredictionContextCache;
 import org.antlr.v4.runtime.dfa.DFA;
-import org.antlr.v4.runtime.*;
-import org.antlr.v4.runtime.misc.*;
-import org.antlr.v4.runtime.tree.*;
+import org.antlr.v4.runtime.tree.ParseTreeListener;
+import org.antlr.v4.runtime.tree.ParseTreeVisitor;
+import org.antlr.v4.runtime.tree.TerminalNode;
+
 import java.util.List;
-import java.util.Iterator;
-import java.util.ArrayList;
 
 @SuppressWarnings({"all", "warnings", "unchecked", "unused", "cast"})
 class EqlBaseParser extends Parser {
@@ -17,46 +31,119 @@ class EqlBaseParser extends Parser {
   protected static final PredictionContextCache _sharedContextCache =
     new PredictionContextCache();
   public static final int
-    AND=1, ANY=2, BY=3, FALSE=4, IN=5, IN_INSENSITIVE=6, JOIN=7, MAXSPAN=8, 
-    NOT=9, NULL=10, OF=11, OR=12, SEQUENCE=13, TRUE=14, UNTIL=15, WHERE=16, 
-    WITH=17, SEQ=18, ASGN=19, EQ=20, NEQ=21, LT=22, LTE=23, GT=24, GTE=25, 
-    PLUS=26, MINUS=27, ASTERISK=28, SLASH=29, PERCENT=30, DOT=31, COMMA=32, 
-    LB=33, RB=34, LP=35, RP=36, PIPE=37, STRING=38, INTEGER_VALUE=39, DECIMAL_VALUE=40, 
-    IDENTIFIER=41, QUOTED_IDENTIFIER=42, TILDE_IDENTIFIER=43, LINE_COMMENT=44, 
-    BRACKETED_COMMENT=45, WS=46;
+  AND = 1, ANY = 2, BY = 3, FALSE = 4, IN = 5, IN_INSENSITIVE = 6, JOIN = 7, LIKE = 8, LIKE_INSENSITIVE = 9, MAXSPAN = 10, NOT = 11, NULL =
+      12, OF = 13, OR = 14, REGEX = 15, REGEX_INSENSITIVE = 16, SEQUENCE = 17, TRUE = 18, UNTIL = 19, WHERE = 20, WITH = 21, SEQ = 22,
+      ASGN = 23, EQ = 24, NEQ = 25, LT = 26, LTE = 27, GT = 28, GTE = 29, PLUS = 30, MINUS = 31, ASTERISK = 32, SLASH = 33, PERCENT = 34,
+      DOT = 35, COMMA = 36, LB = 37, RB = 38, LP = 39, RP = 40, PIPE = 41, STRING = 42, INTEGER_VALUE = 43, DECIMAL_VALUE = 44, IDENTIFIER =
+          45, QUOTED_IDENTIFIER = 46, TILDE_IDENTIFIER = 47, LINE_COMMENT = 48, BRACKETED_COMMENT = 49, WS = 50;
   public static final int
-    RULE_singleStatement = 0, RULE_singleExpression = 1, RULE_statement = 2, 
-    RULE_query = 3, RULE_sequenceParams = 4, RULE_sequence = 5, RULE_join = 6, 
-    RULE_pipe = 7, RULE_joinKeys = 8, RULE_joinTerm = 9, RULE_sequenceTerm = 10, 
-    RULE_subquery = 11, RULE_eventQuery = 12, RULE_eventFilter = 13, RULE_expression = 14, 
-    RULE_booleanExpression = 15, RULE_valueExpression = 16, RULE_operatorExpression = 17, 
-    RULE_predicate = 18, RULE_primaryExpression = 19, RULE_functionExpression = 20, 
-    RULE_functionName = 21, RULE_constant = 22, RULE_comparisonOperator = 23, 
-    RULE_booleanValue = 24, RULE_qualifiedName = 25, RULE_identifier = 26, 
+    RULE_singleStatement = 0, RULE_singleExpression = 1, RULE_statement = 2,
+    RULE_query = 3, RULE_sequenceParams = 4, RULE_sequence = 5, RULE_join = 6,
+    RULE_pipe = 7, RULE_joinKeys = 8, RULE_joinTerm = 9, RULE_sequenceTerm = 10,
+    RULE_subquery = 11, RULE_eventQuery = 12, RULE_eventFilter = 13, RULE_expression = 14,
+    RULE_booleanExpression = 15, RULE_valueExpression = 16, RULE_operatorExpression = 17,
+    RULE_predicate = 18, RULE_primaryExpression = 19, RULE_functionExpression = 20,
+    RULE_functionName = 21, RULE_constant = 22, RULE_comparisonOperator = 23,
+    RULE_booleanValue = 24, RULE_qualifiedName = 25, RULE_identifier = 26,
     RULE_timeUnit = 27, RULE_number = 28, RULE_string = 29, RULE_eventValue = 30;
   public static final String[] ruleNames = {
-    "singleStatement", "singleExpression", "statement", "query", "sequenceParams", 
-    "sequence", "join", "pipe", "joinKeys", "joinTerm", "sequenceTerm", "subquery", 
-    "eventQuery", "eventFilter", "expression", "booleanExpression", "valueExpression", 
-    "operatorExpression", "predicate", "primaryExpression", "functionExpression", 
-    "functionName", "constant", "comparisonOperator", "booleanValue", "qualifiedName", 
+    "singleStatement", "singleExpression", "statement", "query", "sequenceParams",
+    "sequence", "join", "pipe", "joinKeys", "joinTerm", "sequenceTerm", "subquery",
+    "eventQuery", "eventFilter", "expression", "booleanExpression", "valueExpression",
+    "operatorExpression", "predicate", "primaryExpression", "functionExpression",
+    "functionName", "constant", "comparisonOperator", "booleanValue", "qualifiedName",
     "identifier", "timeUnit", "number", "string", "eventValue"
   };
 
   private static final String[] _LITERAL_NAMES = {
-    null, "'and'", "'any'", "'by'", "'false'", "'in'", "'in~'", "'join'", 
-    "'maxspan'", "'not'", "'null'", "'of'", "'or'", "'sequence'", "'true'", 
-    "'until'", "'where'", "'with'", "':'", "'='", "'=='", "'!='", "'<'", "'<='", 
-    "'>'", "'>='", "'+'", "'-'", "'*'", "'/'", "'%'", "'.'", "','", "'['", 
-    "']'", "'('", "')'", "'|'"
+    null, "'and'", "'any'", "'by'", "'false'", "'in'", "'in~'", "'join'",
+      "'like'",
+      "'like~'",
+      "'maxspan'",
+      "'not'",
+      "'null'",
+      "'of'",
+      "'or'",
+      "'regex'",
+      "'regex~'",
+      "'sequence'",
+      "'true'",
+      "'until'",
+      "'where'",
+      "'with'",
+      "':'",
+      "'='",
+      "'=='",
+      "'!='",
+      "'<'",
+      "'<='",
+      "'>'",
+      "'>='",
+      "'+'",
+      "'-'",
+      "'*'",
+      "'/'",
+      "'%'",
+      "'.'",
+      "','",
+      "'['",
+      "']'",
+      "'('",
+      "')'",
+      "'|'"
   };
   private static final String[] _SYMBOLIC_NAMES = {
-    null, "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "MAXSPAN", 
-    "NOT", "NULL", "OF", "OR", "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", 
-    "SEQ", "ASGN", "EQ", "NEQ", "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", 
-    "ASTERISK", "SLASH", "PERCENT", "DOT", "COMMA", "LB", "RB", "LP", "RP", 
-    "PIPE", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", 
-    "TILDE_IDENTIFIER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
+      null,
+      "AND",
+      "ANY",
+      "BY",
+      "FALSE",
+      "IN",
+      "IN_INSENSITIVE",
+      "JOIN",
+      "LIKE",
+      "LIKE_INSENSITIVE",
+      "MAXSPAN",
+      "NOT",
+      "NULL",
+      "OF",
+      "OR",
+      "REGEX",
+      "REGEX_INSENSITIVE",
+      "SEQUENCE",
+      "TRUE",
+      "UNTIL",
+      "WHERE",
+      "WITH",
+      "SEQ",
+      "ASGN",
+      "EQ",
+      "NEQ",
+      "LT",
+      "LTE",
+      "GT",
+      "GTE",
+      "PLUS",
+      "MINUS",
+      "ASTERISK",
+      "SLASH",
+      "PERCENT",
+      "DOT",
+      "COMMA",
+      "LB",
+      "RB",
+      "LP",
+      "RP",
+      "PIPE",
+      "STRING",
+      "INTEGER_VALUE",
+      "DECIMAL_VALUE",
+      "IDENTIFIER",
+      "QUOTED_IDENTIFIER",
+      "TILDE_IDENTIFIER",
+      "LINE_COMMENT",
+      "BRACKETED_COMMENT",
+      "WS"
   };
   public static final Vocabulary VOCABULARY = new VocabularyImpl(_LITERAL_NAMES, _SYMBOLIC_NAMES);
 
