[FR] Add white space checking for KQL parse

[eric-forte-elastic]

Issues

#2700

Summary

This addresses an issue where lark parses KQL queries without whitespace around certain tokens, where KQL does not.

E.g. "Get-NetComputerSiteName" or "Get-NetLocalGroup" vs "Get-NetComputerSiteName" or"Get-NetLocalGroup". Both of which parse via lark/ANTLR, but the second fails in Kibana.

Some notes about alternative implementations:

1. We don't want to update the grammar because we need to ignore white space
2. We don't want to use regex pre-processing because it will catch things like "category" as invalid unavoidably

This approach adds a post-processing step to the lark parsing to tell us where the and and or tokens are in the original string, then compare to see if those tokens locations have the appropriate spacing.

Note since this PR updates the KQL lib please make sure to update the KQL lib version appropriately.

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[brokensound77]

This should probably be handled in the grammar instead

[eric-forte-elastic]

This should probably be handled in the grammar instead

The current grammar requires white space to be ignored. I think the way you are suggesting would require a refactor of both the grammar and the parsing to handle this. This would not only be a refactor/overhaul but in effect a full replacement as most of not all of the code would need to be updated compared to the relatively minor change I am suggesting.