EQL: Allow Unicode escape sequences in strings (#70514)

Occasionally, it's useful to be able to use non-printable,
RTL (right-to-left) or other non-standard unicode characters
in an EQL query.

Introducing an escape sequence `\u{XXXXXXXX}` where 2-8 hex
digits are allowed within the curly braces, where zero padding from the
left is implied e.g.:

```
\u{35}
\u{1f2da}
\u{002acd1}
```

Closes: #62832

x-pack/plugin/eql/qa/common/src/main/java/org/elasticsearch/test/eql/EqlRestTestCase.java

@@ -106,6 +106,45 @@ public abstract class EqlRestTestCase extends ESRestTestCase {
         deleteIndex("test2");
     }
 
+    @SuppressWarnings("unchecked")
+    public void testUnicodeChars() throws Exception {
+        createIndex("test", Settings.EMPTY, null, null);
+
+        StringBuilder bulk = new StringBuilder();
+        bulk.append("{\"index\": {\"_index\": \"test\", \"_id\": 1}}\n");
+        bulk.append("{\"event\":{\"category\":\"process\"},\"@timestamp\":\"2020-09-04T12:34:56Z\",\"log\" : \"prefix_ë_suffix\"}\n");
+        bulk.append("{\"index\": {\"_index\": \"test\", \"_id\": 2}}\n");
+        bulk.append("{\"event\":{\"category\":\"process\"},\"@timestamp\":\"2020-09-05T12:34:57Z\",\"log\" : \"prefix_𖠋_suffix\"}\n");
+        bulkIndex(bulk.toString());
+
+        String endpoint = "/test/_eql/search";
+        Request request = new Request("GET", endpoint);
+        request.setJsonEntity("{\"query\":\"process where log==\\\"prefix_\\\\u{0eb}_suffix\\\"\"}");
+        Response response = client().performRequest(request);
+
+        Map<String, Object> responseMap;
+        try (InputStream content = response.getEntity().getContent()) {
+            responseMap = XContentHelper.convertToMap(JsonXContent.jsonXContent, content, false);
+        }
+        Map<String, Object> hits = (Map<String, Object>) responseMap.get("hits");
+        List<Map<String, Object>> events = (List<Map<String, Object>>) hits.get("events");
+        assertEquals(1, events.size());
+        assertEquals("1", events.get(0).get("_id"));
+
+        request.setJsonEntity("{\"query\":\"process where log==\\\"prefix_\\\\u{01680b}_suffix\\\"\"}");
+        response = client().performRequest(request);
+
+        try (InputStream content = response.getEntity().getContent()) {
+            responseMap = XContentHelper.convertToMap(JsonXContent.jsonXContent, content, false);
+        }
+        hits = (Map<String, Object>) responseMap.get("hits");
+        events = (List<Map<String, Object>>) hits.get("events");
+        assertEquals(1, events.size());
+        assertEquals("2", events.get(0).get("_id"));
+
+        deleteIndex("test");
+    }
+
     private void bulkIndex(String bulk) throws IOException {
         Request bulkRequest = new Request("POST", "/_bulk");
         bulkRequest.setJsonEntity(bulk);

x-pack/plugin/eql/src/main/antlr/EqlBase.g4

@@ -205,12 +205,29 @@ LP: '(';
 RP: ')';
 PIPE: '|';
 
+fragment STRING_ESCAPE
+    : '\\' [btnfr"'\\]
+    ;
+
+fragment HEX_DIGIT
+    : [0-9abcdefABCDEF]
+    ;
+
+fragment UNICODE_ESCAPE
+    : '\\u' '{' HEX_DIGIT+  '}' // 2-8 hex
+    ;
+
+fragment UNESCAPED_CHARS
+    : ~[\r\n"\\]
+    ;
+
 STRING
-    : '\''  ('\\' [btnfr"'\\] | ~[\r\n'\\])* '\''
-    | '"'   ('\\' [btnfr"'\\] | ~[\r\n"\\])* '"'
+    : '"' (STRING_ESCAPE | UNICODE_ESCAPE | UNESCAPED_CHARS)* '"'
+    | '"""' (~[\r\n])*? '"""' '"'? '"'?
+    // Old style quoting of string, handled as errors in AbstractBuilder
+    | '\''  ('\\' [btnfr"'\\] | ~[\r\n'\\])* '\''
     | '?"'  ('\\"' |~["\r\n])* '"'
     | '?\'' ('\\\'' |~['\r\n])* '\''
-    | '"""' (~[\r\n])*? '"""' '"'? '"'?
     ;
 
 INTEGER_VALUE

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/AbstractBuilder.java

@@ -18,16 +18,12 @@ import org.elasticsearch.xpack.ql.util.Check;
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
 /**
  * Base parsing visitor class offering utility methods.
  */
 abstract class AbstractBuilder extends EqlBaseBaseVisitor<Object> {
 
-    private static final Pattern slashPattern = Pattern.compile("\\\\.");
-
     @Override
     public Object visit(ParseTree tree) {
         Object result = super.visit(tree);
@@ -137,50 +133,77 @@ abstract class AbstractBuilder extends EqlBaseBaseVisitor<Object> {
         checkForSingleQuotedString(source, text, 0);
 
         text = text.substring(1, text.length() - 1);
-        StringBuffer resultString = new StringBuffer();
-        Matcher regexMatcher = slashPattern.matcher(text);
-
-        while (regexMatcher.find()) {
-            String group = regexMatcher.group();
-            String replacement;
-
-            switch (group) {
-                case "\\t":
-                    replacement = "\t";
-                    break;
-                case "\\b":
-                    replacement = "\b";
-                    break;
-                case "\\f":
-                    replacement = "\f";
-                    break;
-                case "\\n":
-                    replacement = "\n";
-                    break;
-                case "\\r":
-                    replacement = "\r";
-                    break;
-                case "\\\"":
-                    replacement = "\"";
-                    break;
-                case "\\'":
-                    replacement = "'";
-                    break;
-                case "\\\\":
-                    // will be interpreted as regex, so we have to escape it
-                    replacement = "\\\\";
-                    break;
-                default:
-                    // unknown escape sequence, pass through as-is
-                    replacement = group;
+        StringBuilder sb = new StringBuilder();
+
+        for (int i = 0; i < text.length();) {
+            if (text.charAt(i) == '\\') {
+                // ANTLR4 Grammar guarantees there is always a character after the `\`
+                switch (text.charAt(++i)) {
+                    case 't':
+                        sb.append('\t');
+                        break;
+                    case 'b':
+                        sb.append('\b');
+                        break;
+                    case 'f':
+                        sb.append('\f');
+                        break;
+                    case 'n':
+                        sb.append('\n');
+                        break;
+                    case 'r':
+                        sb.append('\r');
+                        break;
+                    case '"':
+                        sb.append('\"');
+                        break;
+                    case '\'':
+                        sb.append('\'');
+                        break;
+                    case 'u':
+                        i = handleUnicodePoints(source, sb, text, ++i);
+                        break;
+                    case '\\':
+                        sb.append('\\');
+                        // will be interpreted as regex, so we have to escape it
+                        break;
+                    default:
+                        // unknown escape sequence, pass through as-is, e.g: `...\w...`
+                        sb.append('\\').append(text.charAt(i));
+                }
+                i++;
+            } else {
+                sb.append(text.charAt(i++));
             }
+        }
+        return sb.toString();
+    }
 
-            regexMatcher.appendReplacement(resultString, replacement);
-
+    private static int handleUnicodePoints(Source source, StringBuilder sb, String text, int i) {
+        String unicodeSequence;
+        int startIdx = i + 1;
+        int endIdx = text.indexOf('}', startIdx);
+        unicodeSequence = text.substring(startIdx, endIdx);
+        int length = unicodeSequence.length();
+        if (length < 2 || length > 8) {
+            throw new ParsingException(source, "Unicode sequence should use [2-8] hex digits, [{}] has [{}]",
+                    text.substring(startIdx - 3, endIdx + 1), length);
         }
-        regexMatcher.appendTail(resultString);
+        sb.append(hexToUnicode(source, unicodeSequence));
+        return endIdx;
+    }
 
-        return resultString.toString();
+    private static String hexToUnicode(Source source, String hex) {
+        try {
+            int code = Integer.parseInt(hex, 16);
+            // U+D800—U+DFFF can only be used as surrogate pairs and therefore are not valid character codes
+            if (code >= 0xD800 && code <= 0xDFFF) {
+                throw new ParsingException(source, "Invalid unicode character code, [{}] is a surrogate code", hex);
+            }
+            return String.valueOf(Character.toChars(code));
+        } catch (IllegalArgumentException e) {
+            throw new ParsingException(source, "Invalid unicode character code [{}]", hex);
+        }
     }
 
     private static void checkForSingleQuotedString(Source source, String text, int i) {

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseLexer.java

@@ -33,9 +33,10 @@ class EqlBaseLexer extends Lexer {
     "MAXSPAN", "NOT", "NULL", "OF", "OR", "REGEX", "REGEX_INSENSITIVE", "SEQUENCE", 
     "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", "EQ", "NEQ", "LT", "LTE", 
     "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", "PERCENT", "DOT", "COMMA", 
-    "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", 
-    "IDENTIFIER", "QUOTED_IDENTIFIER", "TILDE_IDENTIFIER", "EXPONENT", "DIGIT", 
-    "LETTER", "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
+    "LB", "RB", "LP", "RP", "PIPE", "STRING_ESCAPE", "HEX_DIGIT", "UNICODE_ESCAPE", 
+    "UNESCAPED_CHARS", "STRING", "INTEGER_VALUE", "DECIMAL_VALUE", "IDENTIFIER", 
+    "QUOTED_IDENTIFIER", "TILDE_IDENTIFIER", "EXPONENT", "DIGIT", "LETTER", 
+    "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
   };
 
   private static final String[] _LITERAL_NAMES = {
@@ -109,170 +110,181 @@ class EqlBaseLexer extends Lexer {
   public ATN getATN() { return _ATN; }
 