@@ -479,7 +566,7 @@ class EqlBaseParser extends Parser {
       }
       setState(96);
       sequenceTerm();
-      setState(98); 
+      setState(98);
       _errHandler.sync(this);
       _la = _input.LA(1);
       do {
@@ -489,7 +576,7 @@ class EqlBaseParser extends Parser {
         sequenceTerm();
         }
         }
-        setState(100); 
+        setState(100);
         _errHandler.sync(this);
         _la = _input.LA(1);
       } while ( _la==LB );
@@ -570,7 +657,7 @@ class EqlBaseParser extends Parser {
 
       setState(110);
       joinTerm();
-      setState(112); 
+      setState(112);
       _errHandler.sync(this);
       _la = _input.LA(1);
       do {
@@ -580,7 +667,7 @@ class EqlBaseParser extends Parser {
         joinTerm();
         }
         }
-        setState(114); 
+        setState(114);
         _errHandler.sync(this);
         _la = _input.LA(1);
       } while ( _la==LB );
@@ -1090,7 +1177,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_booleanExpression; }
-   
+
     public BooleanExpressionContext() { }
     public void copyFrom(BooleanExpressionContext ctx) {
       super.copyFrom(ctx);
@@ -1277,7 +1364,7 @@ class EqlBaseParser extends Parser {
             }
             break;
           }
-          } 
+          }
         }
         setState(183);
         _errHandler.sync(this);
@@ -1301,7 +1388,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_valueExpression; }
-   
+
     public ValueExpressionContext() { }
     public void copyFrom(ValueExpressionContext ctx) {
       super.copyFrom(ctx);
@@ -1399,7 +1486,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_operatorExpression; }
-   
+
     public OperatorExpressionContext() { }
     public void copyFrom(OperatorExpressionContext ctx) {
       super.copyFrom(ctx);
@@ -1599,7 +1686,7 @@ class EqlBaseParser extends Parser {
             }
             break;
           }
-          } 
+          }
         }
         setState(210);
         _errHandler.sync(this);
@@ -1642,6 +1729,22 @@ class EqlBaseParser extends Parser {
       return getRuleContext(ConstantContext.class,i);
     }
     public TerminalNode SEQ() { return getToken(EqlBaseParser.SEQ, 0); }
+
+    public TerminalNode LIKE() {
+        return getToken(EqlBaseParser.LIKE, 0);
+    }
+
+    public TerminalNode LIKE_INSENSITIVE() {
+        return getToken(EqlBaseParser.LIKE_INSENSITIVE, 0);
+    }
+
+    public TerminalNode REGEX() {
+        return getToken(EqlBaseParser.REGEX, 0);
+    }
+
+    public TerminalNode REGEX_INSENSITIVE() {
+        return getToken(EqlBaseParser.REGEX_INSENSITIVE, 0);
+    }
     public PredicateContext(ParserRuleContext parent, int invokingState) {
       super(parent, invokingState);
     }
@@ -1717,7 +1820,14 @@ class EqlBaseParser extends Parser {
         enterOuterAlt(_localctx, 2);
         {
         setState(226);
-        ((PredicateContext)_localctx).kind = match(SEQ);
+        ((PredicateContext) _localctx).kind = _input.LT(1);
+        _la = _input.LA(1);
+        if (!((((_la) & ~0x3f) == 0
+            && ((1L << _la) & ((1L << LIKE) | (1L << LIKE_INSENSITIVE) | (1L << REGEX) | (1L << REGEX_INSENSITIVE) | (1L << SEQ))) != 0))) {
+            ((PredicateContext) _localctx).kind = (Token) _errHandler.recoverInline(this);
+        } else {
+            consume();
+        }
         setState(227);
         constant();
         }
@@ -1726,7 +1836,14 @@ class EqlBaseParser extends Parser {
         enterOuterAlt(_localctx, 3);
         {
         setState(228);
-        ((PredicateContext)_localctx).kind = match(SEQ);
+        ((PredicateContext) _localctx).kind = _input.LT(1);
+        _la = _input.LA(1);
+        if (!((((_la) & ~0x3f) == 0
+            && ((1L << _la) & ((1L << LIKE) | (1L << LIKE_INSENSITIVE) | (1L << REGEX) | (1L << REGEX_INSENSITIVE) | (1L << SEQ))) != 0))) {
+            ((PredicateContext) _localctx).kind = (Token) _errHandler.recoverInline(this);
+        } else {
+            consume();
+        }
         setState(229);
         match(LP);
         setState(230);
@@ -1769,7 +1886,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_primaryExpression; }
-   
+
     public PrimaryExpressionContext() { }
     public void copyFrom(PrimaryExpressionContext ctx) {
       super.copyFrom(ctx);
@@ -2051,7 +2168,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_constant; }
-   
+
     public ConstantContext() { }
     public void copyFrom(ConstantContext ctx) {
       super.copyFrom(ctx);
@@ -2361,7 +2478,7 @@ class EqlBaseParser extends Parser {
             {
             setState(280);
             match(LB);
-            setState(282); 
+            setState(282);
             _errHandler.sync(this);
             _la = _input.LA(1);
             do {
@@ -2371,7 +2488,7 @@ class EqlBaseParser extends Parser {
               match(INTEGER_VALUE);
               }
               }
-              setState(284); 
+              setState(284);
               _errHandler.sync(this);
               _la = _input.LA(1);
             } while ( _la==INTEGER_VALUE );
@@ -2382,7 +2499,7 @@ class EqlBaseParser extends Parser {
           default:
             throw new NoViableAltException(this);
           }
-          } 
+          }
         }
         setState(291);
         _errHandler.sync(this);
@@ -2511,7 +2628,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_number; }
-   
+
     public NumberContext() { }
     public void copyFrom(NumberContext ctx) {
       super.copyFrom(ctx);
@@ -2709,7 +2826,8 @@ class EqlBaseParser extends Parser {
   }
 
