[8.x] [Inventory][ECO] Fix asKqlFilter (elastic#200984) (elastic#201135)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Inventory][ECO] Fix asKqlFilter
(elastic#200984)](elastic#200984)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Carlos
Crespo","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-11-21T12:04:53Z","message":"[Inventory][ECO]
Fix asKqlFilter (elastic#200984)\n\nfixes
[elastic#200981](https://github.com/elastic/kibana/issues/200981)\r\n\r\n##
Summary\r\n\r\nThis PR fixes a problem with the asKqlFilter throwing an
error when\r\nbuilding filters with string containing special
characters.","sha":"8f8a671567f429814f049965db5dbf2a92582c04","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","backport:prev-major","Team:obs-ux-infra_services","Team:obs-entities"],"title":"[Inventory][ECO]
Fix
asKqlFilter","number":200984,"url":"https://github.com/elastic/kibana/pull/200984","mergeCommit":{"message":"[Inventory][ECO]
Fix asKqlFilter (elastic#200984)\n\nfixes
[elastic#200981](https://github.com/elastic/kibana/issues/200981)\r\n\r\n##
Summary\r\n\r\nThis PR fixes a problem with the asKqlFilter throwing an
error when\r\nbuilding filters with string containing special
characters.","sha":"8f8a671567f429814f049965db5dbf2a92582c04"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/200984","number":200984,"mergeCommit":{"message":"[Inventory][ECO]
Fix asKqlFilter (elastic#200984)\n\nfixes
[elastic#200981](https://github.com/elastic/kibana/issues/200981)\r\n\r\n##
Summary\r\n\r\nThis PR fixes a problem with the asKqlFilter throwing an
error when\r\nbuilding filters with string containing special
characters.","sha":"8f8a671567f429814f049965db5dbf2a92582c04"}}]}]
BACKPORT-->

Co-authored-by: Carlos Crespo <[email protected]>

x-pack/plugins/entity_manager/public/lib/entity_client.test.ts

@@ -39,7 +39,22 @@ describe('EntityClient', () => {
       };
 
       const result = entityClient.asKqlFilter(entityLatest);
-      expect(result).toEqual('service.name: my-service');
+      expect(result).toEqual('service.name: "my-service"');
+    });
+
+    it('should return the kql filter when an indentity field value contain special characters', () => {
+      const entityLatest: EntityInstance = {
+        entity: {
+          ...commonEntityFields.entity,
+          identity_fields: ['host.name', 'foo.bar'],
+        },
+        host: {
+          name: 'my-host:some-value:some-other-value',
+        },
+      };
+
+      const result = entityClient.asKqlFilter(entityLatest);
+      expect(result).toEqual('host.name: "my-host:some-value:some-other-value"');
     });
 
     it('should return the kql filter when indentity_fields is composed by multiple fields', () => {
@@ -56,7 +71,7 @@ describe('EntityClient', () => {
       };
 
       const result = entityClient.asKqlFilter(entityLatest);
-      expect(result).toEqual('(service.name: my-service AND service.environment: staging)');
+      expect(result).toEqual('(service.name: "my-service" AND service.environment: "staging")');
     });
 
     it('should ignore fields that are not present in the entity', () => {
@@ -71,7 +86,7 @@ describe('EntityClient', () => {
       };
 
       const result = entityClient.asKqlFilter(entityLatest);
-      expect(result).toEqual('host.name: my-host');
+      expect(result).toEqual('host.name: "my-host"');
     });
   });
 

x-pack/plugins/entity_manager/public/lib/entity_client.ts

@@ -95,7 +95,7 @@ export class EntityClient {
     const identityFieldsValue = this.getIdentityFieldsValue(entityInstance);
 
     const nodes: KueryNode[] = Object.entries(identityFieldsValue).map(([identityField, value]) => {
-      return nodeTypes.function.buildNode('is', identityField, value);
+      return nodeTypes.function.buildNode('is', identityField, `"${value}"`);
     });
 
     if (nodes.length === 0) return '';