   public static final String _serializedATN =
-    "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\2\64\u01cd\b\1\4\2"+
+    "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\2\64\u01e7\b\1\4\2"+
     "\t\2\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4"+
     "\13\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22"+
     "\t\22\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31"+
     "\t\31\4\32\t\32\4\33\t\33\4\34\t\34\4\35\t\35\4\36\t\36\4\37\t\37\4 \t"+
     " \4!\t!\4\"\t\"\4#\t#\4$\t$\4%\t%\4&\t&\4\'\t\'\4(\t(\4)\t)\4*\t*\4+\t"+
     "+\4,\t,\4-\t-\4.\t.\4/\t/\4\60\t\60\4\61\t\61\4\62\t\62\4\63\t\63\4\64"+
-    "\t\64\4\65\t\65\4\66\t\66\3\2\3\2\3\2\3\2\3\3\3\3\3\3\3\3\3\4\3\4\3\4"+
-    "\3\5\3\5\3\5\3\5\3\5\3\5\3\6\3\6\3\6\3\7\3\7\3\7\3\7\3\b\3\b\3\b\3\b\3"+
-    "\b\3\t\3\t\3\t\3\t\3\t\3\n\3\n\3\n\3\n\3\n\3\n\3\13\3\13\3\13\3\13\3\13"+
-    "\3\13\3\13\3\13\3\f\3\f\3\f\3\f\3\r\3\r\3\r\3\r\3\r\3\16\3\16\3\16\3\17"+
-    "\3\17\3\17\3\20\3\20\3\20\3\20\3\20\3\20\3\21\3\21\3\21\3\21\3\21\3\21"+
-    "\3\21\3\22\3\22\3\22\3\22\3\22\3\22\3\22\3\22\3\22\3\23\3\23\3\23\3\23"+
-    "\3\23\3\24\3\24\3\24\3\24\3\24\3\24\3\25\3\25\3\25\3\25\3\25\3\25\3\26"+
-    "\3\26\3\26\3\26\3\26\3\27\3\27\3\30\3\30\3\31\3\31\3\31\3\32\3\32\3\32"+
-    "\3\33\3\33\3\34\3\34\3\34\3\35\3\35\3\36\3\36\3\36\3\37\3\37\3 \3 \3!"+
-    "\3!\3\"\3\"\3#\3#\3$\3$\3%\3%\3&\3&\3\'\3\'\3(\3(\3)\3)\3*\3*\3+\3+\3"+
-    "+\3+\7+\u0109\n+\f+\16+\u010c\13+\3+\3+\3+\3+\3+\7+\u0113\n+\f+\16+\u0116"+
-    "\13+\3+\3+\3+\3+\3+\3+\3+\7+\u011f\n+\f+\16+\u0122\13+\3+\3+\3+\3+\3+"+
-    "\3+\3+\7+\u012b\n+\f+\16+\u012e\13+\3+\3+\3+\3+\3+\3+\7+\u0136\n+\f+\16"+
-    "+\u0139\13+\3+\3+\3+\3+\3+\5+\u0140\n+\3+\5+\u0143\n+\5+\u0145\n+\3,\6"+
-    ",\u0148\n,\r,\16,\u0149\3-\6-\u014d\n-\r-\16-\u014e\3-\3-\7-\u0153\n-"+
-    "\f-\16-\u0156\13-\3-\3-\6-\u015a\n-\r-\16-\u015b\3-\6-\u015f\n-\r-\16"+
-    "-\u0160\3-\3-\7-\u0165\n-\f-\16-\u0168\13-\5-\u016a\n-\3-\3-\3-\3-\6-"+
-    "\u0170\n-\r-\16-\u0171\3-\3-\5-\u0176\n-\3.\3.\5.\u017a\n.\3.\3.\3.\7"+
-    ".\u017f\n.\f.\16.\u0182\13.\3/\3/\3/\3/\7/\u0188\n/\f/\16/\u018b\13/\3"+
-    "/\3/\3\60\3\60\3\60\3\60\7\60\u0193\n\60\f\60\16\60\u0196\13\60\3\60\3"+
-    "\60\3\61\3\61\5\61\u019c\n\61\3\61\6\61\u019f\n\61\r\61\16\61\u01a0\3"+
-    "\62\3\62\3\63\3\63\3\64\3\64\3\64\3\64\7\64\u01ab\n\64\f\64\16\64\u01ae"+
-    "\13\64\3\64\5\64\u01b1\n\64\3\64\5\64\u01b4\n\64\3\64\3\64\3\65\3\65\3"+
-    "\65\3\65\3\65\7\65\u01bd\n\65\f\65\16\65\u01c0\13\65\3\65\3\65\3\65\3"+
-    "\65\3\65\3\66\6\66\u01c8\n\66\r\66\16\66\u01c9\3\66\3\66\4\u0137\u01be"+
-    "\2\67\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f\27\r\31\16\33\17\35"+
-    "\20\37\21!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63\33\65\34\67\359\36"+
-    ";\37= ?!A\"C#E$G%I&K\'M(O)Q*S+U,W-Y.[/]\60_\61a\2c\2e\2g\62i\63k\64\3"+
-    "\2\17\n\2$$))^^ddhhppttvv\6\2\f\f\17\17))^^\6\2\f\f\17\17$$^^\5\2\f\f"+
-    "\17\17$$\5\2\f\f\17\17))\4\2\f\f\17\17\4\2BBaa\3\2bb\4\2GGgg\4\2--//\3"+
-    "\2\62;\4\2C\\c|\5\2\13\f\17\17\"\"\u01f4\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3"+
-    "\2\2\2\2\t\3\2\2\2\2\13\3\2\2\2\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3\2\2\2"+
-    "\2\23\3\2\2\2\2\25\3\2\2\2\2\27\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2\2\2\35"+
-    "\3\2\2\2\2\37\3\2\2\2\2!\3\2\2\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2\2\2\2)"+
-    "\3\2\2\2\2+\3\2\2\2\2-\3\2\2\2\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2\2\2\2"+
-    "\65\3\2\2\2\2\67\3\2\2\2\29\3\2\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2\2\2\2"+
-    "A\3\2\2\2\2C\3\2\2\2\2E\3\2\2\2\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2\2M\3"+
-    "\2\2\2\2O\3\2\2\2\2Q\3\2\2\2\2S\3\2\2\2\2U\3\2\2\2\2W\3\2\2\2\2Y\3\2\2"+
-    "\2\2[\3\2\2\2\2]\3\2\2\2\2_\3\2\2\2\2g\3\2\2\2\2i\3\2\2\2\2k\3\2\2\2\3"+
-    "m\3\2\2\2\5q\3\2\2\2\7u\3\2\2\2\tx\3\2\2\2\13~\3\2\2\2\r\u0081\3\2\2\2"+
-    "\17\u0085\3\2\2\2\21\u008a\3\2\2\2\23\u008f\3\2\2\2\25\u0095\3\2\2\2\27"+
-    "\u009d\3\2\2\2\31\u00a1\3\2\2\2\33\u00a6\3\2\2\2\35\u00a9\3\2\2\2\37\u00ac"+
-    "\3\2\2\2!\u00b2\3\2\2\2#\u00b9\3\2\2\2%\u00c2\3\2\2\2\'\u00c7\3\2\2\2"+
-    ")\u00cd\3\2\2\2+\u00d3\3\2\2\2-\u00d8\3\2\2\2/\u00da\3\2\2\2\61\u00dc"+
-    "\3\2\2\2\63\u00df\3\2\2\2\65\u00e2\3\2\2\2\67\u00e4\3\2\2\29\u00e7\3\2"+
-    "\2\2;\u00e9\3\2\2\2=\u00ec\3\2\2\2?\u00ee\3\2\2\2A\u00f0\3\2\2\2C\u00f2"+
-    "\3\2\2\2E\u00f4\3\2\2\2G\u00f6\3\2\2\2I\u00f8\3\2\2\2K\u00fa\3\2\2\2M"+
-    "\u00fc\3\2\2\2O\u00fe\3\2\2\2Q\u0100\3\2\2\2S\u0102\3\2\2\2U\u0144\3\2"+
-    "\2\2W\u0147\3\2\2\2Y\u0175\3\2\2\2[\u0179\3\2\2\2]\u0183\3\2\2\2_\u018e"+
-    "\3\2\2\2a\u0199\3\2\2\2c\u01a2\3\2\2\2e\u01a4\3\2\2\2g\u01a6\3\2\2\2i"+
-    "\u01b7\3\2\2\2k\u01c7\3\2\2\2mn\7c\2\2no\7p\2\2op\7f\2\2p\4\3\2\2\2qr"+
-    "\7c\2\2rs\7p\2\2st\7{\2\2t\6\3\2\2\2uv\7d\2\2vw\7{\2\2w\b\3\2\2\2xy\7"+
-    "h\2\2yz\7c\2\2z{\7n\2\2{|\7u\2\2|}\7g\2\2}\n\3\2\2\2~\177\7k\2\2\177\u0080"+
-    "\7p\2\2\u0080\f\3\2\2\2\u0081\u0082\7k\2\2\u0082\u0083\7p\2\2\u0083\u0084"+
-    "\7\u0080\2\2\u0084\16\3\2\2\2\u0085\u0086\7l\2\2\u0086\u0087\7q\2\2\u0087"+
-    "\u0088\7k\2\2\u0088\u0089\7p\2\2\u0089\20\3\2\2\2\u008a\u008b\7n\2\2\u008b"+
-    "\u008c\7k\2\2\u008c\u008d\7m\2\2\u008d\u008e\7g\2\2\u008e\22\3\2\2\2\u008f"+
-    "\u0090\7n\2\2\u0090\u0091\7k\2\2\u0091\u0092\7m\2\2\u0092\u0093\7g\2\2"+
-    "\u0093\u0094\7\u0080\2\2\u0094\24\3\2\2\2\u0095\u0096\7o\2\2\u0096\u0097"+
-    "\7c\2\2\u0097\u0098\7z\2\2\u0098\u0099\7u\2\2\u0099\u009a\7r\2\2\u009a"+
-    "\u009b\7c\2\2\u009b\u009c\7p\2\2\u009c\26\3\2\2\2\u009d\u009e\7p\2\2\u009e"+
-    "\u009f\7q\2\2\u009f\u00a0\7v\2\2\u00a0\30\3\2\2\2\u00a1\u00a2\7p\2\2\u00a2"+
-    "\u00a3\7w\2\2\u00a3\u00a4\7n\2\2\u00a4\u00a5\7n\2\2\u00a5\32\3\2\2\2\u00a6"+
-    "\u00a7\7q\2\2\u00a7\u00a8\7h\2\2\u00a8\34\3\2\2\2\u00a9\u00aa\7q\2\2\u00aa"+
-    "\u00ab\7t\2\2\u00ab\36\3\2\2\2\u00ac\u00ad\7t\2\2\u00ad\u00ae\7g\2\2\u00ae"+
-    "\u00af\7i\2\2\u00af\u00b0\7g\2\2\u00b0\u00b1\7z\2\2\u00b1 \3\2\2\2\u00b2"+
-    "\u00b3\7t\2\2\u00b3\u00b4\7g\2\2\u00b4\u00b5\7i\2\2\u00b5\u00b6\7g\2\2"+
-    "\u00b6\u00b7\7z\2\2\u00b7\u00b8\7\u0080\2\2\u00b8\"\3\2\2\2\u00b9\u00ba"+
-    "\7u\2\2\u00ba\u00bb\7g\2\2\u00bb\u00bc\7s\2\2\u00bc\u00bd\7w\2\2\u00bd"+
-    "\u00be\7g\2\2\u00be\u00bf\7p\2\2\u00bf\u00c0\7e\2\2\u00c0\u00c1\7g\2\2"+
-    "\u00c1$\3\2\2\2\u00c2\u00c3\7v\2\2\u00c3\u00c4\7t\2\2\u00c4\u00c5\7w\2"+
-    "\2\u00c5\u00c6\7g\2\2\u00c6&\3\2\2\2\u00c7\u00c8\7w\2\2\u00c8\u00c9\7"+
-    "p\2\2\u00c9\u00ca\7v\2\2\u00ca\u00cb\7k\2\2\u00cb\u00cc\7n\2\2\u00cc("+
-    "\3\2\2\2\u00cd\u00ce\7y\2\2\u00ce\u00cf\7j\2\2\u00cf\u00d0\7g\2\2\u00d0"+
-    "\u00d1\7t\2\2\u00d1\u00d2\7g\2\2\u00d2*\3\2\2\2\u00d3\u00d4\7y\2\2\u00d4"+
-    "\u00d5\7k\2\2\u00d5\u00d6\7v\2\2\u00d6\u00d7\7j\2\2\u00d7,\3\2\2\2\u00d8"+
-    "\u00d9\7<\2\2\u00d9.\3\2\2\2\u00da\u00db\7?\2\2\u00db\60\3\2\2\2\u00dc"+
-    "\u00dd\7?\2\2\u00dd\u00de\7?\2\2\u00de\62\3\2\2\2\u00df\u00e0\7#\2\2\u00e0"+
-    "\u00e1\7?\2\2\u00e1\64\3\2\2\2\u00e2\u00e3\7>\2\2\u00e3\66\3\2\2\2\u00e4"+
-    "\u00e5\7>\2\2\u00e5\u00e6\7?\2\2\u00e68\3\2\2\2\u00e7\u00e8\7@\2\2\u00e8"+
-    ":\3\2\2\2\u00e9\u00ea\7@\2\2\u00ea\u00eb\7?\2\2\u00eb<\3\2\2\2\u00ec\u00ed"+
-    "\7-\2\2\u00ed>\3\2\2\2\u00ee\u00ef\7/\2\2\u00ef@\3\2\2\2\u00f0\u00f1\7"+
-    ",\2\2\u00f1B\3\2\2\2\u00f2\u00f3\7\61\2\2\u00f3D\3\2\2\2\u00f4\u00f5\7"+
-    "\'\2\2\u00f5F\3\2\2\2\u00f6\u00f7\7\60\2\2\u00f7H\3\2\2\2\u00f8\u00f9"+
-    "\7.\2\2\u00f9J\3\2\2\2\u00fa\u00fb\7]\2\2\u00fbL\3\2\2\2\u00fc\u00fd\7"+
-    "_\2\2\u00fdN\3\2\2\2\u00fe\u00ff\7*\2\2\u00ffP\3\2\2\2\u0100\u0101\7+"+
-    "\2\2\u0101R\3\2\2\2\u0102\u0103\7~\2\2\u0103T\3\2\2\2\u0104\u010a\7)\2"+
-    "\2\u0105\u0106\7^\2\2\u0106\u0109\t\2\2\2\u0107\u0109\n\3\2\2\u0108\u0105"+
-    "\3\2\2\2\u0108\u0107\3\2\2\2\u0109\u010c\3\2\2\2\u010a\u0108\3\2\2\2\u010a"+
-    "\u010b\3\2\2\2\u010b\u010d\3\2\2\2\u010c\u010a\3\2\2\2\u010d\u0145\7)"+
-    "\2\2\u010e\u0114\7$\2\2\u010f\u0110\7^\2\2\u0110\u0113\t\2\2\2\u0111\u0113"+
-    "\n\4\2\2\u0112\u010f\3\2\2\2\u0112\u0111\3\2\2\2\u0113\u0116\3\2\2\2\u0114"+
-    "\u0112\3\2\2\2\u0114\u0115\3\2\2\2\u0115\u0117\3\2\2\2\u0116\u0114\3\2"+
-    "\2\2\u0117\u0145\7$\2\2\u0118\u0119\7A\2\2\u0119\u011a\7$\2\2\u011a\u0120"+
-    "\3\2\2\2\u011b\u011c\7^\2\2\u011c\u011f\7$\2\2\u011d\u011f\n\5\2\2\u011e"+
-    "\u011b\3\2\2\2\u011e\u011d\3\2\2\2\u011f\u0122\3\2\2\2\u0120\u011e\3\2"+
-    "\2\2\u0120\u0121\3\2\2\2\u0121\u0123\3\2\2\2\u0122\u0120\3\2\2\2\u0123"+
-    "\u0145\7$\2\2\u0124\u0125\7A\2\2\u0125\u0126\7)\2\2\u0126\u012c\3\2\2"+
-    "\2\u0127\u0128\7^\2\2\u0128\u012b\7)\2\2\u0129\u012b\n\6\2\2\u012a\u0127"+
-    "\3\2\2\2\u012a\u0129\3\2\2\2\u012b\u012e\3\2\2\2\u012c\u012a\3\2\2\2\u012c"+
-    "\u012d\3\2\2\2\u012d\u012f\3\2\2\2\u012e\u012c\3\2\2\2\u012f\u0145\7)"+
-    "\2\2\u0130\u0131\7$\2\2\u0131\u0132\7$\2\2\u0132\u0133\7$\2\2\u0133\u0137"+
-    "\3\2\2\2\u0134\u0136\n\7\2\2\u0135\u0134\3\2\2\2\u0136\u0139\3\2\2\2\u0137"+