   public static final String _serializedATN =
-    "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\3\60\u0135\4\2\t\2"+
+      "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\3\64\u0135\4\2\t\2"
+          +
     "\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4\13"+
     "\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22\t\22"+
     "\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31\t\31"+
@@ -2734,85 +2852,89 @@ class EqlBaseParser extends Parser {
     "\3\33\6\33\u011d\n\33\r\33\16\33\u011e\3\33\7\33\u0122\n\33\f\33\16\33"+
     "\u0125\13\33\3\34\3\34\3\35\3\35\5\35\u012b\n\35\3\36\3\36\5\36\u012f"+
     "\n\36\3\37\3\37\3 \3 \3 \2\4 $!\2\4\6\b\n\f\16\20\22\24\26\30\32\34\36"+
-    " \"$&(*,.\60\62\64\668:<>\2\n\3\2\34\35\3\2\36 \3\2\7\b\4\2++--\3\2\26"+
-    "\33\4\2\6\6\20\20\3\2+,\4\2((++\u0142\2@\3\2\2\2\4C\3\2\2\2\6F\3\2\2\2"+
-    "\bP\3\2\2\2\nR\3\2\2\2\fW\3\2\2\2\16l\3\2\2\2\20z\3\2\2\2\22\u0086\3\2"+
-    "\2\2\24\u008f\3\2\2\2\26\u0093\3\2\2\2\30\u0097\3\2\2\2\32\u009b\3\2\2"+
-    "\2\34\u009f\3\2\2\2\36\u00a4\3\2\2\2 \u00ad\3\2\2\2\"\u00bf\3\2\2\2$\u00c8"+
-    "\3\2\2\2&\u00f2\3\2\2\2(\u00fb\3\2\2\2*\u00fd\3\2\2\2,\u010b\3\2\2\2."+
-    "\u0111\3\2\2\2\60\u0113\3\2\2\2\62\u0115\3\2\2\2\64\u0117\3\2\2\2\66\u0126"+
-    "\3\2\2\28\u0128\3\2\2\2:\u012e\3\2\2\2<\u0130\3\2\2\2>\u0132\3\2\2\2@"+
-    "A\5\6\4\2AB\7\2\2\3B\3\3\2\2\2CD\5\36\20\2DE\7\2\2\3E\5\3\2\2\2FJ\5\b"+
-    "\5\2GI\5\20\t\2HG\3\2\2\2IL\3\2\2\2JH\3\2\2\2JK\3\2\2\2K\7\3\2\2\2LJ\3"+
-    "\2\2\2MQ\5\f\7\2NQ\5\16\b\2OQ\5\32\16\2PM\3\2\2\2PN\3\2\2\2PO\3\2\2\2"+
-    "Q\t\3\2\2\2RS\7\23\2\2ST\7\n\2\2TU\7\25\2\2UV\58\35\2V\13\3\2\2\2W`\7"+
-    "\17\2\2XZ\5\22\n\2Y[\5\n\6\2ZY\3\2\2\2Z[\3\2\2\2[a\3\2\2\2\\^\5\n\6\2"+
-    "]_\5\22\n\2^]\3\2\2\2^_\3\2\2\2_a\3\2\2\2`X\3\2\2\2`\\\3\2\2\2`a\3\2\2"+
-    "\2ab\3\2\2\2bd\5\26\f\2ce\5\26\f\2dc\3\2\2\2ef\3\2\2\2fd\3\2\2\2fg\3\2"+
-    "\2\2gj\3\2\2\2hi\7\21\2\2ik\5\26\f\2jh\3\2\2\2jk\3\2\2\2k\r\3\2\2\2ln"+
-    "\7\t\2\2mo\5\22\n\2nm\3\2\2\2no\3\2\2\2op\3\2\2\2pr\5\24\13\2qs\5\24\13"+
-    "\2rq\3\2\2\2st\3\2\2\2tr\3\2\2\2tu\3\2\2\2ux\3\2\2\2vw\7\21\2\2wy\5\24"+
-    "\13\2xv\3\2\2\2xy\3\2\2\2y\17\3\2\2\2z{\7\'\2\2{\u0084\7+\2\2|\u0081\5"+
-    " \21\2}~\7\"\2\2~\u0080\5 \21\2\177}\3\2\2\2\u0080\u0083\3\2\2\2\u0081"+
-    "\177\3\2\2\2\u0081\u0082\3\2\2\2\u0082\u0085\3\2\2\2\u0083\u0081\3\2\2"+
-    "\2\u0084|\3\2\2\2\u0084\u0085\3\2\2\2\u0085\21\3\2\2\2\u0086\u0087\7\5"+
-    "\2\2\u0087\u008c\5\36\20\2\u0088\u0089\7\"\2\2\u0089\u008b\5\36\20\2\u008a"+
-    "\u0088\3\2\2\2\u008b\u008e\3\2\2\2\u008c\u008a\3\2\2\2\u008c\u008d\3\2"+
-    "\2\2\u008d\23\3\2\2\2\u008e\u008c\3\2\2\2\u008f\u0091\5\30\r\2\u0090\u0092"+
-    "\5\22\n\2\u0091\u0090\3\2\2\2\u0091\u0092\3\2\2\2\u0092\25\3\2\2\2\u0093"+
-    "\u0095\5\30\r\2\u0094\u0096\5\22\n\2\u0095\u0094\3\2\2\2\u0095\u0096\3"+
-    "\2\2\2\u0096\27\3\2\2\2\u0097\u0098\7#\2\2\u0098\u0099\5\34\17\2\u0099"+
-    "\u009a\7$\2\2\u009a\31\3\2\2\2\u009b\u009c\5\34\17\2\u009c\33\3\2\2\2"+
-    "\u009d\u00a0\7\4\2\2\u009e\u00a0\5> \2\u009f\u009d\3\2\2\2\u009f\u009e"+
-    "\3\2\2\2\u00a0\u00a1\3\2\2\2\u00a1\u00a2\7\22\2\2\u00a2\u00a3\5\36\20"+
-    "\2\u00a3\35\3\2\2\2\u00a4\u00a5\5 \21\2\u00a5\37\3\2\2\2\u00a6\u00a7\b"+
-    "\21\1\2\u00a7\u00a8\7\13\2\2\u00a8\u00ae\5 \21\7\u00a9\u00aa\7+\2\2\u00aa"+
-    "\u00ab\7\r\2\2\u00ab\u00ae\5\30\r\2\u00ac\u00ae\5\"\22\2\u00ad\u00a6\3"+
-    "\2\2\2\u00ad\u00a9\3\2\2\2\u00ad\u00ac\3\2\2\2\u00ae\u00b7\3\2\2\2\u00af"+
-    "\u00b0\f\4\2\2\u00b0\u00b1\7\3\2\2\u00b1\u00b6\5 \21\5\u00b2\u00b3\f\3"+
-    "\2\2\u00b3\u00b4\7\16\2\2\u00b4\u00b6\5 \21\4\u00b5\u00af\3\2\2\2\u00b5"+
-    "\u00b2\3\2\2\2\u00b6\u00b9\3\2\2\2\u00b7\u00b5\3\2\2\2\u00b7\u00b8\3\2"+
-    "\2\2\u00b8!\3\2\2\2\u00b9\u00b7\3\2\2\2\u00ba\u00c0\5$\23\2\u00bb\u00bc"+
-    "\5$\23\2\u00bc\u00bd\5\60\31\2\u00bd\u00be\5$\23\2\u00be\u00c0\3\2\2\2"+
-    "\u00bf\u00ba\3\2\2\2\u00bf\u00bb\3\2\2\2\u00c0#\3\2\2\2\u00c1\u00c2\b"+
-    "\23\1\2\u00c2\u00c4\5(\25\2\u00c3\u00c5\5&\24\2\u00c4\u00c3\3\2\2\2\u00c4"+
-    "\u00c5\3\2\2\2\u00c5\u00c9\3\2\2\2\u00c6\u00c7\t\2\2\2\u00c7\u00c9\5$"+
-    "\23\5\u00c8\u00c1\3\2\2\2\u00c8\u00c6\3\2\2\2\u00c9\u00d2\3\2\2\2\u00ca"+
-    "\u00cb\f\4\2\2\u00cb\u00cc\t\3\2\2\u00cc\u00d1\5$\23\5\u00cd\u00ce\f\3"+
-    "\2\2\u00ce\u00cf\t\2\2\2\u00cf\u00d1\5$\23\4\u00d0\u00ca\3\2\2\2\u00d0"+
-    "\u00cd\3\2\2\2\u00d1\u00d4\3\2\2\2\u00d2\u00d0\3\2\2\2\u00d2\u00d3\3\2"+
-    "\2\2\u00d3%\3\2\2\2\u00d4\u00d2\3\2\2\2\u00d5\u00d7\7\13\2\2\u00d6\u00d5"+
-    "\3\2\2\2\u00d6\u00d7\3\2\2\2\u00d7\u00d8\3\2\2\2\u00d8\u00d9\t\4\2\2\u00d9"+
