[BUG] ppl retruns syntax error when field name is the ppl keyword

[cashlalala]

What is the bug?
PPL failed to parse when some fileds in log are PPL keywords.

How can one reproduce the bug?

1. Generate a log like { "log": "test mesg", "timestamp": "2022-07-28 22:45:00" } in index logstash-2022.07.28
2. Query the data by source=logstash-2022.07.28 | parse log "(?<almsg>\w+).*"
3. UI shows 400 client error.

What is the expected behavior?
Return parsed fields correctly

What is your host/environment?

• OS: ubuntu 20.04 (but I run the opensearch & dashboard in docker)
• Version: opensearch 2.1.0, opensearch-dashboard 2.1.0
• Plugins: default plugins in docker images opensearch 2.1.0

Do you have any screenshots?

Do you have any additional context?
Is there any escape grammar for the scenario? I have tried to find in document but found nothing.
Or please show me the documentation I can refer.

Many thanks!

[Yury-Fridlyand]

Need to extend keywordsCanBeId in ANTRL for PPL and SQL, see OpenSearchPPLParser.g4 and OpenSearchSQLIdentifierParser.g4:
https://github.com/opensearch-project/sql/blob/main/ppl/src/main/antlr/OpenSearchPPLParser.g4#L486-L492
https://github.com/opensearch-project/sql/blob/main/sql/src/main/antlr/OpenSearchSQLIdentifierParser.g4#L60-L66

[cashlalala]

Thx! That helps!

[MaxKsyunz]

@Yury-Fridlyand don't we still need to make this fix?

[Yury-Fridlyand]

I think yes