-    "\u0138\3\2\2\2\u0137\u0135\3\2\2\2\u0138\u013a\3\2\2\2\u0139\u0137\3\2"+
-    "\2\2\u013a\u013b\7$\2\2\u013b\u013c\7$\2\2\u013c\u013d\7$\2\2\u013d\u013f"+
-    "\3\2\2\2\u013e\u0140\7$\2\2\u013f\u013e\3\2\2\2\u013f\u0140\3\2\2\2\u0140"+
-    "\u0142\3\2\2\2\u0141\u0143\7$\2\2\u0142\u0141\3\2\2\2\u0142\u0143\3\2"+
-    "\2\2\u0143\u0145\3\2\2\2\u0144\u0104\3\2\2\2\u0144\u010e\3\2\2\2\u0144"+
-    "\u0118\3\2\2\2\u0144\u0124\3\2\2\2\u0144\u0130\3\2\2\2\u0145V\3\2\2\2"+
-    "\u0146\u0148\5c\62\2\u0147\u0146\3\2\2\2\u0148\u0149\3\2\2\2\u0149\u0147"+
-    "\3\2\2\2\u0149\u014a\3\2\2\2\u014aX\3\2\2\2\u014b\u014d\5c\62\2\u014c"+
-    "\u014b\3\2\2\2\u014d\u014e\3\2\2\2\u014e\u014c\3\2\2\2\u014e\u014f\3\2"+
-    "\2\2\u014f\u0150\3\2\2\2\u0150\u0154\5G$\2\u0151\u0153\5c\62\2\u0152\u0151"+
-    "\3\2\2\2\u0153\u0156\3\2\2\2\u0154\u0152\3\2\2\2\u0154\u0155\3\2\2\2\u0155"+
-    "\u0176\3\2\2\2\u0156\u0154\3\2\2\2\u0157\u0159\5G$\2\u0158\u015a\5c\62"+
-    "\2\u0159\u0158\3\2\2\2\u015a\u015b\3\2\2\2\u015b\u0159\3\2\2\2\u015b\u015c"+
-    "\3\2\2\2\u015c\u0176\3\2\2\2\u015d\u015f\5c\62\2\u015e\u015d\3\2\2\2\u015f"+
-    "\u0160\3\2\2\2\u0160\u015e\3\2\2\2\u0160\u0161\3\2\2\2\u0161\u0169\3\2"+
-    "\2\2\u0162\u0166\5G$\2\u0163\u0165\5c\62\2\u0164\u0163\3\2\2\2\u0165\u0168"+
-    "\3\2\2\2\u0166\u0164\3\2\2\2\u0166\u0167\3\2\2\2\u0167\u016a\3\2\2\2\u0168"+
-    "\u0166\3\2\2\2\u0169\u0162\3\2\2\2\u0169\u016a\3\2\2\2\u016a\u016b\3\2"+
-    "\2\2\u016b\u016c\5a\61\2\u016c\u0176\3\2\2\2\u016d\u016f\5G$\2\u016e\u0170"+
-    "\5c\62\2\u016f\u016e\3\2\2\2\u0170\u0171\3\2\2\2\u0171\u016f\3\2\2\2\u0171"+
-    "\u0172\3\2\2\2\u0172\u0173\3\2\2\2\u0173\u0174\5a\61\2\u0174\u0176\3\2"+
-    "\2\2\u0175\u014c\3\2\2\2\u0175\u0157\3\2\2\2\u0175\u015e\3\2\2\2\u0175"+
-    "\u016d\3\2\2\2\u0176Z\3\2\2\2\u0177\u017a\5e\63\2\u0178\u017a\t\b\2\2"+
-    "\u0179\u0177\3\2\2\2\u0179\u0178\3\2\2\2\u017a\u0180\3\2\2\2\u017b\u017f"+
-    "\5e\63\2\u017c\u017f\5c\62\2\u017d\u017f\7a\2\2\u017e\u017b\3\2\2\2\u017e"+
-    "\u017c\3\2\2\2\u017e\u017d\3\2\2\2\u017f\u0182\3\2\2\2\u0180\u017e\3\2"+
-    "\2\2\u0180\u0181\3\2\2\2\u0181\\\3\2\2\2\u0182\u0180\3\2\2\2\u0183\u0189"+
-    "\7b\2\2\u0184\u0188\n\t\2\2\u0185\u0186\7b\2\2\u0186\u0188\7b\2\2\u0187"+
-    "\u0184\3\2\2\2\u0187\u0185\3\2\2\2\u0188\u018b\3\2\2\2\u0189\u0187\3\2"+
-    "\2\2\u0189\u018a\3\2\2\2\u018a\u018c\3\2\2\2\u018b\u0189\3\2\2\2\u018c"+
-    "\u018d\7b\2\2\u018d^\3\2\2\2\u018e\u0194\5e\63\2\u018f\u0193\5e\63\2\u0190"+
-    "\u0193\5c\62\2\u0191\u0193\7a\2\2\u0192\u018f\3\2\2\2\u0192\u0190\3\2"+
-    "\2\2\u0192\u0191\3\2\2\2\u0193\u0196\3\2\2\2\u0194\u0192\3\2\2\2\u0194"+
-    "\u0195\3\2\2\2\u0195\u0197\3\2\2\2\u0196\u0194\3\2\2\2\u0197\u0198\7\u0080"+
-    "\2\2\u0198`\3\2\2\2\u0199\u019b\t\n\2\2\u019a\u019c\t\13\2\2\u019b\u019a"+
-    "\3\2\2\2\u019b\u019c\3\2\2\2\u019c\u019e\3\2\2\2\u019d\u019f\5c\62\2\u019e"+
-    "\u019d\3\2\2\2\u019f\u01a0\3\2\2\2\u01a0\u019e\3\2\2\2\u01a0\u01a1\3\2"+
-    "\2\2\u01a1b\3\2\2\2\u01a2\u01a3\t\f\2\2\u01a3d\3\2\2\2\u01a4\u01a5\t\r"+
-    "\2\2\u01a5f\3\2\2\2\u01a6\u01a7\7\61\2\2\u01a7\u01a8\7\61\2\2\u01a8\u01ac"+
-    "\3\2\2\2\u01a9\u01ab\n\7\2\2\u01aa\u01a9\3\2\2\2\u01ab\u01ae\3\2\2\2\u01ac"+
-    "\u01aa\3\2\2\2\u01ac\u01ad\3\2\2\2\u01ad\u01b0\3\2\2\2\u01ae\u01ac\3\2"+
-    "\2\2\u01af\u01b1\7\17\2\2\u01b0\u01af\3\2\2\2\u01b0\u01b1\3\2\2\2\u01b1"+
-    "\u01b3\3\2\2\2\u01b2\u01b4\7\f\2\2\u01b3\u01b2\3\2\2\2\u01b3\u01b4\3\2"+
-    "\2\2\u01b4\u01b5\3\2\2\2\u01b5\u01b6\b\64\2\2\u01b6h\3\2\2\2\u01b7\u01b8"+
-    "\7\61\2\2\u01b8\u01b9\7,\2\2\u01b9\u01be\3\2\2\2\u01ba\u01bd\5i\65\2\u01bb"+
-    "\u01bd\13\2\2\2\u01bc\u01ba\3\2\2\2\u01bc\u01bb\3\2\2\2\u01bd\u01c0\3"+
-    "\2\2\2\u01be\u01bf\3\2\2\2\u01be\u01bc\3\2\2\2\u01bf\u01c1\3\2\2\2\u01c0"+
-    "\u01be\3\2\2\2\u01c1\u01c2\7,\2\2\u01c2\u01c3\7\61\2\2\u01c3\u01c4\3\2"+
-    "\2\2\u01c4\u01c5\b\65\2\2\u01c5j\3\2\2\2\u01c6\u01c8\t\16\2\2\u01c7\u01c6"+
-    "\3\2\2\2\u01c8\u01c9\3\2\2\2\u01c9\u01c7\3\2\2\2\u01c9\u01ca\3\2\2\2\u01ca"+
-    "\u01cb\3\2\2\2\u01cb\u01cc\b\66\2\2\u01ccl\3\2\2\2\'\2\u0108\u010a\u0112"+
-    "\u0114\u011e\u0120\u012a\u012c\u0137\u013f\u0142\u0144\u0149\u014e\u0154"+
-    "\u015b\u0160\u0166\u0169\u0171\u0175\u0179\u017e\u0180\u0187\u0189\u0192"+
-    "\u0194\u019b\u01a0\u01ac\u01b0\u01b3\u01bc\u01be\u01c9\3\2\3\2";
+    "\t\64\4\65\t\65\4\66\t\66\4\67\t\67\48\t8\49\t9\4:\t:\3\2\3\2\3\2\3\2"+
+    "\3\3\3\3\3\3\3\3\3\4\3\4\3\4\3\5\3\5\3\5\3\5\3\5\3\5\3\6\3\6\3\6\3\7\3"+
+    "\7\3\7\3\7\3\b\3\b\3\b\3\b\3\b\3\t\3\t\3\t\3\t\3\t\3\n\3\n\3\n\3\n\3\n"+
+    "\3\n\3\13\3\13\3\13\3\13\3\13\3\13\3\13\3\13\3\f\3\f\3\f\3\f\3\r\3\r\3"+
+    "\r\3\r\3\r\3\16\3\16\3\16\3\17\3\17\3\17\3\20\3\20\3\20\3\20\3\20\3\20"+
+    "\3\21\3\21\3\21\3\21\3\21\3\21\3\21\3\22\3\22\3\22\3\22\3\22\3\22\3\22"+
+    "\3\22\3\22\3\23\3\23\3\23\3\23\3\23\3\24\3\24\3\24\3\24\3\24\3\24\3\25"+
+    "\3\25\3\25\3\25\3\25\3\25\3\26\3\26\3\26\3\26\3\26\3\27\3\27\3\30\3\30"+
+    "\3\31\3\31\3\31\3\32\3\32\3\32\3\33\3\33\3\34\3\34\3\34\3\35\3\35\3\36"+
+    "\3\36\3\36\3\37\3\37\3 \3 \3!\3!\3\"\3\"\3#\3#\3$\3$\3%\3%\3&\3&\3\'\3"+
+    "\'\3(\3(\3)\3)\3*\3*\3+\3+\3+\3,\3,\3-\3-\3-\3-\3-\6-\u0117\n-\r-\16-"+
+    "\u0118\3-\3-\3.\3.\3/\3/\3/\3/\7/\u0123\n/\f/\16/\u0126\13/\3/\3/\3/\3"+
+    "/\3/\3/\7/\u012e\n/\f/\16/\u0131\13/\3/\3/\3/\3/\3/\5/\u0138\n/\3/\5/"+
+    "\u013b\n/\3/\3/\3/\3/\7/\u0141\n/\f/\16/\u0144\13/\3/\3/\3/\3/\3/\3/\3"+
+    "/\7/\u014d\n/\f/\16/\u0150\13/\3/\3/\3/\3/\3/\3/\3/\7/\u0159\n/\f/\16"+
+    "/\u015c\13/\3/\5/\u015f\n/\3\60\6\60\u0162\n\60\r\60\16\60\u0163\3\61"+
+    "\6\61\u0167\n\61\r\61\16\61\u0168\3\61\3\61\7\61\u016d\n\61\f\61\16\61"+
+    "\u0170\13\61\3\61\3\61\6\61\u0174\n\61\r\61\16\61\u0175\3\61\6\61\u0179"+
+    "\n\61\r\61\16\61\u017a\3\61\3\61\7\61\u017f\n\61\f\61\16\61\u0182\13\61"+
+    "\5\61\u0184\n\61\3\61\3\61\3\61\3\61\6\61\u018a\n\61\r\61\16\61\u018b"+
+    "\3\61\3\61\5\61\u0190\n\61\3\62\3\62\5\62\u0194\n\62\3\62\3\62\3\62\7"+
+    "\62\u0199\n\62\f\62\16\62\u019c\13\62\3\63\3\63\3\63\3\63\7\63\u01a2\n"+
+    "\63\f\63\16\63\u01a5\13\63\3\63\3\63\3\64\3\64\3\64\3\64\7\64\u01ad\n"+
+    "\64\f\64\16\64\u01b0\13\64\3\64\3\64\3\65\3\65\5\65\u01b6\n\65\3\65\6"+
+    "\65\u01b9\n\65\r\65\16\65\u01ba\3\66\3\66\3\67\3\67\38\38\38\38\78\u01c5"+
+    "\n8\f8\168\u01c8\138\38\58\u01cb\n8\38\58\u01ce\n8\38\38\39\39\39\39\3"+
+    "9\79\u01d7\n9\f9\169\u01da\139\39\39\39\39\39\3:\6:\u01e2\n:\r:\16:\u01e3"+
+    "\3:\3:\4\u012f\u01d8\2;\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f"+
+    "\27\r\31\16\33\17\35\20\37\21!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63"+
+    "\33\65\34\67\359\36;\37= ?!A\"C#E$G%I&K\'M(O)Q*S+U\2W\2Y\2[\2],_-a.c/"+
+    "e\60g\61i\2k\2m\2o\62q\63s\64\3\2\20\n\2$$))^^ddhhppttvv\5\2\62;CHch\6"+
+    "\2\f\f\17\17$$^^\4\2\f\f\17\17\6\2\f\f\17\17))^^\5\2\f\f\17\17$$\5\2\f"+
+    "\f\17\17))\4\2BBaa\3\2bb\4\2GGgg\4\2--//\3\2\62;\4\2C\\c|\5\2\13\f\17"+
+    "\17\"\"\u020c\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3\2\2\2\2\t\3\2\2\2\2\13\3\2"+
+    "\2\2\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3\2\2\2\2\23\3\2\2\2\2\25\3\2\2\2\2"+
+    "\27\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2\2\2\35\3\2\2\2\2\37\3\2\2\2\2!\3\2"+
+    "\2\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2\2\2\2)\3\2\2\2\2+\3\2\2\2\2-\3\2\2"+
+    "\2\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2\2\2\2\65\3\2\2\2\2\67\3\2\2\2\29\3"+
+    "\2\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2\2\2\2A\3\2\2\2\2C\3\2\2\2\2E\3\2\2"+
+    "\2\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2\2M\3\2\2\2\2O\3\2\2\2\2Q\3\2\2\2\2"+
+    "S\3\2\2\2\2]\3\2\2\2\2_\3\2\2\2\2a\3\2\2\2\2c\3\2\2\2\2e\3\2\2\2\2g\3"+
+    "\2\2\2\2o\3\2\2\2\2q\3\2\2\2\2s\3\2\2\2\3u\3\2\2\2\5y\3\2\2\2\7}\3\2\2"+
+    "\2\t\u0080\3\2\2\2\13\u0086\3\2\2\2\r\u0089\3\2\2\2\17\u008d\3\2\2\2\21"+
+    "\u0092\3\2\2\2\23\u0097\3\2\2\2\25\u009d\3\2\2\2\27\u00a5\3\2\2\2\31\u00a9"+
+    "\3\2\2\2\33\u00ae\3\2\2\2\35\u00b1\3\2\2\2\37\u00b4\3\2\2\2!\u00ba\3\2"+
+    "\2\2#\u00c1\3\2\2\2%\u00ca\3\2\2\2\'\u00cf\3\2\2\2)\u00d5\3\2\2\2+\u00db"+
+    "\3\2\2\2-\u00e0\3\2\2\2/\u00e2\3\2\2\2\61\u00e4\3\2\2\2\63\u00e7\3\2\2"+
+    "\2\65\u00ea\3\2\2\2\67\u00ec\3\2\2\29\u00ef\3\2\2\2;\u00f1\3\2\2\2=\u00f4"+
+    "\3\2\2\2?\u00f6\3\2\2\2A\u00f8\3\2\2\2C\u00fa\3\2\2\2E\u00fc\3\2\2\2G"+
+    "\u00fe\3\2\2\2I\u0100\3\2\2\2K\u0102\3\2\2\2M\u0104\3\2\2\2O\u0106\3\2"+
+    "\2\2Q\u0108\3\2\2\2S\u010a\3\2\2\2U\u010c\3\2\2\2W\u010f\3\2\2\2Y\u0111"+
+    "\3\2\2\2[\u011c\3\2\2\2]\u015e\3\2\2\2_\u0161\3\2\2\2a\u018f\3\2\2\2c"+
+    "\u0193\3\2\2\2e\u019d\3\2\2\2g\u01a8\3\2\2\2i\u01b3\3\2\2\2k\u01bc\3\2"+
+    "\2\2m\u01be\3\2\2\2o\u01c0\3\2\2\2q\u01d1\3\2\2\2s\u01e1\3\2\2\2uv\7c"+
+    "\2\2vw\7p\2\2wx\7f\2\2x\4\3\2\2\2yz\7c\2\2z{\7p\2\2{|\7{\2\2|\6\3\2\2"+
+    "\2}~\7d\2\2~\177\7{\2\2\177\b\3\2\2\2\u0080\u0081\7h\2\2\u0081\u0082\7"+