-    "\u00da\7%\2\2\u00da\u00df\5\36\20\2\u00db\u00dc\7\"\2\2\u00dc\u00de\5"+
-    "\36\20\2\u00dd\u00db\3\2\2\2\u00de\u00e1\3\2\2\2\u00df\u00dd\3\2\2\2\u00df"+
-    "\u00e0\3\2\2\2\u00e0\u00e2\3\2\2\2\u00e1\u00df\3\2\2\2\u00e2\u00e3\7&"+
-    "\2\2\u00e3\u00f3\3\2\2\2\u00e4\u00e5\7\24\2\2\u00e5\u00f3\5.\30\2\u00e6"+
-    "\u00e7\7\24\2\2\u00e7\u00e8\7%\2\2\u00e8\u00ed\5.\30\2\u00e9\u00ea\7\""+
-    "\2\2\u00ea\u00ec\5.\30\2\u00eb\u00e9\3\2\2\2\u00ec\u00ef\3\2\2\2\u00ed"+
-    "\u00eb\3\2\2\2\u00ed\u00ee\3\2\2\2\u00ee\u00f0\3\2\2\2\u00ef\u00ed\3\2"+
-    "\2\2\u00f0\u00f1\7&\2\2\u00f1\u00f3\3\2\2\2\u00f2\u00d6\3\2\2\2\u00f2"+
-    "\u00e4\3\2\2\2\u00f2\u00e6\3\2\2\2\u00f3\'\3\2\2\2\u00f4\u00fc\5.\30\2"+
-    "\u00f5\u00fc\5*\26\2\u00f6\u00fc\5\64\33\2\u00f7\u00f8\7%\2\2\u00f8\u00f9"+
-    "\5\36\20\2\u00f9\u00fa\7&\2\2\u00fa\u00fc\3\2\2\2\u00fb\u00f4\3\2\2\2"+
-    "\u00fb\u00f5\3\2\2\2\u00fb\u00f6\3\2\2\2\u00fb\u00f7\3\2\2\2\u00fc)\3"+
-    "\2\2\2\u00fd\u00fe\5,\27\2\u00fe\u0107\7%\2\2\u00ff\u0104\5\36\20\2\u0100"+
-    "\u0101\7\"\2\2\u0101\u0103\5\36\20\2\u0102\u0100\3\2\2\2\u0103\u0106\3"+
-    "\2\2\2\u0104\u0102\3\2\2\2\u0104\u0105\3\2\2\2\u0105\u0108\3\2\2\2\u0106"+
+          " \"$&(*,.\60\62\64\668:<>\2\13\3\2 !\3\2\"$\3\2\7\b\5\2\n\13\21\22\30"
+          + "\30\4\2//\61\61\3\2\32\37\4\2\6\6\24\24\3\2/\60\4\2,,//\u0142\2@\3\2\2"
+          + "\2\4C\3\2\2\2\6F\3\2\2\2\bP\3\2\2\2\nR\3\2\2\2\fW\3\2\2\2\16l\3\2\2\2"
+          + "\20z\3\2\2\2\22\u0086\3\2\2\2\24\u008f\3\2\2\2\26\u0093\3\2\2\2\30\u0097"
+          + "\3\2\2\2\32\u009b\3\2\2\2\34\u009f\3\2\2\2\36\u00a4\3\2\2\2 \u00ad\3\2"
+          + "\2\2\"\u00bf\3\2\2\2$\u00c8\3\2\2\2&\u00f2\3\2\2\2(\u00fb\3\2\2\2*\u00fd"
+          + "\3\2\2\2,\u010b\3\2\2\2.\u0111\3\2\2\2\60\u0113\3\2\2\2\62\u0115\3\2\2"
+          + "\2\64\u0117\3\2\2\2\66\u0126\3\2\2\28\u0128\3\2\2\2:\u012e\3\2\2\2<\u0130"
+          + "\3\2\2\2>\u0132\3\2\2\2@A\5\6\4\2AB\7\2\2\3B\3\3\2\2\2CD\5\36\20\2DE\7"
+          + "\2\2\3E\5\3\2\2\2FJ\5\b\5\2GI\5\20\t\2HG\3\2\2\2IL\3\2\2\2JH\3\2\2\2J"
+          + "K\3\2\2\2K\7\3\2\2\2LJ\3\2\2\2MQ\5\f\7\2NQ\5\16\b\2OQ\5\32\16\2PM\3\2"
+          + "\2\2PN\3\2\2\2PO\3\2\2\2Q\t\3\2\2\2RS\7\27\2\2ST\7\f\2\2TU\7\31\2\2UV"
+          + "\58\35\2V\13\3\2\2\2W`\7\23\2\2XZ\5\22\n\2Y[\5\n\6\2ZY\3\2\2\2Z[\3\2\2"
+          + "\2[a\3\2\2\2\\^\5\n\6\2]_\5\22\n\2^]\3\2\2\2^_\3\2\2\2_a\3\2\2\2`X\3\2"
+          + "\2\2`\\\3\2\2\2`a\3\2\2\2ab\3\2\2\2bd\5\26\f\2ce\5\26\f\2dc\3\2\2\2ef"
+          + "\3\2\2\2fd\3\2\2\2fg\3\2\2\2gj\3\2\2\2hi\7\25\2\2ik\5\26\f\2jh\3\2\2\2"
+          + "jk\3\2\2\2k\r\3\2\2\2ln\7\t\2\2mo\5\22\n\2nm\3\2\2\2no\3\2\2\2op\3\2\2"
+          + "\2pr\5\24\13\2qs\5\24\13\2rq\3\2\2\2st\3\2\2\2tr\3\2\2\2tu\3\2\2\2ux\3"
+          + "\2\2\2vw\7\25\2\2wy\5\24\13\2xv\3\2\2\2xy\3\2\2\2y\17\3\2\2\2z{\7+\2\2"
+          + "{\u0084\7/\2\2|\u0081\5 \21\2}~\7&\2\2~\u0080\5 \21\2\177}\3\2\2\2\u0080"
+          + "\u0083\3\2\2\2\u0081\177\3\2\2\2\u0081\u0082\3\2\2\2\u0082\u0085\3\2\2"
+          + "\2\u0083\u0081\3\2\2\2\u0084|\3\2\2\2\u0084\u0085\3\2\2\2\u0085\21\3\2"
+          + "\2\2\u0086\u0087\7\5\2\2\u0087\u008c\5\36\20\2\u0088\u0089\7&\2\2\u0089"
+          + "\u008b\5\36\20\2\u008a\u0088\3\2\2\2\u008b\u008e\3\2\2\2\u008c\u008a\3"
+          + "\2\2\2\u008c\u008d\3\2\2\2\u008d\23\3\2\2\2\u008e\u008c\3\2\2\2\u008f"
+          + "\u0091\5\30\r\2\u0090\u0092\5\22\n\2\u0091\u0090\3\2\2\2\u0091\u0092\3"
+          + "\2\2\2\u0092\25\3\2\2\2\u0093\u0095\5\30\r\2\u0094\u0096\5\22\n\2\u0095"
+          + "\u0094\3\2\2\2\u0095\u0096\3\2\2\2\u0096\27\3\2\2\2\u0097\u0098\7\'\2"
+          + "\2\u0098\u0099\5\34\17\2\u0099\u009a\7(\2\2\u009a\31\3\2\2\2\u009b\u009c"
+          + "\5\34\17\2\u009c\33\3\2\2\2\u009d\u00a0\7\4\2\2\u009e\u00a0\5> \2\u009f"
+          + "\u009d\3\2\2\2\u009f\u009e\3\2\2\2\u00a0\u00a1\3\2\2\2\u00a1\u00a2\7\26"
+          + "\2\2\u00a2\u00a3\5\36\20\2\u00a3\35\3\2\2\2\u00a4\u00a5\5 \21\2\u00a5"
+          + "\37\3\2\2\2\u00a6\u00a7\b\21\1\2\u00a7\u00a8\7\r\2\2\u00a8\u00ae\5 \21"
+          + "\7\u00a9\u00aa\7/\2\2\u00aa\u00ab\7\17\2\2\u00ab\u00ae\5\30\r\2\u00ac"
+          + "\u00ae\5\"\22\2\u00ad\u00a6\3\2\2\2\u00ad\u00a9\3\2\2\2\u00ad\u00ac\3"
+          + "\2\2\2\u00ae\u00b7\3\2\2\2\u00af\u00b0\f\4\2\2\u00b0\u00b1\7\3\2\2\u00b1"
+          + "\u00b6\5 \21\5\u00b2\u00b3\f\3\2\2\u00b3\u00b4\7\20\2\2\u00b4\u00b6\5"
+          + " \21\4\u00b5\u00af\3\2\2\2\u00b5\u00b2\3\2\2\2\u00b6\u00b9\3\2\2\2\u00b7"
+          + "\u00b5\3\2\2\2\u00b7\u00b8\3\2\2\2\u00b8!\3\2\2\2\u00b9\u00b7\3\2\2\2"
+          + "\u00ba\u00c0\5$\23\2\u00bb\u00bc\5$\23\2\u00bc\u00bd\5\60\31\2\u00bd\u00be"
