[Internal]: ES|QL breaking change

[yctercero]

Description

ES|QL is introducing a breaking syntax change. While we don't believe it will affect a large number of users and is being documented by their team, we feel we should also add it as a breaking change for 8.19/9.1 as some user's rules could begin to fail.

What's changing:
Updating the grammar would mean that partial quoting would no longer be allowed; the following kinds of queries would be early rejected by ANTLR's lexer and parser (since they mix unquoted and quoted strings)

Prebuilt rules seem to be safe, but it would be any user custom rules utilizing old syntax that could begin seeing failures. We should point user to new syntax.

Per the linked issue, if user hit this error, they will:

Users will have to rewrite smaller parts of their affected ES|QL CCS queries to adapt to the newer syntax.

Resources

Ticket describing change: https://github.com/elastic/dev/issues/3166

Which documentation set does this change impact?

Elastic On-Prem and Cloud (all)

Feature differences

Please see the in depth details here: https://github.com/elastic/dev/issues/3166

What release is this request related to?

8.19/9.1

Serverless release

I believe it's already in.

Collaboration model

The documentation team

Point of contact.

Main contact: @yctercero
Stakeholders: @yctercero @approksiu

[kilfoyle]

@natasha-moore-elastic This looks like a Developer docs change to me but I see that you were assigned. Please feel free to unassign yourself or to correct me if I've got it wrong. :-)

[natasha-moore-elastic]

@natasha-moore-elastic This looks like a Developer docs change to me but I see that you were assigned. Please feel free to unassign yourself or to correct me if I've got it wrong. :-)

Hey @kilfoyle, I was tagged because I'm the point person for Security release notes, and this, as well as #1976, are requests to add the breaking change and known issue to the Security release notes. (That's not explicitly stated here, but that's my understanding based on a previous thread with @yctercero).
That said, since my sprint is pretty packed, I wouldn't mind the Developer docs taking these two requests over if there's bandwidth (maybe at least for serverless release notes?) :)

[florent-leborgne]

@leemthompo this was pointed out as probably relevant for serverless release notes. It mentions ES|QL CCS queries (which are currently documented as not supported on serverless), but I believe this is not necessarily limited to ES|QL CCS, so might still be relevant to share this breaking change there as well. Likewise, this issue comes from the Security solution side, but this is a general ES|QL change.