+    "c\2\2\u0082\u0083\7n\2\2\u0083\u0084\7u\2\2\u0084\u0085\7g\2\2\u0085\n"+
+    "\3\2\2\2\u0086\u0087\7k\2\2\u0087\u0088\7p\2\2\u0088\f\3\2\2\2\u0089\u008a"+
+    "\7k\2\2\u008a\u008b\7p\2\2\u008b\u008c\7\u0080\2\2\u008c\16\3\2\2\2\u008d"+
+    "\u008e\7l\2\2\u008e\u008f\7q\2\2\u008f\u0090\7k\2\2\u0090\u0091\7p\2\2"+
+    "\u0091\20\3\2\2\2\u0092\u0093\7n\2\2\u0093\u0094\7k\2\2\u0094\u0095\7"+
+    "m\2\2\u0095\u0096\7g\2\2\u0096\22\3\2\2\2\u0097\u0098\7n\2\2\u0098\u0099"+
+    "\7k\2\2\u0099\u009a\7m\2\2\u009a\u009b\7g\2\2\u009b\u009c\7\u0080\2\2"+
+    "\u009c\24\3\2\2\2\u009d\u009e\7o\2\2\u009e\u009f\7c\2\2\u009f\u00a0\7"+
+    "z\2\2\u00a0\u00a1\7u\2\2\u00a1\u00a2\7r\2\2\u00a2\u00a3\7c\2\2\u00a3\u00a4"+
+    "\7p\2\2\u00a4\26\3\2\2\2\u00a5\u00a6\7p\2\2\u00a6\u00a7\7q\2\2\u00a7\u00a8"+
+    "\7v\2\2\u00a8\30\3\2\2\2\u00a9\u00aa\7p\2\2\u00aa\u00ab\7w\2\2\u00ab\u00ac"+
+    "\7n\2\2\u00ac\u00ad\7n\2\2\u00ad\32\3\2\2\2\u00ae\u00af\7q\2\2\u00af\u00b0"+
+    "\7h\2\2\u00b0\34\3\2\2\2\u00b1\u00b2\7q\2\2\u00b2\u00b3\7t\2\2\u00b3\36"+
+    "\3\2\2\2\u00b4\u00b5\7t\2\2\u00b5\u00b6\7g\2\2\u00b6\u00b7\7i\2\2\u00b7"+
+    "\u00b8\7g\2\2\u00b8\u00b9\7z\2\2\u00b9 \3\2\2\2\u00ba\u00bb\7t\2\2\u00bb"+
+    "\u00bc\7g\2\2\u00bc\u00bd\7i\2\2\u00bd\u00be\7g\2\2\u00be\u00bf\7z\2\2"+
+    "\u00bf\u00c0\7\u0080\2\2\u00c0\"\3\2\2\2\u00c1\u00c2\7u\2\2\u00c2\u00c3"+
+    "\7g\2\2\u00c3\u00c4\7s\2\2\u00c4\u00c5\7w\2\2\u00c5\u00c6\7g\2\2\u00c6"+
+    "\u00c7\7p\2\2\u00c7\u00c8\7e\2\2\u00c8\u00c9\7g\2\2\u00c9$\3\2\2\2\u00ca"+
+    "\u00cb\7v\2\2\u00cb\u00cc\7t\2\2\u00cc\u00cd\7w\2\2\u00cd\u00ce\7g\2\2"+
+    "\u00ce&\3\2\2\2\u00cf\u00d0\7w\2\2\u00d0\u00d1\7p\2\2\u00d1\u00d2\7v\2"+
+    "\2\u00d2\u00d3\7k\2\2\u00d3\u00d4\7n\2\2\u00d4(\3\2\2\2\u00d5\u00d6\7"+
+    "y\2\2\u00d6\u00d7\7j\2\2\u00d7\u00d8\7g\2\2\u00d8\u00d9\7t\2\2\u00d9\u00da"+
+    "\7g\2\2\u00da*\3\2\2\2\u00db\u00dc\7y\2\2\u00dc\u00dd\7k\2\2\u00dd\u00de"+
+    "\7v\2\2\u00de\u00df\7j\2\2\u00df,\3\2\2\2\u00e0\u00e1\7<\2\2\u00e1.\3"+
+    "\2\2\2\u00e2\u00e3\7?\2\2\u00e3\60\3\2\2\2\u00e4\u00e5\7?\2\2\u00e5\u00e6"+
+    "\7?\2\2\u00e6\62\3\2\2\2\u00e7\u00e8\7#\2\2\u00e8\u00e9\7?\2\2\u00e9\64"+
+    "\3\2\2\2\u00ea\u00eb\7>\2\2\u00eb\66\3\2\2\2\u00ec\u00ed\7>\2\2\u00ed"+
+    "\u00ee\7?\2\2\u00ee8\3\2\2\2\u00ef\u00f0\7@\2\2\u00f0:\3\2\2\2\u00f1\u00f2"+
+    "\7@\2\2\u00f2\u00f3\7?\2\2\u00f3<\3\2\2\2\u00f4\u00f5\7-\2\2\u00f5>\3"+
+    "\2\2\2\u00f6\u00f7\7/\2\2\u00f7@\3\2\2\2\u00f8\u00f9\7,\2\2\u00f9B\3\2"+
+    "\2\2\u00fa\u00fb\7\61\2\2\u00fbD\3\2\2\2\u00fc\u00fd\7\'\2\2\u00fdF\3"+
+    "\2\2\2\u00fe\u00ff\7\60\2\2\u00ffH\3\2\2\2\u0100\u0101\7.\2\2\u0101J\3"+
+    "\2\2\2\u0102\u0103\7]\2\2\u0103L\3\2\2\2\u0104\u0105\7_\2\2\u0105N\3\2"+
+    "\2\2\u0106\u0107\7*\2\2\u0107P\3\2\2\2\u0108\u0109\7+\2\2\u0109R\3\2\2"+
+    "\2\u010a\u010b\7~\2\2\u010bT\3\2\2\2\u010c\u010d\7^\2\2\u010d\u010e\t"+
+    "\2\2\2\u010eV\3\2\2\2\u010f\u0110\t\3\2\2\u0110X\3\2\2\2\u0111\u0112\7"+
+    "^\2\2\u0112\u0113\7w\2\2\u0113\u0114\3\2\2\2\u0114\u0116\7}\2\2\u0115"+
+    "\u0117\5W,\2\u0116\u0115\3\2\2\2\u0117\u0118\3\2\2\2\u0118\u0116\3\2\2"+
+    "\2\u0118\u0119\3\2\2\2\u0119\u011a\3\2\2\2\u011a\u011b\7\177\2\2\u011b"+
+    "Z\3\2\2\2\u011c\u011d\n\4\2\2\u011d\\\3\2\2\2\u011e\u0124\7$\2\2\u011f"+
+    "\u0123\5U+\2\u0120\u0123\5Y-\2\u0121\u0123\5[.\2\u0122\u011f\3\2\2\2\u0122"+
+    "\u0120\3\2\2\2\u0122\u0121\3\2\2\2\u0123\u0126\3\2\2\2\u0124\u0122\3\2"+
+    "\2\2\u0124\u0125\3\2\2\2\u0125\u0127\3\2\2\2\u0126\u0124\3\2\2\2\u0127"+
+    "\u015f\7$\2\2\u0128\u0129\7$\2\2\u0129\u012a\7$\2\2\u012a\u012b\7$\2\2"+
+    "\u012b\u012f\3\2\2\2\u012c\u012e\n\5\2\2\u012d\u012c\3\2\2\2\u012e\u0131"+
+    "\3\2\2\2\u012f\u0130\3\2\2\2\u012f\u012d\3\2\2\2\u0130\u0132\3\2\2\2\u0131"+
+    "\u012f\3\2\2\2\u0132\u0133\7$\2\2\u0133\u0134\7$\2\2\u0134\u0135\7$\2"+
+    "\2\u0135\u0137\3\2\2\2\u0136\u0138\7$\2\2\u0137\u0136\3\2\2\2\u0137\u0138"+
+    "\3\2\2\2\u0138\u013a\3\2\2\2\u0139\u013b\7$\2\2\u013a\u0139\3\2\2\2\u013a"+
+    "\u013b\3\2\2\2\u013b\u015f\3\2\2\2\u013c\u0142\7)\2\2\u013d\u013e\7^\2"+
+    "\2\u013e\u0141\t\2\2\2\u013f\u0141\n\6\2\2\u0140\u013d\3\2\2\2\u0140\u013f"+
+    "\3\2\2\2\u0141\u0144\3\2\2\2\u0142\u0140\3\2\2\2\u0142\u0143\3\2\2\2\u0143"+
+    "\u0145\3\2\2\2\u0144\u0142\3\2\2\2\u0145\u015f\7)\2\2\u0146\u0147\7A\2"+
+    "\2\u0147\u0148\7$\2\2\u0148\u014e\3\2\2\2\u0149\u014a\7^\2\2\u014a\u014d"+
+    "\7$\2\2\u014b\u014d\n\7\2\2\u014c\u0149\3\2\2\2\u014c\u014b\3\2\2\2\u014d"+
+    "\u0150\3\2\2\2\u014e\u014c\3\2\2\2\u014e\u014f\3\2\2\2\u014f\u0151\3\2"+
+    "\2\2\u0150\u014e\3\2\2\2\u0151\u015f\7$\2\2\u0152\u0153\7A\2\2\u0153\u0154"+
+    "\7)\2\2\u0154\u015a\3\2\2\2\u0155\u0156\7^\2\2\u0156\u0159\7)\2\2\u0157"+
+    "\u0159\n\b\2\2\u0158\u0155\3\2\2\2\u0158\u0157\3\2\2\2\u0159\u015c\3\2"+
+    "\2\2\u015a\u0158\3\2\2\2\u015a\u015b\3\2\2\2\u015b\u015d\3\2\2\2\u015c"+
+    "\u015a\3\2\2\2\u015d\u015f\7)\2\2\u015e\u011e\3\2\2\2\u015e\u0128\3\2"+
+    "\2\2\u015e\u013c\3\2\2\2\u015e\u0146\3\2\2\2\u015e\u0152\3\2\2\2\u015f"+
+    "^\3\2\2\2\u0160\u0162\5k\66\2\u0161\u0160\3\2\2\2\u0162\u0163\3\2\2\2"+
+    "\u0163\u0161\3\2\2\2\u0163\u0164\3\2\2\2\u0164`\3\2\2\2\u0165\u0167\5"+
+    "k\66\2\u0166\u0165\3\2\2\2\u0167\u0168\3\2\2\2\u0168\u0166\3\2\2\2\u0168"+
+    "\u0169\3\2\2\2\u0169\u016a\3\2\2\2\u016a\u016e\5G$\2\u016b\u016d\5k\66"+
+    "\2\u016c\u016b\3\2\2\2\u016d\u0170\3\2\2\2\u016e\u016c\3\2\2\2\u016e\u016f"+
+    "\3\2\2\2\u016f\u0190\3\2\2\2\u0170\u016e\3\2\2\2\u0171\u0173\5G$\2\u0172"+
+    "\u0174\5k\66\2\u0173\u0172\3\2\2\2\u0174\u0175\3\2\2\2\u0175\u0173\3\2"+
+    "\2\2\u0175\u0176\3\2\2\2\u0176\u0190\3\2\2\2\u0177\u0179\5k\66\2\u0178"+
+    "\u0177\3\2\2\2\u0179\u017a\3\2\2\2\u017a\u0178\3\2\2\2\u017a\u017b\3\2"+
+    "\2\2\u017b\u0183\3\2\2\2\u017c\u0180\5G$\2\u017d\u017f\5k\66\2\u017e\u017d"+
+    "\3\2\2\2\u017f\u0182\3\2\2\2\u0180\u017e\3\2\2\2\u0180\u0181\3\2\2\2\u0181"+
+    "\u0184\3\2\2\2\u0182\u0180\3\2\2\2\u0183\u017c\3\2\2\2\u0183\u0184\3\2"+
+    "\2\2\u0184\u0185\3\2\2\2\u0185\u0186\5i\65\2\u0186\u0190\3\2\2\2\u0187"+
+    "\u0189\5G$\2\u0188\u018a\5k\66\2\u0189\u0188\3\2\2\2\u018a\u018b\3\2\2"+
+    "\2\u018b\u0189\3\2\2\2\u018b\u018c\3\2\2\2\u018c\u018d\3\2\2\2\u018d\u018e"+
+    "\5i\65\2\u018e\u0190\3\2\2\2\u018f\u0166\3\2\2\2\u018f\u0171\3\2\2\2\u018f"+
+    "\u0178\3\2\2\2\u018f\u0187\3\2\2\2\u0190b\3\2\2\2\u0191\u0194\5m\67\2"+
+    "\u0192\u0194\t\t\2\2\u0193\u0191\3\2\2\2\u0193\u0192\3\2\2\2\u0194\u019a"+
+    "\3\2\2\2\u0195\u0199\5m\67\2\u0196\u0199\5k\66\2\u0197\u0199\7a\2\2\u0198"+
+    "\u0195\3\2\2\2\u0198\u0196\3\2\2\2\u0198\u0197\3\2\2\2\u0199\u019c\3\2"+
+    "\2\2\u019a\u0198\3\2\2\2\u019a\u019b\3\2\2\2\u019bd\3\2\2\2\u019c\u019a"+
+    "\3\2\2\2\u019d\u01a3\7b\2\2\u019e\u01a2\n\n\2\2\u019f\u01a0\7b\2\2\u01a0"+
+    "\u01a2\7b\2\2\u01a1\u019e\3\2\2\2\u01a1\u019f\3\2\2\2\u01a2\u01a5\3\2"+
+    "\2\2\u01a3\u01a1\3\2\2\2\u01a3\u01a4\3\2\2\2\u01a4\u01a6\3\2\2\2\u01a5"+
+    "\u01a3\3\2\2\2\u01a6\u01a7\7b\2\2\u01a7f\3\2\2\2\u01a8\u01ae\5m\67\2\u01a9"+
+    "\u01ad\5m\67\2\u01aa\u01ad\5k\66\2\u01ab\u01ad\7a\2\2\u01ac\u01a9\3\2"+
+    "\2\2\u01ac\u01aa\3\2\2\2\u01ac\u01ab\3\2\2\2\u01ad\u01b0\3\2\2\2\u01ae"+
+    "\u01ac\3\2\2\2\u01ae\u01af\3\2\2\2\u01af\u01b1\3\2\2\2\u01b0\u01ae\3\2"+
+    "\2\2\u01b1\u01b2\7\u0080\2\2\u01b2h\3\2\2\2\u01b3\u01b5\t\13\2\2\u01b4"+
+    "\u01b6\t\f\2\2\u01b5\u01b4\3\2\2\2\u01b5\u01b6\3\2\2\2\u01b6\u01b8\3\2"+
+    "\2\2\u01b7\u01b9\5k\66\2\u01b8\u01b7\3\2\2\2\u01b9\u01ba\3\2\2\2\u01ba"+
+    "\u01b8\3\2\2\2\u01ba\u01bb\3\2\2\2\u01bbj\3\2\2\2\u01bc\u01bd\t\r\2\2"+
+    "\u01bdl\3\2\2\2\u01be\u01bf\t\16\2\2\u01bfn\3\2\2\2\u01c0\u01c1\7\61\2"+
+    "\2\u01c1\u01c2\7\61\2\2\u01c2\u01c6\3\2\2\2\u01c3\u01c5\n\5\2\2\u01c4"+
+    "\u01c3\3\2\2\2\u01c5\u01c8\3\2\2\2\u01c6\u01c4\3\2\2\2\u01c6\u01c7\3\2"+
+    "\2\2\u01c7\u01ca\3\2\2\2\u01c8\u01c6\3\2\2\2\u01c9\u01cb\7\17\2\2\u01ca"+
+    "\u01c9\3\2\2\2\u01ca\u01cb\3\2\2\2\u01cb\u01cd\3\2\2\2\u01cc\u01ce\7\f"+
+    "\2\2\u01cd\u01cc\3\2\2\2\u01cd\u01ce\3\2\2\2\u01ce\u01cf\3\2\2\2\u01cf"+
+    "\u01d0\b8\2\2\u01d0p\3\2\2\2\u01d1\u01d2\7\61\2\2\u01d2\u01d3\7,\2\2\u01d3"+
+    "\u01d8\3\2\2\2\u01d4\u01d7\5q9\2\u01d5\u01d7\13\2\2\2\u01d6\u01d4\3\2"+
+    "\2\2\u01d6\u01d5\3\2\2\2\u01d7\u01da\3\2\2\2\u01d8\u01d9\3\2\2\2\u01d8"+
+    "\u01d6\3\2\2\2\u01d9\u01db\3\2\2\2\u01da\u01d8\3\2\2\2\u01db\u01dc\7,"+
+    "\2\2\u01dc\u01dd\7\61\2\2\u01dd\u01de\3\2\2\2\u01de\u01df\b9\2\2\u01df"+
+    "r\3\2\2\2\u01e0\u01e2\t\17\2\2\u01e1\u01e0\3\2\2\2\u01e2\u01e3\3\2\2\2"+
+    "\u01e3\u01e1\3\2\2\2\u01e3\u01e4\3\2\2\2\u01e4\u01e5\3\2\2\2\u01e5\u01e6"+
+    "\b:\2\2\u01e6t\3\2\2\2(\2\u0118\u0122\u0124\u012f\u0137\u013a\u0140\u0142"+
+    "\u014c\u014e\u0158\u015a\u015e\u0163\u0168\u016e\u0175\u017a\u0180\u0183"+
+    "\u018b\u018f\u0193\u0198\u019a\u01a1\u01a3\u01ac\u01ae\u01b5\u01ba\u01c6"+
+    "\u01ca\u01cd\u01d6\u01d8\u01e3\3\2\3\2";
   public static final ATN _ATN =
     new ATNDeserializer().deserialize(_serializedATN.toCharArray());
   static {

