[Vis skill] Fixes ES|QL escaping drift during visualization config generation

[mbondyra]

Summary

Fixes ES|QL escaping drift during visualization config generation.

What Was Not Working

generate_esql produced the correct query for a GROK pattern:

| GROK message "%{IP} - - \\[%{DATA}\\] \"%{WORD:method} %{DATA}\""

But when the visualization config was generated, the query embedded in visualization.data_source.query lost one escaping level for the bracket regex:

| GROK message "%{IP} - - \[%{DATA}\] \"%{WORD:method} %{DATA}\""

That happened because the prompt asked the model to manually place raw ES|QL inside a JSON string. For ES|QL containing backslashes and quotes, JSON serialization needs an additional escaping layer. The model-generated visualization looked correct visually, but after JSON parsing it no longer matched the authoritative ES|QL.

Description

This change ensures visualization configs preserve the ES|QL query produced by the graph. The prompt now embeds the ES|QL query as a JSON-encoded string, preventing raw interpolation from dropping escape levels for patterns like GROK.
Before:

After:

Test Plan

• node scripts/jest x-pack/platform/packages/shared/agent-builder/agent-builder-tools-base/visualization/graph_lens.test.ts
• node scripts/eslint x-pack/platform/packages/shared/agent-builder/agent-builder-tools-base/visualization/graph_lens.ts x-pack/platform/packages/shared/agent-builder/agent-builder-tools-base/visualization/graph_lens.test.ts x-pack/platform/packages/shared/agent-builder/agent-builder-tools-base/visualization/prompts.ts

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• See some risk examples
• ...

[infra-vault-gh-plugin-prod]

Pinging @elastic/kibana-presentation (Team:Presentation)

[kibanamachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 75b5fba
• Build duration: 76 mins

Failed CI Steps

• FTR Configs #116
• Scout Lane #9 - stateful-classic / default

Test Failures

• [job] [logs] FTR Configs #116 / Discover discover in space Storing search sessions in space Saves and restores a session
• [job] [logs] Scout Lane #9 - stateful-classic / default / local-stateful-classic - UptimeIntegrationDeprecation - returns true when non-managed synthetics policies exist

Metrics [docs]

✅ unchanged

[kibanamachine]

Starting backport for target branches: 9.4

https://github.com/elastic/kibana/actions/runs/26940432770

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	9.4	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 272493

Questions ?

Please refer to the Backport tool documentation

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra

[kibanamachine]

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 272493 locally
cc: @mbondyra