+          + "\5$\23\2\u00be\u00c0\3\2\2\2\u00bf\u00ba\3\2\2\2\u00bf\u00bb\3\2\2\2\u00c0"
+          + "#\3\2\2\2\u00c1\u00c2\b\23\1\2\u00c2\u00c4\5(\25\2\u00c3\u00c5\5&\24\2"
+          + "\u00c4\u00c3\3\2\2\2\u00c4\u00c5\3\2\2\2\u00c5\u00c9\3\2\2\2\u00c6\u00c7"
+          + "\t\2\2\2\u00c7\u00c9\5$\23\5\u00c8\u00c1\3\2\2\2\u00c8\u00c6\3\2\2\2\u00c9"
+          + "\u00d2\3\2\2\2\u00ca\u00cb\f\4\2\2\u00cb\u00cc\t\3\2\2\u00cc\u00d1\5$"
+          + "\23\5\u00cd\u00ce\f\3\2\2\u00ce\u00cf\t\2\2\2\u00cf\u00d1\5$\23\4\u00d0"
+          + "\u00ca\3\2\2\2\u00d0\u00cd\3\2\2\2\u00d1\u00d4\3\2\2\2\u00d2\u00d0\3\2"
+          + "\2\2\u00d2\u00d3\3\2\2\2\u00d3%\3\2\2\2\u00d4\u00d2\3\2\2\2\u00d5\u00d7"
+          + "\7\r\2\2\u00d6\u00d5\3\2\2\2\u00d6\u00d7\3\2\2\2\u00d7\u00d8\3\2\2\2\u00d8"
+          + "\u00d9\t\4\2\2\u00d9\u00da\7)\2\2\u00da\u00df\5\36\20\2\u00db\u00dc\7"
+          + "&\2\2\u00dc\u00de\5\36\20\2\u00dd\u00db\3\2\2\2\u00de\u00e1\3\2\2\2\u00df"
+          + "\u00dd\3\2\2\2\u00df\u00e0\3\2\2\2\u00e0\u00e2\3\2\2\2\u00e1\u00df\3\2"
+          + "\2\2\u00e2\u00e3\7*\2\2\u00e3\u00f3\3\2\2\2\u00e4\u00e5\t\5\2\2\u00e5"
+          + "\u00f3\5.\30\2\u00e6\u00e7\t\5\2\2\u00e7\u00e8\7)\2\2\u00e8\u00ed\5.\30"
+          + "\2\u00e9\u00ea\7&\2\2\u00ea\u00ec\5.\30\2\u00eb\u00e9\3\2\2\2\u00ec\u00ef"
+          + "\3\2\2\2\u00ed\u00eb\3\2\2\2\u00ed\u00ee\3\2\2\2\u00ee\u00f0\3\2\2\2\u00ef"
+          + "\u00ed\3\2\2\2\u00f0\u00f1\7*\2\2\u00f1\u00f3\3\2\2\2\u00f2\u00d6\3\2"
+          + "\2\2\u00f2\u00e4\3\2\2\2\u00f2\u00e6\3\2\2\2\u00f3\'\3\2\2\2\u00f4\u00fc"
+          + "\5.\30\2\u00f5\u00fc\5*\26\2\u00f6\u00fc\5\64\33\2\u00f7\u00f8\7)\2\2"
+          + "\u00f8\u00f9\5\36\20\2\u00f9\u00fa\7*\2\2\u00fa\u00fc\3\2\2\2\u00fb\u00f4"
+          + "\3\2\2\2\u00fb\u00f5\3\2\2\2\u00fb\u00f6\3\2\2\2\u00fb\u00f7\3\2\2\2\u00fc"
+          + ")\3\2\2\2\u00fd\u00fe\5,\27\2\u00fe\u0107\7)\2\2\u00ff\u0104\5\36\20\2"
+          + "\u0100\u0101\7&\2\2\u0101\u0103\5\36\20\2\u0102\u0100\3\2\2\2\u0103\u0106"
+          + "\3\2\2\2\u0104\u0102\3\2\2\2\u0104\u0105\3\2\2\2\u0105\u0108\3\2\2\2\u0106"
+          +
     "\u0104\3\2\2\2\u0107\u00ff\3\2\2\2\u0107\u0108\3\2\2\2\u0108\u0109\3\2"+
-    "\2\2\u0109\u010a\7&\2\2\u010a+\3\2\2\2\u010b\u010c\t\5\2\2\u010c-\3\2"+
-    "\2\2\u010d\u0112\7\f\2\2\u010e\u0112\5:\36\2\u010f\u0112\5\62\32\2\u0110"+
+          "\2\2\u0109\u010a\7*\2\2\u010a+\3\2\2\2\u010b\u010c\t\6\2\2\u010c-\3\2"
+          + "\2\2\u010d\u0112\7\16\2\2\u010e\u0112\5:\36\2\u010f\u0112\5\62\32\2\u0110"
+          +
     "\u0112\5<\37\2\u0111\u010d\3\2\2\2\u0111\u010e\3\2\2\2\u0111\u010f\3\2"+
-    "\2\2\u0111\u0110\3\2\2\2\u0112/\3\2\2\2\u0113\u0114\t\6\2\2\u0114\61\3"+
-    "\2\2\2\u0115\u0116\t\7\2\2\u0116\63\3\2\2\2\u0117\u0123\5\66\34\2\u0118"+
-    "\u0119\7!\2\2\u0119\u0122\5\66\34\2\u011a\u011c\7#\2\2\u011b\u011d\7)"+
-    "\2\2\u011c\u011b\3\2\2\2\u011d\u011e\3\2\2\2\u011e\u011c\3\2\2\2\u011e"+
-    "\u011f\3\2\2\2\u011f\u0120\3\2\2\2\u0120\u0122\7$\2\2\u0121\u0118\3\2"+
+          "\2\2\u0111\u0110\3\2\2\2\u0112/\3\2\2\2\u0113\u0114\t\7\2\2\u0114\61\3"
+          + "\2\2\2\u0115\u0116\t\b\2\2\u0116\63\3\2\2\2\u0117\u0123\5\66\34\2\u0118"
+          + "\u0119\7%\2\2\u0119\u0122\5\66\34\2\u011a\u011c\7\'\2\2\u011b\u011d\7"
+          + "-\2\2\u011c\u011b\3\2\2\2\u011d\u011e\3\2\2\2\u011e\u011c\3\2\2\2\u011e"
+          + "\u011f\3\2\2\2\u011f\u0120\3\2\2\2\u0120\u0122\7(\2\2\u0121\u0118\3\2"
+          +
     "\2\2\u0121\u011a\3\2\2\2\u0122\u0125\3\2\2\2\u0123\u0121\3\2\2\2\u0123"+
-    "\u0124\3\2\2\2\u0124\65\3\2\2\2\u0125\u0123\3\2\2\2\u0126\u0127\t\b\2"+
-    "\2\u0127\67\3\2\2\2\u0128\u012a\5:\36\2\u0129\u012b\7+\2\2\u012a\u0129"+
-    "\3\2\2\2\u012a\u012b\3\2\2\2\u012b9\3\2\2\2\u012c\u012f\7*\2\2\u012d\u012f"+
-    "\7)\2\2\u012e\u012c\3\2\2\2\u012e\u012d\3\2\2\2\u012f;\3\2\2\2\u0130\u0131"+
-    "\7(\2\2\u0131=\3\2\2\2\u0132\u0133\t\t\2\2\u0133?\3\2\2\2\'JPZ^`fjntx"+
+          "\u0124\3\2\2\2\u0124\65\3\2\2\2\u0125\u0123\3\2\2\2\u0126\u0127\t\t\2"
+          + "\2\u0127\67\3\2\2\2\u0128\u012a\5:\36\2\u0129\u012b\7/\2\2\u012a\u0129"
+          + "\3\2\2\2\u012a\u012b\3\2\2\2\u012b9\3\2\2\2\u012c\u012f\7.\2\2\u012d\u012f"
+          + "\7-\2\2\u012e\u012c\3\2\2\2\u012e\u012d\3\2\2\2\u012f;\3\2\2\2\u0130\u0131"
+          + "\7,\2\2\u0131=\3\2\2\2\u0132\u0133\t\n\2\2\u0133?\3\2\2\2\'JPZ^`fjntx"
+          +
     "\u0081\u0084\u008c\u0091\u0095\u009f\u00ad\u00b5\u00b7\u00bf\u00c4\u00c8"+
     "\u00d0\u00d2\u00d6\u00df\u00ed\u00f2\u00fb\u0104\u0107\u0111\u011e\u0121"+
     "\u0123\u012a\u012e";

