20234 FIX Correct inline help of check_elasticsearch_query search pattern and field names

The inline help of the active check "Query elasticsearch logs"
(`check_elasticsearch_query`) described the wrong query syntax.

The "Search pattern" field claimed that the Kibana query language (KQL) could
be used and linked to the KQL documentation. This was never the case: the check
sends the pattern verbatim as an Elasticsearch `query_string` query to the
`_count` API. The query string syntax is similar to KQL, but a distinct and
separate language. The help now links to the query string documentation and
points out that regular expressions can be embedded by wrapping them in forward
slashes.

The "Fieldnames to query" field claimed that regexp queries were allowed and
linked to the `regexp` query documentation. The entered field names are passed
to the `fields` parameter of the same `query_string` query, which supports
wildcards, not regular expressions. The `regexp` query documented under the old
link matches values within a single named field and is never issued by this
check. The help now describes wildcards and links to the query string
documentation.

This is a documentation fix only, the behavior of the check is unchanged.

CMK-32227

Change-Id: Ic4cbbe486150a43298f6f4d27c7ad23f3900d79a

Author: loocars

.werks/20234.md

@@ -0,0 +1,26 @@
+[//]: # (werk v2)
+# Correct inline help of check_elasticsearch_query search pattern and field names
+
+key        | value
+---------- | ---
+date       | 2026-08-07T05:13:25.426372+00:00
+version    | 2.4.0p36
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+The inline help of the active check "Query elasticsearch logs" (`check_elasticsearch_query`) described the wrong query syntax.
+
+The "Search pattern" field claimed that the Kibana query language (KQL) could be used and linked to the KQL documentation.
+This was never the case: the check sends the pattern verbatim as an Elasticsearch `query_string` query to the `_count` API.
+The query string syntax is similar to KQL, but a distinct and separate language.
+The help now links to the query string documentation and points out that regular expressions can be embedded by wrapping them in forward slashes.
+
+The "Fieldnames to query" field claimed that regexp queries were allowed and linked to the `regexp` query documentation.
+The entered field names are passed to the `fields` parameter of the same `query_string` query, which supports wildcards, not regular expressions.
+The `regexp` query documented under the old link matches values within a single named field and is never issued by this check.
+The help now describes wildcards and links to the query string documentation.
+
+This is a documentation fix only, the behavior of the check is unchanged.

cmk/plugins/elasticsearch/rulesets/elasticsearch_query.py

@@ -103,9 +103,12 @@ def _parameter_form() -> Dictionary:
                     title=Title("Search pattern"),
                     help_text=Help(
                         "Here you can define what search pattern should be used. "
-                        "You can use Kibana query language as described "
-                        '<a href="https://www.elastic.co/guide/en/kibana/current/kuery-query.html"'
-                        'target="_blank">here</a>. To optimize search speed, use defined indices and fields '
+                        "You can use the Elasticsearch query string syntax as described "
+                        '<a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html"'
+                        'target="_blank">here</a>. Note that this is not the Kibana query language (KQL). '
+                        "Regular expressions are supported by wrapping them in forward slashes, "
+                        "for example <tt>name:/joh?n(ath[oa]n)/</tt>. "
+                        "To optimize search speed, use defined indices and fields "
                         "otherwise all indices and fields will be searched."
                     ),
                 ),
@@ -130,8 +133,8 @@ def _parameter_form() -> Dictionary:
                     title=Title("Fieldnames to query"),
                     help_text=Help(
                         "Here you can define fieldnames that should be used "
-                        "in the search. Regexp query is allowed as described "
-                        '<a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html"'
+                        "in the search. Wildcards are allowed as described "
+                        '<a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html"'
                         'target="_blank">here</a>. If you want to speed up your search, '
                         "use defined indices."
                     ),