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseParser.java

@@ -31,119 +31,47 @@ class EqlBaseParser extends Parser {
   protected static final PredictionContextCache _sharedContextCache =
     new PredictionContextCache();
   public static final int
-  AND = 1, ANY = 2, BY = 3, FALSE = 4, IN = 5, IN_INSENSITIVE = 6, JOIN = 7, LIKE = 8, LIKE_INSENSITIVE = 9, MAXSPAN = 10, NOT = 11, NULL =
-      12, OF = 13, OR = 14, REGEX = 15, REGEX_INSENSITIVE = 16, SEQUENCE = 17, TRUE = 18, UNTIL = 19, WHERE = 20, WITH = 21, SEQ = 22,
-      ASGN = 23, EQ = 24, NEQ = 25, LT = 26, LTE = 27, GT = 28, GTE = 29, PLUS = 30, MINUS = 31, ASTERISK = 32, SLASH = 33, PERCENT = 34,
-      DOT = 35, COMMA = 36, LB = 37, RB = 38, LP = 39, RP = 40, PIPE = 41, STRING = 42, INTEGER_VALUE = 43, DECIMAL_VALUE = 44, IDENTIFIER =
-          45, QUOTED_IDENTIFIER = 46, TILDE_IDENTIFIER = 47, LINE_COMMENT = 48, BRACKETED_COMMENT = 49, WS = 50;
+    AND=1, ANY=2, BY=3, FALSE=4, IN=5, IN_INSENSITIVE=6, JOIN=7, LIKE=8, LIKE_INSENSITIVE=9, 
+    MAXSPAN=10, NOT=11, NULL=12, OF=13, OR=14, REGEX=15, REGEX_INSENSITIVE=16, 
+    SEQUENCE=17, TRUE=18, UNTIL=19, WHERE=20, WITH=21, SEQ=22, ASGN=23, EQ=24, 
+    NEQ=25, LT=26, LTE=27, GT=28, GTE=29, PLUS=30, MINUS=31, ASTERISK=32, 
+    SLASH=33, PERCENT=34, DOT=35, COMMA=36, LB=37, RB=38, LP=39, RP=40, PIPE=41, 
+    STRING=42, INTEGER_VALUE=43, DECIMAL_VALUE=44, IDENTIFIER=45, QUOTED_IDENTIFIER=46, 
+    TILDE_IDENTIFIER=47, LINE_COMMENT=48, BRACKETED_COMMENT=49, WS=50;
   public static final int
-    RULE_singleStatement = 0, RULE_singleExpression = 1, RULE_statement = 2,
-    RULE_query = 3, RULE_sequenceParams = 4, RULE_sequence = 5, RULE_join = 6,
-    RULE_pipe = 7, RULE_joinKeys = 8, RULE_joinTerm = 9, RULE_sequenceTerm = 10,
-    RULE_subquery = 11, RULE_eventQuery = 12, RULE_eventFilter = 13, RULE_expression = 14,
-    RULE_booleanExpression = 15, RULE_valueExpression = 16, RULE_operatorExpression = 17,
-    RULE_predicate = 18, RULE_primaryExpression = 19, RULE_functionExpression = 20,
-    RULE_functionName = 21, RULE_constant = 22, RULE_comparisonOperator = 23,
-    RULE_booleanValue = 24, RULE_qualifiedName = 25, RULE_identifier = 26,
+    RULE_singleStatement = 0, RULE_singleExpression = 1, RULE_statement = 2, 
+    RULE_query = 3, RULE_sequenceParams = 4, RULE_sequence = 5, RULE_join = 6, 
+    RULE_pipe = 7, RULE_joinKeys = 8, RULE_joinTerm = 9, RULE_sequenceTerm = 10, 
+    RULE_subquery = 11, RULE_eventQuery = 12, RULE_eventFilter = 13, RULE_expression = 14, 
+    RULE_booleanExpression = 15, RULE_valueExpression = 16, RULE_operatorExpression = 17, 
+    RULE_predicate = 18, RULE_primaryExpression = 19, RULE_functionExpression = 20, 
+    RULE_functionName = 21, RULE_constant = 22, RULE_comparisonOperator = 23, 
+    RULE_booleanValue = 24, RULE_qualifiedName = 25, RULE_identifier = 26, 
     RULE_timeUnit = 27, RULE_number = 28, RULE_string = 29, RULE_eventValue = 30;
   public static final String[] ruleNames = {
-    "singleStatement", "singleExpression", "statement", "query", "sequenceParams",
-    "sequence", "join", "pipe", "joinKeys", "joinTerm", "sequenceTerm", "subquery",
-    "eventQuery", "eventFilter", "expression", "booleanExpression", "valueExpression",
-    "operatorExpression", "predicate", "primaryExpression", "functionExpression",
-    "functionName", "constant", "comparisonOperator", "booleanValue", "qualifiedName",
+    "singleStatement", "singleExpression", "statement", "query", "sequenceParams", 
+    "sequence", "join", "pipe", "joinKeys", "joinTerm", "sequenceTerm", "subquery", 
+    "eventQuery", "eventFilter", "expression", "booleanExpression", "valueExpression", 
+    "operatorExpression", "predicate", "primaryExpression", "functionExpression", 
+    "functionName", "constant", "comparisonOperator", "booleanValue", "qualifiedName", 
     "identifier", "timeUnit", "number", "string", "eventValue"
   };
 
   private static final String[] _LITERAL_NAMES = {
-    null, "'and'", "'any'", "'by'", "'false'", "'in'", "'in~'", "'join'",
-      "'like'",
-      "'like~'",
-      "'maxspan'",
-      "'not'",
-      "'null'",
-      "'of'",
-      "'or'",
-      "'regex'",
-      "'regex~'",
-      "'sequence'",
-      "'true'",
-      "'until'",
-      "'where'",
-      "'with'",
-      "':'",
-      "'='",
-      "'=='",
-      "'!='",
-      "'<'",
-      "'<='",
-      "'>'",
-      "'>='",
-      "'+'",
-      "'-'",
-      "'*'",
-      "'/'",
-      "'%'",
-      "'.'",
-      "','",
-      "'['",
-      "']'",
-      "'('",
-      "')'",
-      "'|'"
+    null, "'and'", "'any'", "'by'", "'false'", "'in'", "'in~'", "'join'", 
+    "'like'", "'like~'", "'maxspan'", "'not'", "'null'", "'of'", "'or'", "'regex'", 
+    "'regex~'", "'sequence'", "'true'", "'until'", "'where'", "'with'", "':'", 
+    "'='", "'=='", "'!='", "'<'", "'<='", "'>'", "'>='", "'+'", "'-'", "'*'", 
+    "'/'", "'%'", "'.'", "','", "'['", "']'", "'('", "')'", "'|'"
   };
   private static final String[] _SYMBOLIC_NAMES = {
-      null,
-      "AND",
-      "ANY",
-      "BY",
-      "FALSE",
-      "IN",
-      "IN_INSENSITIVE",
-      "JOIN",
-      "LIKE",
-      "LIKE_INSENSITIVE",
-      "MAXSPAN",
-      "NOT",
-      "NULL",
-      "OF",
-      "OR",
-      "REGEX",
-      "REGEX_INSENSITIVE",
-      "SEQUENCE",
-      "TRUE",
-      "UNTIL",
-      "WHERE",
-      "WITH",
-      "SEQ",
-      "ASGN",
-      "EQ",
-      "NEQ",
-      "LT",
-      "LTE",
-      "GT",
-      "GTE",
-      "PLUS",
-      "MINUS",
-      "ASTERISK",
-      "SLASH",
-      "PERCENT",
-      "DOT",
-      "COMMA",
-      "LB",
-      "RB",
-      "LP",
-      "RP",
-      "PIPE",
-      "STRING",
-      "INTEGER_VALUE",
-      "DECIMAL_VALUE",
-      "IDENTIFIER",
-      "QUOTED_IDENTIFIER",
-      "TILDE_IDENTIFIER",
-      "LINE_COMMENT",
-      "BRACKETED_COMMENT",
-      "WS"
+    null, "AND", "ANY", "BY", "FALSE", "IN", "IN_INSENSITIVE", "JOIN", "LIKE", 
+    "LIKE_INSENSITIVE", "MAXSPAN", "NOT", "NULL", "OF", "OR", "REGEX", "REGEX_INSENSITIVE", 
+    "SEQUENCE", "TRUE", "UNTIL", "WHERE", "WITH", "SEQ", "ASGN", "EQ", "NEQ", 
+    "LT", "LTE", "GT", "GTE", "PLUS", "MINUS", "ASTERISK", "SLASH", "PERCENT", 
+    "DOT", "COMMA", "LB", "RB", "LP", "RP", "PIPE", "STRING", "INTEGER_VALUE", 
+    "DECIMAL_VALUE", "IDENTIFIER", "QUOTED_IDENTIFIER", "TILDE_IDENTIFIER", 
+    "LINE_COMMENT", "BRACKETED_COMMENT", "WS"
   };
   public static final Vocabulary VOCABULARY = new VocabularyImpl(_LITERAL_NAMES, _SYMBOLIC_NAMES);
 