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/ExpressionBuilder.java

@@ -11,6 +11,8 @@ import org.antlr.v4.runtime.ParserRuleContext;
 import org.antlr.v4.runtime.tree.ParseTree;
 import org.antlr.v4.runtime.tree.TerminalNode;
 import org.elasticsearch.xpack.eql.expression.function.EqlFunctionResolution;
+import org.elasticsearch.xpack.eql.expression.function.scalar.string.Match;
+import org.elasticsearch.xpack.eql.expression.function.scalar.string.Wildcard;
 import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveEquals;
 import org.elasticsearch.xpack.eql.expression.predicate.operator.comparison.InsensitiveWildcardEquals;
 import org.elasticsearch.xpack.eql.parser.EqlBaseParser.ArithmeticUnaryContext;
@@ -168,13 +170,25 @@ public class ExpressionBuilder extends IdentifierBuilder {
 
         switch (predicate.kind.getType()) {
             case EqlBaseParser.SEQ:
-                return Predicates.combineOr(expressions(predicate.constant()).stream()
-                    .map(c -> new InsensitiveWildcardEquals(source, expr, c, zoneId))
-                    .collect(toList()));
+                return combineExpressions(predicate.constant(), c -> new InsensitiveWildcardEquals(source, expr, c, zoneId));
+            case EqlBaseParser.LIKE:
+            case EqlBaseParser.LIKE_INSENSITIVE:
+                return new Wildcard(
+                    source,
+                    expr,
+                    expressions(predicate.constant()),
+                    predicate.kind.getType() == EqlBaseParser.LIKE_INSENSITIVE
+                );
+            case EqlBaseParser.REGEX:
+            case EqlBaseParser.REGEX_INSENSITIVE:
+                return new Match(
+                    source,
+                    expr,
+                    expressions(predicate.constant()),
+                    predicate.kind.getType() == EqlBaseParser.REGEX_INSENSITIVE
+                );
             case EqlBaseParser.IN_INSENSITIVE:
-                Expression insensitiveIn = Predicates.combineOr(expressions(predicate.expression()).stream()
-                    .map(c -> new InsensitiveEquals(source, expr, c, zoneId))
-                    .collect(toList()));
+                Expression insensitiveIn = combineExpressions(predicate.expression(), c -> new InsensitiveEquals(source, expr, c, zoneId));
                 return predicate.NOT() != null ? new Not(source, insensitiveIn) : insensitiveIn;
             case EqlBaseParser.IN:
                 List<Expression> container = expressions(predicate.expression());
@@ -185,6 +199,13 @@ public class ExpressionBuilder extends IdentifierBuilder {
         }
     }
 
+    private Expression combineExpressions(
+        List<? extends ParserRuleContext> expressions,
+        java.util.function.Function<Expression, Expression> mapper
+    ) {
+        return Predicates.combineOr(expressions(expressions).stream().map(mapper::apply).collect(toList()));
+    }
+
     @Override
     public Literal visitDecimalLiteral(EqlBaseParser.DecimalLiteralContext ctx) {
         Source source = source(ctx);

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/util/StringUtils.java

@@ -7,7 +7,10 @@
 
 package org.elasticsearch.xpack.eql.util;
 
+import org.elasticsearch.xpack.eql.EqlIllegalArgumentException;
+import org.elasticsearch.xpack.ql.expression.Expression;
 import org.elasticsearch.xpack.ql.expression.predicate.regex.LikePattern;
+import org.elasticsearch.xpack.ql.type.DataTypes;
 
 public final class StringUtils {
 
@@ -29,4 +32,11 @@ public final class StringUtils {
 
         return new LikePattern(likeString, escape);
     }
+
+    public static LikePattern toLikePattern(Expression expression) {
+        if (expression.foldable() == false || DataTypes.isString(expression.dataType()) == false) {
+            throw new EqlIllegalArgumentException("Invalid like pattern received {}", expression);
+        }
+        return toLikePattern(expression.fold().toString());
+    }
 }

x-pack/plugin/eql/src/main/resources/org/elasticsearch/xpack/eql/plugin/eql_whitelist.txt

@@ -49,6 +49,7 @@ class org.elasticsearch.xpack.ql.expression.function.scalar.whitelist.InternalQl
 # Regex
 #
   Boolean regex(String, String)
+  Boolean regex(String, String, Boolean)
 
 #
 # Math

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/parser/ExpressionTests.java

@@ -396,7 +396,8 @@ public class ExpressionTests extends ESTestCase {
         }
         ParsingException e = expectThrows(ParsingException.class, () -> expr(sb.toString()));
         assertEquals("line 1:" + (6 + firstComparator.length()) + ": mismatched input '" + secondComparator +
-                "' expecting {<EOF>, 'and', 'in', 'in~', 'not', 'or', ':', '+', '-', '*', '/', '%', '.', '['}",
+            "' expecting {<EOF>, 'and', 'in', 'in~', 'like', 'like~', 'not', 'or', "
+            + "'regex', 'regex~', ':', '+', '-', '*', '/', '%', '.', '['}",
             e.getMessage());
     }
 }

x-pack/plugin/eql/src/test/resources/queryfolder_tests.txt

@@ -428,38 +428,12 @@ InternalEqlScriptUtils.cidrMatch(InternalQlScriptUtils.docValue(doc,params.v0),p
 "params":{"v0":"source_address","v1":["10.6.48.157/8"],"v2":"true"}
 ;
 
-//matchFunctionOne
-//process where match(command_line, "^.*?net.exe")
-//;
-//"regexp":{"command_line":{"value":"^.*?net.exe"
-//;
-//
-//matchFunctionTwo
-//process where match(command_line, "^.*?net.exe", "net\\.exe")
-//;
-//"regexp":{"command_line":{"value":"^.*?net.exe|net\\.exe"
-//;
-//
-//matchFunctionThree
-//process where match(command_line, "^.*?net.exe", "net\\.exe", "C:\\\\Windows\\\\system32\\\\net1\\s+")
-//;
-//"regexp":{"command_line":{"value":"^.*?net.exe|net\\.exe|C:\\\\Windows\\\\system32\\\\net1\\s+"
-//;
-
 numberFunctionSingleArgument
 process where number(process_name) == 1;
 InternalEqlScriptUtils.number(InternalQlScriptUtils.docValue(doc,params.v0),params.v1)
 "params":{"v0":"process_name","v1":null,"v2":1}
 ;
 
-//matchFunctionScalar
-//process where match(substring(command_line, 5), "^.*?net.exe", "net\\.exe", "C:\\\\Windows\\\\system32\\\\net1\\s+")
-//;
-//"script":{"source":"InternalQlScriptUtils.nullSafeFilter(InternalSqlScriptUtils.regex(InternalEqlScriptUtils.substring(
-//InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2),params.v3))",
-//"params":{"v0":"command_line","v1":5,"v2":null,"v3":"^.*?net.exe|net\\.exe|C:\\\\Windows\\\\system32\\\\net1\\s+"}}
-//;
-
 
