EQL: Update between() case handling and tests

[rw-access]

Closes #56749

• Made the between() function configuration aware and remove the deprecated case_sensitive argument.
• Updated the null handling to pass tests and match this specification
  • if greedy is unspecified, then it is set to false (unchanged)
  • if any of the input arguments (source, left, right, greedy) are null, then the function will return null
  • if left is not in the string source or right is not in the string source, then null is returned
• Updated the handling for empty strings to match the specs/test
  • if right is an empty string and greedy is true, then the rest of the string after left is consumed

[elasticmachine]

Pinging @elastic/es-ql (:Query Languages/EQL)

[costin]

I'll be on PTO in the upcoming weeks so I removed myself from the reviewers list.
Please wait for both their approval before merging this in.

Thanks,

[matriv]

Looks good, but maybe add some test that if either of the args is null => null is returned.
And from what I see we need to update the docs to describe that null behaviour.

[matriv]

Looks good, but maybe add some test that if either of the args is null => null is returned.
And from what I see we need to update the docs to describe that null behaviour.

@rw-access Please don't forget ^^ .

[rw-access]

@matriv re: null behavior

I was relying on these tests

elasticsearch/x-pack/plugin/eql/src/test/resources/test_string_functions.toml

Lines 1 to 58 in e9b1fa5

	[between]
	description = "Test the proper evaluation of the `between` function"
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", null, "planet")'
	# expected = null
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "welcome", null)'
	# expected = null
	[[between.fold.tests]]
	expression = 'between(null, "welcome", "planet")'
	# expected = null
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "welcome", "planet")'
	expected = " to the "
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "welcome", "village")'
	# expected = null
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "goodbye", "planet")'
	# expected = null
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "welcome", "e", false)'
	expected = " to th"
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "welcome", "e", true)'
	expected = " to the plan"
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "welcome", "x", false)'
	# expected = null
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "welcome", "x", true)'
	# expected = null
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "", "x", true)'
	# expected = null
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "", "", true)'
	expected = "welcome to the planet"
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "", "", false)'
	expected = ""
	[[between.fold.tests]]
	expression = 'between("welcome to the planet", "", "planet", false)'
	expected = "welcome to the "

but I'll add more tests to

elasticsearch/x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/expression/function/scalar/string/StringUtilsTests.java

Line 81 in 5c978ac

public void testBetweenNullOrEmptyString() throws Exception {

[matriv]

Ah, I see, not insisting, just it would be nice to have a couple in Java unit tests too.

[astefan]

LGTM in general. I agree with @matriv about Java unit tests. The more, the better.
Also, it's surprising to me that the case sensitivity for between didn't make it for the first (experimental) release of eql.

[astefan]

Since the number of optional parameters is not needed anymore, maybe we should remove it from FunctionRegistry.

[rw-access]

@elasticmachine update branch