@@ -566,7 +494,7 @@ class EqlBaseParser extends Parser {
       }
       setState(96);
       sequenceTerm();
-      setState(98);
+      setState(98); 
       _errHandler.sync(this);
       _la = _input.LA(1);
       do {
@@ -576,7 +504,7 @@ class EqlBaseParser extends Parser {
         sequenceTerm();
         }
         }
-        setState(100);
+        setState(100); 
         _errHandler.sync(this);
         _la = _input.LA(1);
       } while ( _la==LB );
@@ -657,7 +585,7 @@ class EqlBaseParser extends Parser {
 
       setState(110);
       joinTerm();
-      setState(112);
+      setState(112); 
       _errHandler.sync(this);
       _la = _input.LA(1);
       do {
@@ -667,7 +595,7 @@ class EqlBaseParser extends Parser {
         joinTerm();
         }
         }
-        setState(114);
+        setState(114); 
         _errHandler.sync(this);
         _la = _input.LA(1);
       } while ( _la==LB );
@@ -1177,7 +1105,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_booleanExpression; }
-
+   
     public BooleanExpressionContext() { }
     public void copyFrom(BooleanExpressionContext ctx) {
       super.copyFrom(ctx);
@@ -1364,7 +1292,7 @@ class EqlBaseParser extends Parser {
             }
             break;
           }
-          }
+          } 
         }
         setState(183);
         _errHandler.sync(this);
@@ -1388,7 +1316,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_valueExpression; }
-
+   
     public ValueExpressionContext() { }
     public void copyFrom(ValueExpressionContext ctx) {
       super.copyFrom(ctx);
@@ -1486,7 +1414,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_operatorExpression; }
-
+   
     public OperatorExpressionContext() { }
     public void copyFrom(OperatorExpressionContext ctx) {
       super.copyFrom(ctx);
@@ -1686,7 +1614,7 @@ class EqlBaseParser extends Parser {
             }
             break;
           }
-          }
+          } 
         }
         setState(210);
         _errHandler.sync(this);
@@ -1729,22 +1657,10 @@ class EqlBaseParser extends Parser {
       return getRuleContext(ConstantContext.class,i);
     }
     public TerminalNode SEQ() { return getToken(EqlBaseParser.SEQ, 0); }
-
-    public TerminalNode LIKE() {
-        return getToken(EqlBaseParser.LIKE, 0);
-    }
-
-    public TerminalNode LIKE_INSENSITIVE() {
-        return getToken(EqlBaseParser.LIKE_INSENSITIVE, 0);
-    }
-
-    public TerminalNode REGEX() {
-        return getToken(EqlBaseParser.REGEX, 0);
-    }
-
-    public TerminalNode REGEX_INSENSITIVE() {
-        return getToken(EqlBaseParser.REGEX_INSENSITIVE, 0);
-    }
+    public TerminalNode LIKE() { return getToken(EqlBaseParser.LIKE, 0); }
+    public TerminalNode LIKE_INSENSITIVE() { return getToken(EqlBaseParser.LIKE_INSENSITIVE, 0); }
+    public TerminalNode REGEX() { return getToken(EqlBaseParser.REGEX, 0); }
+    public TerminalNode REGEX_INSENSITIVE() { return getToken(EqlBaseParser.REGEX_INSENSITIVE, 0); }
     public PredicateContext(ParserRuleContext parent, int invokingState) {
       super(parent, invokingState);
     }
@@ -1820,13 +1736,12 @@ class EqlBaseParser extends Parser {
         enterOuterAlt(_localctx, 2);
         {
         setState(226);
-        ((PredicateContext) _localctx).kind = _input.LT(1);
+        ((PredicateContext)_localctx).kind = _input.LT(1);
         _la = _input.LA(1);
-        if (!((((_la) & ~0x3f) == 0
-            && ((1L << _la) & ((1L << LIKE) | (1L << LIKE_INSENSITIVE) | (1L << REGEX) | (1L << REGEX_INSENSITIVE) | (1L << SEQ))) != 0))) {
-            ((PredicateContext) _localctx).kind = (Token) _errHandler.recoverInline(this);
+        if ( !((((_la) & ~0x3f) == 0 && ((1L << _la) & ((1L << LIKE) | (1L << LIKE_INSENSITIVE) | (1L << REGEX) | (1L << REGEX_INSENSITIVE) | (1L << SEQ))) != 0)) ) {
+          ((PredicateContext)_localctx).kind = (Token)_errHandler.recoverInline(this);
         } else {
-            consume();
+          consume();
         }
         setState(227);
         constant();
@@ -1836,13 +1751,12 @@ class EqlBaseParser extends Parser {
         enterOuterAlt(_localctx, 3);
         {
         setState(228);
-        ((PredicateContext) _localctx).kind = _input.LT(1);
+        ((PredicateContext)_localctx).kind = _input.LT(1);
         _la = _input.LA(1);
-        if (!((((_la) & ~0x3f) == 0
-            && ((1L << _la) & ((1L << LIKE) | (1L << LIKE_INSENSITIVE) | (1L << REGEX) | (1L << REGEX_INSENSITIVE) | (1L << SEQ))) != 0))) {
-            ((PredicateContext) _localctx).kind = (Token) _errHandler.recoverInline(this);
+        if ( !((((_la) & ~0x3f) == 0 && ((1L << _la) & ((1L << LIKE) | (1L << LIKE_INSENSITIVE) | (1L << REGEX) | (1L << REGEX_INSENSITIVE) | (1L << SEQ))) != 0)) ) {
+          ((PredicateContext)_localctx).kind = (Token)_errHandler.recoverInline(this);
         } else {
-            consume();
+          consume();
         }
         setState(229);
         match(LP);
@@ -1886,7 +1800,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_primaryExpression; }
-
+   
     public PrimaryExpressionContext() { }
     public void copyFrom(PrimaryExpressionContext ctx) {
       super.copyFrom(ctx);
@@ -2168,7 +2082,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_constant; }
-
+   
     public ConstantContext() { }
     public void copyFrom(ConstantContext ctx) {
       super.copyFrom(ctx);
@@ -2478,7 +2392,7 @@ class EqlBaseParser extends Parser {
             {
             setState(280);
             match(LB);
-            setState(282);
+            setState(282); 
             _errHandler.sync(this);
             _la = _input.LA(1);
             do {
@@ -2488,7 +2402,7 @@ class EqlBaseParser extends Parser {
               match(INTEGER_VALUE);
               }
               }
-              setState(284);
+              setState(284); 
               _errHandler.sync(this);
               _la = _input.LA(1);
             } while ( _la==INTEGER_VALUE );
@@ -2499,7 +2413,7 @@ class EqlBaseParser extends Parser {
           default:
             throw new NoViableAltException(this);
           }
-          }
+          } 
         }
         setState(291);
         _errHandler.sync(this);
@@ -2628,7 +2542,7 @@ class EqlBaseParser extends Parser {
       super(parent, invokingState);
     }
     @Override public int getRuleIndex() { return RULE_number; }
-
+   
     public NumberContext() { }
     public void copyFrom(NumberContext ctx) {
       super.copyFrom(ctx);
@@ -2826,8 +2740,7 @@ class EqlBaseParser extends Parser {
   }
 