 numberFunctionTwoFieldArguments
 process where number(process_name, pid) != null;
@@ -710,3 +684,131 @@ process where true | tail 10 | head 7
 ;
 "size":7,
 ;
+
+
+//
+// like and regex
+//
+
+likeSingleArgNoPattern
+process where command_line like "net.exe"
+;
+"term":{"command_line":{"value":"net.exe","boost":1.0}
+;
+
+likeSingleArgNoPatternInsensitive
+process where command_line like~ "net.exe"
+;
+"term":{"command_line":{"value":"net.exe","case_insensitive":true,"boost":1.0}
+;
+
+likeSingleArg
+process where command_line like "n*t.exe"
+;
+"wildcard":{"command_line":{"wildcard":"n*t.exe","boost":1.0}
+;
+
+likeSingleArgInsensitive
+process where command_line like~ "n*t.exe"
+;
+"wildcard":{"command_line":{"wildcard":"n*t.exe","case_insensitive":true,"boost":1.0}
+;
+
+likeMultiArg
+process where command_line like ("n?t.e?e", "net.*")
+;
+{"bool":{"should":[{"wildcard"
+"wildcard":{"command_line":{"wildcard":"n?t.e?e","boost":1.0}
+"wildcard":{"command_line":{"wildcard":"net.*","boost":1.0}
+;
+
+likeMultiArgInsensitive
+process where command_line like~ ("n?t.e?e", "net.*")
+;
+{"bool":{"should":[{"wildcard"
+"wildcard":{"command_line":{"wildcard":"n?t.e?e","case_insensitive":true,"boost":1.0}
+"wildcard":{"command_line":{"wildcard":"net.*","case_insensitive":true,"boost":1.0}
+;
+
+likeMultiArgWithScript
+process where substring(command_line, 5) like ("net.e*", "net.e?e")
+;
+"script":{"source":"InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.regex(InternalEqlScriptUtils.substring(
+InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2),params.v3))",
+"params":{"v0":"command_line","v1":5,"v2":null,"v3":"^net\\.e.*$"}}
+"params":{"v0":"command_line","v1":5,"v2":null,"v3":"^net\\.e.e$"}}
+;
+
+likeMultiArgWithScriptInsensitive
+process where substring(command_line, 5) like~ ("net.e*", "net.e?e")
+;
+"script":{"source":"InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.regex(InternalEqlScriptUtils.substring(
+InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2),params.v3,params.v4))",
+"params":{"v0":"command_line","v1":5,"v2":null,"v3":"^net\\.e.*$","v4":true}}
+"params":{"v0":"command_line","v1":5,"v2":null,"v3":"^net\\.e.e$","v4":true}}
+;
+
+regexSingleArgNoPattern
+process where command_line regex "net\\.exe"
+;
+"term":{"command_line":{"value":"net.exe","boost":1.0}
+;
+
+regexSingleArgNoPatternInsensitive
+process where command_line regex~ "net\\.exe"
+;
+"term":{"command_line":{"value":"net.exe","case_insensitive":true,"boost":1.0}
+;
+
+regexSingleArg
+process where command_line regex "^.*?net.exe"
+;
+"regexp":{"command_line":{"value":"^.*?net.exe",
+;
+
+regexSingleArgInsensitive
+process where command_line regex~ "^.*?net.exe"
+;
+"regexp":{"command_line":{"value":"^.*?net.exe","flags_value":255,"case_insensitive":true
+;
+
+regexMultiArg
+process where command_line regex ("^.*?net.exe", "net\\.exe")
+;
+"regexp":{"command_line":{"value":"^.*?net.exe|net\\.exe"
+;
+
+regexMultiArgInsensitive
+process where command_line regex~ ("^.*?net.exe", "net\\.exe")
+;
+"regexp":{"command_line":{"value":"^.*?net.exe|net\\.exe","flags_value":255,"case_insensitive":true
+;
+
+regexMultiMultiArgVariant
+process where command_line regex ("^.*?net.exe", "net\\.exe", "C:\\\\Windows\\\\system32\\\\net1\\s+")
+;
+"regexp":{"command_line":{"value":"^.*?net.exe|net\\.exe|C:\\\\Windows\\\\system32\\\\net1\\s+"
+;
+
+regexMultiMultiArgVariantInsensitive
+process where command_line regex~ ("^.*?net.exe", "net\\.exe", "C:\\\\Windows\\\\system32\\\\net1\\s+")
+;
+"regexp":{"command_line":{"value":"^.*?net.exe|net\\.exe|C:\\\\Windows\\\\system32\\\\net1\\s+","flags_value":255,"case_insensitive":true
+;
+
+regexMultiArgWithScript
+process where substring(command_line, 5) regex ("^.*?net.exe", "net\\.exe", "C:\\\\Windows\\\\system32\\\\net1\\s+")
+;
+"script":{"source":"InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.regex(InternalEqlScriptUtils.substring(
+InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2),params.v3))",
+"params":{"v0":"command_line","v1":5,"v2":null,"v3":"^.*?net.exe|net\\.exe|C:\\\\Windows\\\\system32\\\\net1\\s+"}}
+;
+
+regexMultiArgWithScriptInsensitive
+process where substring(command_line, 5) regex~ ("^.*?net.exe", "net\\.exe", "C:\\\\Windows\\\\system32\\\\net1\\s+")
+;
+"script":{"source":"InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.regex(InternalEqlScriptUtils.substring(
+InternalQlScriptUtils.docValue(doc,params.v0),params.v1,params.v2),params.v3,params.v4))",
+"params":{"v0":"command_line","v1":5,"v2":null,"v3":"^.*?net.exe|net\\.exe|C:\\\\Windows\\\\system32\\\\net1\\s+","v4":true}}
+;
+

x-pack/plugin/ql/src/main/java/org/elasticsearch/xpack/ql/expression/function/scalar/whitelist/InternalQlScriptUtils.java

@@ -115,8 +115,12 @@ public class InternalQlScriptUtils {
     // Regex
     //
     public static Boolean regex(String value, String pattern) {
+        return regex(value, pattern, Boolean.FALSE);
+    }
+
+    public static Boolean regex(String value, String pattern, Boolean caseInsensitive) {
         // TODO: this needs to be improved to avoid creating the pattern on every call
-        return RegexOperation.match(value, pattern);
+        return RegexOperation.match(value, pattern, caseInsensitive);
     }
 
     //

x-pack/plugin/ql/src/main/java/org/elasticsearch/xpack/ql/expression/predicate/regex/Like.java

@@ -10,19 +10,14 @@ import org.elasticsearch.xpack.ql.expression.Expression;
 import org.elasticsearch.xpack.ql.tree.NodeInfo;
 import org.elasticsearch.xpack.ql.tree.Source;
 
-import java.util.Objects;
-
 public class Like extends RegexMatch<LikePattern> {
 
-    private final boolean caseInsensitive;
-
     public Like(Source source, Expression left, LikePattern pattern) {
         this(source, left, pattern, false);
     }
 
     public Like(Source source, Expression left, LikePattern pattern, boolean caseInsensitive) {
-        super(source, left, pattern);
-        this.caseInsensitive = caseInsensitive;
+        super(source, left, pattern, caseInsensitive);
     }
 
     @Override
@@ -35,18 +30,4 @@ public class Like extends RegexMatch<LikePattern> {
         return new Like(source(), newLeft, pattern(), caseInsensitive());
     }
 
-    public boolean caseInsensitive() {
-        return caseInsensitive;
-    }
-
-    @Override
-    public boolean equals(Object obj) {
-        return super.equals(obj) && Objects.equals(((Like) obj).caseInsensitive(), caseInsensitive());
-    }
-
-    @Override
-    public int hashCode() {
-        return Objects.hash(super.hashCode(), caseInsensitive());
-    }
-
 }

x-pack/plugin/ql/src/main/java/org/elasticsearch/xpack/ql/expression/predicate/regex/RLike.java

@@ -13,16 +13,20 @@ import org.elasticsearch.xpack.ql.tree.Source;
 public class RLike extends RegexMatch<RLikePattern> {
 
     public RLike(Source source, Expression value, RLikePattern pattern) {
-        super(source, value, pattern);
+        super(source, value, pattern, false);
+    }
+
+    public RLike(Source source, Expression field, RLikePattern rLikePattern, boolean caseInsensitive) {
+        super(source, field, rLikePattern, caseInsensitive);
     }
 
     @Override
     protected NodeInfo<RLike> info() {
-        return NodeInfo.create(this, RLike::new, field(), pattern());
+        return NodeInfo.create(this, RLike::new, field(), pattern(), caseInsensitive());
     }
 
     @Override
     protected RLike replaceChild(Expression newChild) {
-        return new RLike(source(), newChild, pattern());
+        return new RLike(source(), newChild, pattern(), caseInsensitive());
     }
 }

x-pack/plugin/ql/src/main/java/org/elasticsearch/xpack/ql/expression/predicate/regex/RegexMatch.java

@@ -26,16 +26,22 @@ import static org.elasticsearch.xpack.ql.expression.gen.script.ParamsBuilder.par
 public abstract class RegexMatch<T extends StringPattern> extends UnaryScalarFunction {
 
     private final T pattern;
+    private final boolean caseInsensitive;
 
-    protected RegexMatch(Source source, Expression value, T pattern) {
+    protected RegexMatch(Source source, Expression value, T pattern, boolean caseInsensitive) {
         super(source, value);
         this.pattern = pattern;
+        this.caseInsensitive = caseInsensitive;
     }
 
     public T pattern() {
         return pattern;
     }
 
+    public boolean caseInsensitive() {
+        return caseInsensitive;
+    }
+
     @Override
     public DataType dataType() {
         return DataTypes.BOOLEAN;
@@ -74,21 +80,32 @@ public abstract class RegexMatch<T extends StringPattern> extends UnaryScalarFun
     @Override
     public ScriptTemplate asScript() {
         ScriptTemplate fieldAsScript = asScript(field());
+        // keep backwards compatibility with previous 7.x versions
+        if (caseInsensitive == false) {
+            return new ScriptTemplate(
+                formatTemplate(format("{ql}.", "regex({},{})", fieldAsScript.template())),
+                paramsBuilder().script(fieldAsScript.params()).variable(pattern.asJavaRegex()).build(),
+                dataType()
+            );
+        }
         return new ScriptTemplate(
-                formatTemplate(format("{sql}.", "regex({},{})", fieldAsScript.template())),
-                paramsBuilder()
-                        .script(fieldAsScript.params())
-                        .variable(pattern.asJavaRegex())
-                        .build(),
-                dataType());
+            formatTemplate(format("{ql}.", "regex({},{},{})", fieldAsScript.template())),
+            paramsBuilder().script(fieldAsScript.params()).variable(pattern.asJavaRegex()).variable(caseInsensitive).build(),
+            dataType()
+        );
     }
 
