Timelion: Cannot escape colons in field names in the metric parameter

[samuelkampa]

Kibana version: 7.9.1

Describe the bug: In Timelion, it is impossible to escape colons (which are treated as delimiters) in field names in the metric parameter. This, in turn, makes it impossible to produce certain visualizations in Timelion. By contrast, it is possible to escape colons in the q parameter, which suggests that this is a bug and not a deliberate design decision.

Steps to reproduce:

1. Seed data with field names that contain colons (e.g., :helloworld).
2. Write a Timelion expression with a metric parameter whose value contains a field name with a colon, and watch it fail as expected (e.g., .es(index=sample*, timefield=timestamp,metric=cardinality::helloworld)).
3. Write a Timelion expression with a metric parameter whose value contains a field name with a colon and attempt to escape colon, and watch it fail (e.g., .es(index=sample*, timefield=timestamp,metric=cardinality:\:helloworld)).

Expected behavior: You should be able to use the \ character to escape colons (and prevent splitting) in the metric parameter, just as you can use the \ character to escape colons in q parameter.

Screenshots (if relevant):

Any additional context: This bug was originally reported almost 3 years ago (#22113). Possible solutions were entertained, but it appears that no solution was implemented.

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[samuelkampa]

@stratoula, any updates on this issue? I suspect it's a one- or two-line fix, and it would solve a major business need for our organization.

[stratoula]

Hey @samuelkampa, we will look into this soonish, thanx for reporting it.

[timroes]

I think we can solve that a bit more simple then with an escape character. We're splitting on : here. I think as a fix, let's just split on the first : and treat everything after the first colon as the field name. That way no one needs to escape it.

[samuelkampa]

@timroes Makes sense to me. Thanks @stratoula and @timroes!