   public static final String _serializedATN =
-      "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\3\64\u0135\4\2\t\2"
-          +
+    "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\3\64\u0135\4\2\t\2"+
     "\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4\13"+
     "\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22\t\22"+
     "\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31\t\31"+
@@ -2852,89 +2765,85 @@ class EqlBaseParser extends Parser {
     "\3\33\6\33\u011d\n\33\r\33\16\33\u011e\3\33\7\33\u0122\n\33\f\33\16\33"+
     "\u0125\13\33\3\34\3\34\3\35\3\35\5\35\u012b\n\35\3\36\3\36\5\36\u012f"+
     "\n\36\3\37\3\37\3 \3 \3 \2\4 $!\2\4\6\b\n\f\16\20\22\24\26\30\32\34\36"+
-          " \"$&(*,.\60\62\64\668:<>\2\13\3\2 !\3\2\"$\3\2\7\b\5\2\n\13\21\22\30"
-          + "\30\4\2//\61\61\3\2\32\37\4\2\6\6\24\24\3\2/\60\4\2,,//\u0142\2@\3\2\2"
-          + "\2\4C\3\2\2\2\6F\3\2\2\2\bP\3\2\2\2\nR\3\2\2\2\fW\3\2\2\2\16l\3\2\2\2"
-          + "\20z\3\2\2\2\22\u0086\3\2\2\2\24\u008f\3\2\2\2\26\u0093\3\2\2\2\30\u0097"
-          + "\3\2\2\2\32\u009b\3\2\2\2\34\u009f\3\2\2\2\36\u00a4\3\2\2\2 \u00ad\3\2"
-          + "\2\2\"\u00bf\3\2\2\2$\u00c8\3\2\2\2&\u00f2\3\2\2\2(\u00fb\3\2\2\2*\u00fd"
-          + "\3\2\2\2,\u010b\3\2\2\2.\u0111\3\2\2\2\60\u0113\3\2\2\2\62\u0115\3\2\2"
-          + "\2\64\u0117\3\2\2\2\66\u0126\3\2\2\28\u0128\3\2\2\2:\u012e\3\2\2\2<\u0130"
-          + "\3\2\2\2>\u0132\3\2\2\2@A\5\6\4\2AB\7\2\2\3B\3\3\2\2\2CD\5\36\20\2DE\7"
-          + "\2\2\3E\5\3\2\2\2FJ\5\b\5\2GI\5\20\t\2HG\3\2\2\2IL\3\2\2\2JH\3\2\2\2J"
-          + "K\3\2\2\2K\7\3\2\2\2LJ\3\2\2\2MQ\5\f\7\2NQ\5\16\b\2OQ\5\32\16\2PM\3\2"
-          + "\2\2PN\3\2\2\2PO\3\2\2\2Q\t\3\2\2\2RS\7\27\2\2ST\7\f\2\2TU\7\31\2\2UV"
-          + "\58\35\2V\13\3\2\2\2W`\7\23\2\2XZ\5\22\n\2Y[\5\n\6\2ZY\3\2\2\2Z[\3\2\2"
-          + "\2[a\3\2\2\2\\^\5\n\6\2]_\5\22\n\2^]\3\2\2\2^_\3\2\2\2_a\3\2\2\2`X\3\2"
-          + "\2\2`\\\3\2\2\2`a\3\2\2\2ab\3\2\2\2bd\5\26\f\2ce\5\26\f\2dc\3\2\2\2ef"
-          + "\3\2\2\2fd\3\2\2\2fg\3\2\2\2gj\3\2\2\2hi\7\25\2\2ik\5\26\f\2jh\3\2\2\2"
-          + "jk\3\2\2\2k\r\3\2\2\2ln\7\t\2\2mo\5\22\n\2nm\3\2\2\2no\3\2\2\2op\3\2\2"
-          + "\2pr\5\24\13\2qs\5\24\13\2rq\3\2\2\2st\3\2\2\2tr\3\2\2\2tu\3\2\2\2ux\3"
-          + "\2\2\2vw\7\25\2\2wy\5\24\13\2xv\3\2\2\2xy\3\2\2\2y\17\3\2\2\2z{\7+\2\2"
-          + "{\u0084\7/\2\2|\u0081\5 \21\2}~\7&\2\2~\u0080\5 \21\2\177}\3\2\2\2\u0080"
-          + "\u0083\3\2\2\2\u0081\177\3\2\2\2\u0081\u0082\3\2\2\2\u0082\u0085\3\2\2"
-          + "\2\u0083\u0081\3\2\2\2\u0084|\3\2\2\2\u0084\u0085\3\2\2\2\u0085\21\3\2"
-          + "\2\2\u0086\u0087\7\5\2\2\u0087\u008c\5\36\20\2\u0088\u0089\7&\2\2\u0089"
-          + "\u008b\5\36\20\2\u008a\u0088\3\2\2\2\u008b\u008e\3\2\2\2\u008c\u008a\3"
-          + "\2\2\2\u008c\u008d\3\2\2\2\u008d\23\3\2\2\2\u008e\u008c\3\2\2\2\u008f"
-          + "\u0091\5\30\r\2\u0090\u0092\5\22\n\2\u0091\u0090\3\2\2\2\u0091\u0092\3"
-          + "\2\2\2\u0092\25\3\2\2\2\u0093\u0095\5\30\r\2\u0094\u0096\5\22\n\2\u0095"
-          + "\u0094\3\2\2\2\u0095\u0096\3\2\2\2\u0096\27\3\2\2\2\u0097\u0098\7\'\2"
-          + "\2\u0098\u0099\5\34\17\2\u0099\u009a\7(\2\2\u009a\31\3\2\2\2\u009b\u009c"
-          + "\5\34\17\2\u009c\33\3\2\2\2\u009d\u00a0\7\4\2\2\u009e\u00a0\5> \2\u009f"
-          + "\u009d\3\2\2\2\u009f\u009e\3\2\2\2\u00a0\u00a1\3\2\2\2\u00a1\u00a2\7\26"
-          + "\2\2\u00a2\u00a3\5\36\20\2\u00a3\35\3\2\2\2\u00a4\u00a5\5 \21\2\u00a5"
-          + "\37\3\2\2\2\u00a6\u00a7\b\21\1\2\u00a7\u00a8\7\r\2\2\u00a8\u00ae\5 \21"
-          + "\7\u00a9\u00aa\7/\2\2\u00aa\u00ab\7\17\2\2\u00ab\u00ae\5\30\r\2\u00ac"
-          + "\u00ae\5\"\22\2\u00ad\u00a6\3\2\2\2\u00ad\u00a9\3\2\2\2\u00ad\u00ac\3"
-          + "\2\2\2\u00ae\u00b7\3\2\2\2\u00af\u00b0\f\4\2\2\u00b0\u00b1\7\3\2\2\u00b1"
-          + "\u00b6\5 \21\5\u00b2\u00b3\f\3\2\2\u00b3\u00b4\7\20\2\2\u00b4\u00b6\5"
-          + " \21\4\u00b5\u00af\3\2\2\2\u00b5\u00b2\3\2\2\2\u00b6\u00b9\3\2\2\2\u00b7"
-          + "\u00b5\3\2\2\2\u00b7\u00b8\3\2\2\2\u00b8!\3\2\2\2\u00b9\u00b7\3\2\2\2"
-          + "\u00ba\u00c0\5$\23\2\u00bb\u00bc\5$\23\2\u00bc\u00bd\5\60\31\2\u00bd\u00be"
-          + "\5$\23\2\u00be\u00c0\3\2\2\2\u00bf\u00ba\3\2\2\2\u00bf\u00bb\3\2\2\2\u00c0"
-          + "#\3\2\2\2\u00c1\u00c2\b\23\1\2\u00c2\u00c4\5(\25\2\u00c3\u00c5\5&\24\2"
-          + "\u00c4\u00c3\3\2\2\2\u00c4\u00c5\3\2\2\2\u00c5\u00c9\3\2\2\2\u00c6\u00c7"
-          + "\t\2\2\2\u00c7\u00c9\5$\23\5\u00c8\u00c1\3\2\2\2\u00c8\u00c6\3\2\2\2\u00c9"
-          + "\u00d2\3\2\2\2\u00ca\u00cb\f\4\2\2\u00cb\u00cc\t\3\2\2\u00cc\u00d1\5$"
-          + "\23\5\u00cd\u00ce\f\3\2\2\u00ce\u00cf\t\2\2\2\u00cf\u00d1\5$\23\4\u00d0"
-          + "\u00ca\3\2\2\2\u00d0\u00cd\3\2\2\2\u00d1\u00d4\3\2\2\2\u00d2\u00d0\3\2"
-          + "\2\2\u00d2\u00d3\3\2\2\2\u00d3%\3\2\2\2\u00d4\u00d2\3\2\2\2\u00d5\u00d7"
-          + "\7\r\2\2\u00d6\u00d5\3\2\2\2\u00d6\u00d7\3\2\2\2\u00d7\u00d8\3\2\2\2\u00d8"
-          + "\u00d9\t\4\2\2\u00d9\u00da\7)\2\2\u00da\u00df\5\36\20\2\u00db\u00dc\7"
-          + "&\2\2\u00dc\u00de\5\36\20\2\u00dd\u00db\3\2\2\2\u00de\u00e1\3\2\2\2\u00df"
-          + "\u00dd\3\2\2\2\u00df\u00e0\3\2\2\2\u00e0\u00e2\3\2\2\2\u00e1\u00df\3\2"
-          + "\2\2\u00e2\u00e3\7*\2\2\u00e3\u00f3\3\2\2\2\u00e4\u00e5\t\5\2\2\u00e5"
-          + "\u00f3\5.\30\2\u00e6\u00e7\t\5\2\2\u00e7\u00e8\7)\2\2\u00e8\u00ed\5.\30"
-          + "\2\u00e9\u00ea\7&\2\2\u00ea\u00ec\5.\30\2\u00eb\u00e9\3\2\2\2\u00ec\u00ef"
-          + "\3\2\2\2\u00ed\u00eb\3\2\2\2\u00ed\u00ee\3\2\2\2\u00ee\u00f0\3\2\2\2\u00ef"
-          + "\u00ed\3\2\2\2\u00f0\u00f1\7*\2\2\u00f1\u00f3\3\2\2\2\u00f2\u00d6\3\2"
-          + "\2\2\u00f2\u00e4\3\2\2\2\u00f2\u00e6\3\2\2\2\u00f3\'\3\2\2\2\u00f4\u00fc"
-          + "\5.\30\2\u00f5\u00fc\5*\26\2\u00f6\u00fc\5\64\33\2\u00f7\u00f8\7)\2\2"
-          + "\u00f8\u00f9\5\36\20\2\u00f9\u00fa\7*\2\2\u00fa\u00fc\3\2\2\2\u00fb\u00f4"
-          + "\3\2\2\2\u00fb\u00f5\3\2\2\2\u00fb\u00f6\3\2\2\2\u00fb\u00f7\3\2\2\2\u00fc"
-          + ")\3\2\2\2\u00fd\u00fe\5,\27\2\u00fe\u0107\7)\2\2\u00ff\u0104\5\36\20\2"
-          + "\u0100\u0101\7&\2\2\u0101\u0103\5\36\20\2\u0102\u0100\3\2\2\2\u0103\u0106"
-          + "\3\2\2\2\u0104\u0102\3\2\2\2\u0104\u0105\3\2\2\2\u0105\u0108\3\2\2\2\u0106"
-          +
+    " \"$&(*,.\60\62\64\668:<>\2\13\3\2 !\3\2\"$\3\2\7\b\5\2\n\13\21\22\30"+
+    "\30\4\2//\61\61\3\2\32\37\4\2\6\6\24\24\3\2/\60\4\2,,//\u0142\2@\3\2\2"+
+    "\2\4C\3\2\2\2\6F\3\2\2\2\bP\3\2\2\2\nR\3\2\2\2\fW\3\2\2\2\16l\3\2\2\2"+
+    "\20z\3\2\2\2\22\u0086\3\2\2\2\24\u008f\3\2\2\2\26\u0093\3\2\2\2\30\u0097"+
+    "\3\2\2\2\32\u009b\3\2\2\2\34\u009f\3\2\2\2\36\u00a4\3\2\2\2 \u00ad\3\2"+
+    "\2\2\"\u00bf\3\2\2\2$\u00c8\3\2\2\2&\u00f2\3\2\2\2(\u00fb\3\2\2\2*\u00fd"+
+    "\3\2\2\2,\u010b\3\2\2\2.\u0111\3\2\2\2\60\u0113\3\2\2\2\62\u0115\3\2\2"+
+    "\2\64\u0117\3\2\2\2\66\u0126\3\2\2\28\u0128\3\2\2\2:\u012e\3\2\2\2<\u0130"+
+    "\3\2\2\2>\u0132\3\2\2\2@A\5\6\4\2AB\7\2\2\3B\3\3\2\2\2CD\5\36\20\2DE\7"+
+    "\2\2\3E\5\3\2\2\2FJ\5\b\5\2GI\5\20\t\2HG\3\2\2\2IL\3\2\2\2JH\3\2\2\2J"+
+    "K\3\2\2\2K\7\3\2\2\2LJ\3\2\2\2MQ\5\f\7\2NQ\5\16\b\2OQ\5\32\16\2PM\3\2"+
+    "\2\2PN\3\2\2\2PO\3\2\2\2Q\t\3\2\2\2RS\7\27\2\2ST\7\f\2\2TU\7\31\2\2UV"+
+    "\58\35\2V\13\3\2\2\2W`\7\23\2\2XZ\5\22\n\2Y[\5\n\6\2ZY\3\2\2\2Z[\3\2\2"+
+    "\2[a\3\2\2\2\\^\5\n\6\2]_\5\22\n\2^]\3\2\2\2^_\3\2\2\2_a\3\2\2\2`X\3\2"+
+    "\2\2`\\\3\2\2\2`a\3\2\2\2ab\3\2\2\2bd\5\26\f\2ce\5\26\f\2dc\3\2\2\2ef"+
+    "\3\2\2\2fd\3\2\2\2fg\3\2\2\2gj\3\2\2\2hi\7\25\2\2ik\5\26\f\2jh\3\2\2\2"+
+    "jk\3\2\2\2k\r\3\2\2\2ln\7\t\2\2mo\5\22\n\2nm\3\2\2\2no\3\2\2\2op\3\2\2"+
+    "\2pr\5\24\13\2qs\5\24\13\2rq\3\2\2\2st\3\2\2\2tr\3\2\2\2tu\3\2\2\2ux\3"+
+    "\2\2\2vw\7\25\2\2wy\5\24\13\2xv\3\2\2\2xy\3\2\2\2y\17\3\2\2\2z{\7+\2\2"+
+    "{\u0084\7/\2\2|\u0081\5 \21\2}~\7&\2\2~\u0080\5 \21\2\177}\3\2\2\2\u0080"+
+    "\u0083\3\2\2\2\u0081\177\3\2\2\2\u0081\u0082\3\2\2\2\u0082\u0085\3\2\2"+
+    "\2\u0083\u0081\3\2\2\2\u0084|\3\2\2\2\u0084\u0085\3\2\2\2\u0085\21\3\2"+
+    "\2\2\u0086\u0087\7\5\2\2\u0087\u008c\5\36\20\2\u0088\u0089\7&\2\2\u0089"+
+    "\u008b\5\36\20\2\u008a\u0088\3\2\2\2\u008b\u008e\3\2\2\2\u008c\u008a\3"+
+    "\2\2\2\u008c\u008d\3\2\2\2\u008d\23\3\2\2\2\u008e\u008c\3\2\2\2\u008f"+
+    "\u0091\5\30\r\2\u0090\u0092\5\22\n\2\u0091\u0090\3\2\2\2\u0091\u0092\3"+
+    "\2\2\2\u0092\25\3\2\2\2\u0093\u0095\5\30\r\2\u0094\u0096\5\22\n\2\u0095"+
+    "\u0094\3\2\2\2\u0095\u0096\3\2\2\2\u0096\27\3\2\2\2\u0097\u0098\7\'\2"+
+    "\2\u0098\u0099\5\34\17\2\u0099\u009a\7(\2\2\u009a\31\3\2\2\2\u009b\u009c"+
+    "\5\34\17\2\u009c\33\3\2\2\2\u009d\u00a0\7\4\2\2\u009e\u00a0\5> \2\u009f"+
+    "\u009d\3\2\2\2\u009f\u009e\3\2\2\2\u00a0\u00a1\3\2\2\2\u00a1\u00a2\7\26"+
+    "\2\2\u00a2\u00a3\5\36\20\2\u00a3\35\3\2\2\2\u00a4\u00a5\5 \21\2\u00a5"+
+    "\37\3\2\2\2\u00a6\u00a7\b\21\1\2\u00a7\u00a8\7\r\2\2\u00a8\u00ae\5 \21"+
+    "\7\u00a9\u00aa\7/\2\2\u00aa\u00ab\7\17\2\2\u00ab\u00ae\5\30\r\2\u00ac"+
+    "\u00ae\5\"\22\2\u00ad\u00a6\3\2\2\2\u00ad\u00a9\3\2\2\2\u00ad\u00ac\3"+
+    "\2\2\2\u00ae\u00b7\3\2\2\2\u00af\u00b0\f\4\2\2\u00b0\u00b1\7\3\2\2\u00b1"+
+    "\u00b6\5 \21\5\u00b2\u00b3\f\3\2\2\u00b3\u00b4\7\20\2\2\u00b4\u00b6\5"+
+    " \21\4\u00b5\u00af\3\2\2\2\u00b5\u00b2\3\2\2\2\u00b6\u00b9\3\2\2\2\u00b7"+
+    "\u00b5\3\2\2\2\u00b7\u00b8\3\2\2\2\u00b8!\3\2\2\2\u00b9\u00b7\3\2\2\2"+
+    "\u00ba\u00c0\5$\23\2\u00bb\u00bc\5$\23\2\u00bc\u00bd\5\60\31\2\u00bd\u00be"+
+    "\5$\23\2\u00be\u00c0\3\2\2\2\u00bf\u00ba\3\2\2\2\u00bf\u00bb\3\2\2\2\u00c0"+
+    "#\3\2\2\2\u00c1\u00c2\b\23\1\2\u00c2\u00c4\5(\25\2\u00c3\u00c5\5&\24\2"+
+    "\u00c4\u00c3\3\2\2\2\u00c4\u00c5\3\2\2\2\u00c5\u00c9\3\2\2\2\u00c6\u00c7"+
+    "\t\2\2\2\u00c7\u00c9\5$\23\5\u00c8\u00c1\3\2\2\2\u00c8\u00c6\3\2\2\2\u00c9"+
+    "\u00d2\3\2\2\2\u00ca\u00cb\f\4\2\2\u00cb\u00cc\t\3\2\2\u00cc\u00d1\5$"+
+    "\23\5\u00cd\u00ce\f\3\2\2\u00ce\u00cf\t\2\2\2\u00cf\u00d1\5$\23\4\u00d0"+
+    "\u00ca\3\2\2\2\u00d0\u00cd\3\2\2\2\u00d1\u00d4\3\2\2\2\u00d2\u00d0\3\2"+
+    "\2\2\u00d2\u00d3\3\2\2\2\u00d3%\3\2\2\2\u00d4\u00d2\3\2\2\2\u00d5\u00d7"+
+    "\7\r\2\2\u00d6\u00d5\3\2\2\2\u00d6\u00d7\3\2\2\2\u00d7\u00d8\3\2\2\2\u00d8"+
+    "\u00d9\t\4\2\2\u00d9\u00da\7)\2\2\u00da\u00df\5\36\20\2\u00db\u00dc\7"+
+    "&\2\2\u00dc\u00de\5\36\20\2\u00dd\u00db\3\2\2\2\u00de\u00e1\3\2\2\2\u00df"+
+    "\u00dd\3\2\2\2\u00df\u00e0\3\2\2\2\u00e0\u00e2\3\2\2\2\u00e1\u00df\3\2"+
+    "\2\2\u00e2\u00e3\7*\2\2\u00e3\u00f3\3\2\2\2\u00e4\u00e5\t\5\2\2\u00e5"+
+    "\u00f3\5.\30\2\u00e6\u00e7\t\5\2\2\u00e7\u00e8\7)\2\2\u00e8\u00ed\5.\30"+
+    "\2\u00e9\u00ea\7&\2\2\u00ea\u00ec\5.\30\2\u00eb\u00e9\3\2\2\2\u00ec\u00ef"+
+    "\3\2\2\2\u00ed\u00eb\3\2\2\2\u00ed\u00ee\3\2\2\2\u00ee\u00f0\3\2\2\2\u00ef"+
+    "\u00ed\3\2\2\2\u00f0\u00f1\7*\2\2\u00f1\u00f3\3\2\2\2\u00f2\u00d6\3\2"+
+    "\2\2\u00f2\u00e4\3\2\2\2\u00f2\u00e6\3\2\2\2\u00f3\'\3\2\2\2\u00f4\u00fc"+
+    "\5.\30\2\u00f5\u00fc\5*\26\2\u00f6\u00fc\5\64\33\2\u00f7\u00f8\7)\2\2"+
+    "\u00f8\u00f9\5\36\20\2\u00f9\u00fa\7*\2\2\u00fa\u00fc\3\2\2\2\u00fb\u00f4"+
+    "\3\2\2\2\u00fb\u00f5\3\2\2\2\u00fb\u00f6\3\2\2\2\u00fb\u00f7\3\2\2\2\u00fc"+
+    ")\3\2\2\2\u00fd\u00fe\5,\27\2\u00fe\u0107\7)\2\2\u00ff\u0104\5\36\20\2"+
+    "\u0100\u0101\7&\2\2\u0101\u0103\5\36\20\2\u0102\u0100\3\2\2\2\u0103\u0106"+
+    "\3\2\2\2\u0104\u0102\3\2\2\2\u0104\u0105\3\2\2\2\u0105\u0108\3\2\2\2\u0106"+
     "\u0104\3\2\2\2\u0107\u00ff\3\2\2\2\u0107\u0108\3\2\2\2\u0108\u0109\3\2"+
-          "\2\2\u0109\u010a\7*\2\2\u010a+\3\2\2\2\u010b\u010c\t\6\2\2\u010c-\3\2"
-          + "\2\2\u010d\u0112\7\16\2\2\u010e\u0112\5:\36\2\u010f\u0112\5\62\32\2\u0110"
-          +
+    "\2\2\u0109\u010a\7*\2\2\u010a+\3\2\2\2\u010b\u010c\t\6\2\2\u010c-\3\2"+
+    "\2\2\u010d\u0112\7\16\2\2\u010e\u0112\5:\36\2\u010f\u0112\5\62\32\2\u0110"+
     "\u0112\5<\37\2\u0111\u010d\3\2\2\2\u0111\u010e\3\2\2\2\u0111\u010f\3\2"+
-          "\2\2\u0111\u0110\3\2\2\2\u0112/\3\2\2\2\u0113\u0114\t\7\2\2\u0114\61\3"
-          + "\2\2\2\u0115\u0116\t\b\2\2\u0116\63\3\2\2\2\u0117\u0123\5\66\34\2\u0118"
-          + "\u0119\7%\2\2\u0119\u0122\5\66\34\2\u011a\u011c\7\'\2\2\u011b\u011d\7"
-          + "-\2\2\u011c\u011b\3\2\2\2\u011d\u011e\3\2\2\2\u011e\u011c\3\2\2\2\u011e"
-          + "\u011f\3\2\2\2\u011f\u0120\3\2\2\2\u0120\u0122\7(\2\2\u0121\u0118\3\2"
-          +
+    "\2\2\u0111\u0110\3\2\2\2\u0112/\3\2\2\2\u0113\u0114\t\7\2\2\u0114\61\3"+
+    "\2\2\2\u0115\u0116\t\b\2\2\u0116\63\3\2\2\2\u0117\u0123\5\66\34\2\u0118"+
+    "\u0119\7%\2\2\u0119\u0122\5\66\34\2\u011a\u011c\7\'\2\2\u011b\u011d\7"+
+    "-\2\2\u011c\u011b\3\2\2\2\u011d\u011e\3\2\2\2\u011e\u011c\3\2\2\2\u011e"+
+    "\u011f\3\2\2\2\u011f\u0120\3\2\2\2\u0120\u0122\7(\2\2\u0121\u0118\3\2"+
     "\2\2\u0121\u011a\3\2\2\2\u0122\u0125\3\2\2\2\u0123\u0121\3\2\2\2\u0123"+
-          "\u0124\3\2\2\2\u0124\65\3\2\2\2\u0125\u0123\3\2\2\2\u0126\u0127\t\t\2"
-          + "\2\u0127\67\3\2\2\2\u0128\u012a\5:\36\2\u0129\u012b\7/\2\2\u012a\u0129"
-          + "\3\2\2\2\u012a\u012b\3\2\2\2\u012b9\3\2\2\2\u012c\u012f\7.\2\2\u012d\u012f"
-          + "\7-\2\2\u012e\u012c\3\2\2\2\u012e\u012d\3\2\2\2\u012f;\3\2\2\2\u0130\u0131"
-          + "\7,\2\2\u0131=\3\2\2\2\u0132\u0133\t\n\2\2\u0133?\3\2\2\2\'JPZ^`fjntx"
-          +
+    "\u0124\3\2\2\2\u0124\65\3\2\2\2\u0125\u0123\3\2\2\2\u0126\u0127\t\t\2"+
+    "\2\u0127\67\3\2\2\2\u0128\u012a\5:\36\2\u0129\u012b\7/\2\2\u012a\u0129"+
+    "\3\2\2\2\u012a\u012b\3\2\2\2\u012b9\3\2\2\2\u012c\u012f\7.\2\2\u012d\u012f"+
+    "\7-\2\2\u012e\u012c\3\2\2\2\u012e\u012d\3\2\2\2\u012f;\3\2\2\2\u0130\u0131"+
+    "\7,\2\2\u0131=\3\2\2\2\u0132\u0133\t\n\2\2\u0133?\3\2\2\2\'JPZ^`fjntx"+
     "\u0081\u0084\u008c\u0091\u0095\u009f\u00ad\u00b5\u00b7\u00bf\u00c4\u00c8"+
     "\u00d0\u00d2\u00d6\u00df\u00ed\u00f2\u00fb\u0104\u0107\u0111\u011e\u0121"+
     "\u0123\u012a\u012e";