+    @Override
     public boolean equals(Object obj) {
-        return super.equals(obj) && Objects.equals(((RegexMatch<?>) obj).pattern(), pattern());
+        if (super.equals(obj)) {
+            RegexMatch<?> other = (RegexMatch<?>) obj;
+            return caseInsensitive == other.caseInsensitive && Objects.equals(pattern, other.pattern);
+        }
+        return false;
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(super.hashCode(), pattern());
+        return Objects.hash(super.hashCode(), pattern(), caseInsensitive);
     }
 }

x-pack/plugin/ql/src/main/java/org/elasticsearch/xpack/ql/expression/predicate/regex/RegexProcessor.java

@@ -31,6 +31,10 @@ public class RegexProcessor implements Processor {
         }
 
         public static Boolean match(Object value, String pattern) {
+            return match(value, pattern, Boolean.FALSE);
+        }
+
+        public static Boolean match(Object value, String pattern, Boolean caseInsensitive) {
             if (pattern == null) {
                 return Boolean.TRUE;
             }
@@ -39,7 +43,11 @@ public class RegexProcessor implements Processor {
                 return null;
             }
 
-            return Pattern.compile(pattern).matcher(value.toString()).matches();
+            int flags = 0;
+            if (Boolean.TRUE.equals(caseInsensitive)) {
+                flags |= Pattern.CASE_INSENSITIVE;
+            }
+            return Pattern.compile(pattern, flags).matcher(value.toString()).matches();
         }
     }
 

x-pack/plugin/ql/src/main/java/org/elasticsearch/xpack/ql/optimizer/OptimizerRules.java

@@ -1475,12 +1475,16 @@ public final class OptimizerRules {
                     String match = pattern.exactMatch();
                     if (match != null) {
                         Literal literal = new Literal(regexMatch.source(), match, DataTypes.KEYWORD);
-                        e = new Equals(e.source(), regexMatch.field(), literal);
+                        e = regexToEquals(regexMatch, literal);
                     }
                 }
             }
             return e;
         }
+
+        protected Expression regexToEquals(RegexMatch<?> regexMatch, Literal literal) {
+            return new Equals(regexMatch.source(), regexMatch.field(), literal);
+        }
     }
 
     public static final class SetAsOptimized extends Rule<LogicalPlan, LogicalPlan> {

x-pack/plugin/ql/src/main/java/org/elasticsearch/xpack/ql/planner/ExpressionTranslators.java

@@ -129,8 +129,8 @@ public final class ExpressionTranslators {
                 }
 
                 if (e instanceof RLike) {
-                    String pattern = ((RLike) e).pattern().asJavaRegex();
-                    q = new RegexQuery(e.source(), targetFieldName, pattern);
+                    RLike rl = ((RLike) e);
+                    q = new RegexQuery(e.source(), targetFieldName, rl.pattern().asJavaRegex(), rl.caseInsensitive());
                 }
             } else {
                 q = new ScriptQuery(e.source(), e.asScript());

x-pack/plugin/ql/src/main/java/org/elasticsearch/xpack/ql/querydsl/query/RegexQuery.java

@@ -16,11 +16,17 @@ import static org.elasticsearch.index.query.QueryBuilders.regexpQuery;
 public class RegexQuery extends LeafQuery {
 
     private final String field, regex;
+    private final boolean caseInsensitive;
 
     public RegexQuery(Source source, String field, String regex) {
+        this(source, field, regex, false);
+    }
+
+    public RegexQuery(Source source, String field, String regex, boolean caseInsensitive) {
         super(source);
         this.field = field;
         this.regex = regex;
+        this.caseInsensitive = caseInsensitive;
     }
 
     public String field() {
@@ -31,14 +37,18 @@ public class RegexQuery extends LeafQuery {
         return regex;
     }
 
+    public Boolean caseInsensitive() {
+        return caseInsensitive;
+    }
+
     @Override
     public QueryBuilder asBuilder() {
-        return regexpQuery(field, regex);
+        return regexpQuery(field, regex).caseInsensitive(caseInsensitive);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(field, regex);
+        return Objects.hash(field, regex, caseInsensitive);
     }
 
     @Override
@@ -52,8 +62,7 @@ public class RegexQuery extends LeafQuery {
         }
 
         RegexQuery other = (RegexQuery) obj;
-        return Objects.equals(field, other.field)
-                && Objects.equals(regex, other.regex);
+        return Objects.equals(field, other.field) && Objects.equals(regex, other.regex) && caseInsensitive == other.caseInsensitive;
     }
 
     @Override

x-pack/plugin/sql/src/main/resources/org/elasticsearch/xpack/sql/plugin/sql_whitelist.txt

@@ -60,6 +60,7 @@ class org.elasticsearch.xpack.ql.expression.function.scalar.whitelist.InternalQl
 # Regex
 #
   Boolean regex(String, String)
+  Boolean regex(String, String, Boolean)
 
 #
 # Math
@@ -77,11 +78,6 @@ class org.elasticsearch.xpack.sql.expression.function.scalar.whitelist.InternalS
   def least(java.util.List)
   def nullif(Object, Object)
 
-#
-# Regex
-#
-  Boolean regex(String, String)
-
 #
 # Math
 #

x-pack/plugin/sql/src/test/java/org/elasticsearch/xpack/sql/planner/QueryTranslatorTests.java

@@ -712,7 +712,9 @@ public class QueryTranslatorTests extends ESTestCase {
         QueryTranslation qt = translate(condition);
         assertTrue(qt.query instanceof ScriptQuery);
         ScriptQuery sc = (ScriptQuery) qt.query;
-        assertEquals("InternalQlScriptUtils.nullSafeFilter(InternalSqlScriptUtils.regex(" +
+        assertEquals(
+            "InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.regex("
+                +
                 "InternalSqlScriptUtils.ltrim(InternalQlScriptUtils.docValue(doc,params.v0)),params.v1))",
             sc.script().toString());
         assertEquals("[{v=keyword}, {v=^.*a.*$}]", sc.script().params().toString());
@@ -727,7 +729,9 @@ public class QueryTranslatorTests extends ESTestCase {
         QueryTranslation qt = translate(condition);
         assertTrue(qt.query instanceof ScriptQuery);
         ScriptQuery sc = (ScriptQuery) qt.query;
-        assertEquals("InternalQlScriptUtils.nullSafeFilter(InternalSqlScriptUtils.regex(" +
+        assertEquals(
+            "InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.regex("
+                +
                 "InternalSqlScriptUtils.ltrim(InternalQlScriptUtils.docValue(doc,params.v0)),params.v1))",
             sc.script().toString());
         assertEquals("[{v=keyword}, {v=.*a.*}]", sc.script().params().toString());
@@ -800,8 +804,10 @@ public class QueryTranslatorTests extends ESTestCase {
         GroupingContext groupingContext = QueryFolder.FoldAggregate.groupBy(((Aggregate) p).groupings());
         assertNotNull(groupingContext);
         ScriptTemplate scriptTemplate = groupingContext.tail.script();
-        assertEquals("InternalQlScriptUtils.nullSafeFilter(InternalSqlScriptUtils.regex(InternalQlScriptUtils.docValue(doc,params.v0)," +
-                "params.v1)) ? params.v2 : InternalQlScriptUtils.nullSafeFilter(InternalSqlScriptUtils.regex(InternalQlScriptUtils." +
+        assertEquals(
+            "InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.regex(InternalQlScriptUtils.docValue(doc,params.v0),"
+                + "params.v1)) ? params.v2 : InternalQlScriptUtils.nullSafeFilter(InternalQlScriptUtils.regex(InternalQlScriptUtils."
+                +
                 "docValue(doc,params.v3),params.v4)) ? params.v5 : params.v6",
                 scriptTemplate.toString());
         assertEquals("[{v=keyword}, {v=^.*foo.*$}, {v=1}, {v=keyword}, {v=.*bar.*}, {v=2}, {v=3}]",