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/parser/ExpressionTests.java

@@ -67,6 +67,7 @@ public class ExpressionTests extends ESTestCase {
         assertEquals("hello\nworld", unquoteString(source("\"hello\\nworld\"")));
         assertEquals("hello\\\nworld", unquoteString(source("\"hello\\\\\\nworld\"")));
         assertEquals("hello\\\"world", unquoteString(source("\"hello\\\\\\\"world\"")));
+        assertEquals("hello\\world", unquoteString(source("\"hello\\world\"")));
 
         // test for unescaped strings: """...."""
         assertEquals("hello\"world", unquoteString(source("\"\"\"hello\"world\"\"\"")));
@@ -188,6 +189,114 @@ public class ExpressionTests extends ESTestCase {
         assertEquals("line 1:52: token recognition error at: '\"'", e.getMessage());
     }
 
+    public void testUnicodeWithWrongHexDigits() {
+        String[] strings = new String[] { "\"\\u{U1}\"", "\"\\u{00U1}\"", "\"\\u{00AUF}\"" };
+        for (String str : strings) {
+            ParsingException e = expectThrows(ParsingException.class, "Expected syntax error", () -> expr(str));
+            assertEquals("line 1:1: token recognition error at: '" + str.substring(0, str.length() - 3) + "'", e.getMessage());
+        }
+    }
+
+    public void testUnicodeWithWrongNumberOfHexDigits() {
+        ParsingException e = expectThrows(ParsingException.class, "Expected syntax error",
+                () -> expr("\"\\u{}\""));
+        assertEquals("line 1:1: token recognition error at: '\"\\u{}'", e.getMessage());
+
+        String[] strings = new String[] { "\\u{D}", "\\u{123456789}", "\\u{123456789A}" };
+        for (String str : strings) {
+            e = expectThrows(ParsingException.class, "Expected syntax error", () -> expr("\"" + str + "\""));
+            assertEquals("line 1:2: Unicode sequence should use [2-8] hex digits, [" + str + "] has [" + (str.length() - 4) + "]",
+                    e.getMessage());
+        }
+    }
+
+    public void testUnicodeWithWrongCurlyBraces() {
+        ParsingException e = expectThrows(ParsingException.class, "Expected syntax error",
+                () -> expr("\"\\u{}\""));
+        assertEquals("line 1:1: token recognition error at: '\"\\u{}'", e.getMessage());
+
+        String[][] strings = new String[][] {
+                { "\\uad12", "\\ua" },
+                { "\\u{DA12", "\\u{DA12\"" },
+                { "\\u01f0}", "\\u0" }
+        };
+        for (String[] str : strings) {
+            e = expectThrows(ParsingException.class, "Expected syntax error", () -> expr("\"" + str[0] + "\""));
+            assertEquals("line 1:1: token recognition error at: '\"" + str[1] + "'", e.getMessage());
+        }
+    }
+
+    public void testUnicodeWithInvalidUnicodePoints() {
+        String[] strings = new String[] {
+                "\\u{10000000}",
+                "\\u{FFFFFFFa}",
+                "\\u{FFFF0000}",
+        };
+        for (String str : strings) {
+            ParsingException e = expectThrows(ParsingException.class, "Expected syntax error", () -> expr("\"" + str + "\""));
+            assertEquals("line 1:2: Invalid unicode character code [" + str.substring(3, str.length() - 1) +"]", e.getMessage());
+        }
+
+        strings = new String[] {
+                "\\u{d800}",
+                "\\u{dB12}",
+                "\\u{DcF7}",
+                "\\u{dFFF}",
+        };
+        for (String str : strings) {
+            ParsingException e = expectThrows(ParsingException.class, "Expected syntax error", () -> expr("\"" + str + "\""));
+            assertEquals("line 1:2: Invalid unicode character code, [" + str.substring(3, str.length() - 1) +"] is a surrogate code",
+                    e.getMessage());
+        }
+    }
+
+    public void testStringWithUnicodeEscapedChars() {
+        assertEquals(new Literal(null, "foo\\u123foo", DataTypes.KEYWORD), expr("\"foo\\\\u123foo\""));
+        assertEquals(new Literal(null, "foo\\\\u123foo", DataTypes.KEYWORD), expr("\"foo\\\\\\\\u123foo\""));
+        assertEquals(new Literal(null, "foo\\u{123f}oo", DataTypes.KEYWORD), expr("\"foo\\\\u{123f}oo\""));
+        assertEquals(new Literal(null, "foo\\ሿoo", DataTypes.KEYWORD), expr("\"foo\\\\\\u{123f}oo\""));
+        assertEquals(new Literal(null, "foo\\\\u{123f}oo", DataTypes.KEYWORD), expr("\"foo\\\\\\\\u{123f}oo\""));
+
+        String strPadding = randomAlphaOfLength(randomInt(10));
+        String[][] strings = new String[][] {
+            { "\\u{0021}", "!" },
+            { "\\u{41}", "A" },
+            { "\\u{075}", "u" },
+            { "\\u{00Eb}", "ë" },
+            { "\\u{1F0}", "ǰ" },
+            { "\\u{0398}", "Θ" },
+            { "\\u{7e1}", "ߡ" },
+            { "\\u{017e1}", "១" },
+            { "\\u{00002140}", "⅀" },
+            { "\\u{02263}", "≣" },
+            { "\\u{0003289}", "㊉" },
+            { "\\u{06d89}", "涉" },
+            { "\\u{00007c71}", "籱" },
+            { "\\u{1680B}", "𖠋" },
+            { "\\u{01f4a9}", "💩" },
+            { "\\u{0010989}", "\uD802\uDD89"},
+            { "\\u{d7FF}", "\uD7FF"},
+            { "\\u{e000}", "\uE000"},
+            { "\\u{00}", "\u0000"},
+            { "\\u{0000}", "\u0000"},
+            { "\\u{000000}", "\u0000"},
+            { "\\u{00000000}", "\u0000"},
+        };
+
+        StringBuilder sbExpected = new StringBuilder();
+        StringBuilder sbInput = new StringBuilder();
+        for (String[] str : strings) {
+            assertEquals(
+                new Literal(null, strPadding + str[1] + strPadding, DataTypes.KEYWORD),
+                expr('"' + strPadding + str[0] + strPadding + '"')
+            );
+
+            sbInput.append(strPadding).append(str[0]);
+            sbExpected.append(strPadding).append(str[1]);
+        }
+        assertEquals(new Literal(null, sbExpected.toString(), DataTypes.KEYWORD), expr('"' + sbInput.toString() + '"'));
+    }
+
     public void testNumbers() {
         assertEquals(new Literal(null, 8589934592L, DataTypes.LONG), expr("8589934592"));
         assertEquals(new Literal(null, 5, DataTypes.INTEGER), expr("5"));
@@ -380,11 +489,11 @@ public class ExpressionTests extends ESTestCase {
     }
 
     public void testChainedComparisonsDisallowed() {
-        int noComparisions = randomIntBetween(2, 20);
+        int noComparisons = randomIntBetween(2, 20);
         String firstComparator = "";
         String secondComparator = "";
         StringBuilder sb = new StringBuilder("a ");
-        for (int i = 0 ; i < noComparisions; i++) {
+        for (int i = 0 ; i < noComparisons; i++) {
             String comparator = randomFrom("==", "!=", "<", "<=", ">", ">=");
             sb.append(comparator).append(" a ");