[ES|QL] fix column name detection

[drewdaemon]

Summary

1. Fixes the column name detection (bug introduced in [ES|QL] improve available column lists #233221)

Before

After

2. Makes case changes bust the columns cache. To do this I had to make the cache keys sections of the original query, since there's no way to preserve casing through a parse-serialize process. The side effect is that there will be more cache misses.

This fixes this case (pre-existing bug)

Screen.Recording.2025-09-11.at.2.28.15.PM.mov

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!

[drewdaemon]

/ci

[drewdaemon]

/ci

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 6809d3c

Failed CI Steps

• Jest Tests #6
• Jest Tests #6
• FTR Configs #136
• FTR Configs #136

Test Failures

• [job] [logs] Jest Tests #6 / column escaping recognizes escaped fields
• [job] [logs] Jest Tests #6 / column escaping recognizes escaped fields
• [job] [logs] Jest Tests #6 / getQueryForFields should convert FORK branches into vanilla queries
• [job] [logs] Jest Tests #6 / getQueryForFields should convert FORK branches into vanilla queries
• [job] [logs] Jest Tests #6 / getQueryForFields should convert multiple EVAL expressions into separate EVAL commands
• [job] [logs] Jest Tests #6 / getQueryForFields should convert multiple EVAL expressions into separate EVAL commands
• [job] [logs] Jest Tests #6 / getQueryForFields should return everything up till the last command
• [job] [logs] Jest Tests #6 / getQueryForFields should return everything up till the last command
• [job] [logs] FTR Configs #136 / InfraOps App feature controls infrastructure security global infrastructure all privileges infrastructure landing page with data shows Wafflemap
• [job] [logs] FTR Configs #136 / InfraOps App feature controls infrastructure security global infrastructure all privileges infrastructure landing page with data shows Wafflemap

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
onechat	248.6KB	248.5KB	-102.0B

History

• 💔 Build #338466 failed ac79f9f

[drewdaemon]

@stratoula before I go to the effort of debugging tests and stuff, can you confirm that you agree with the overall decisions I made here? They are described in the PR description.

[stratoula]

the 2nd is a good catch, it makes sense yes (unfortunately...). Let's create 2 PRs though. The one to solve quickly the regression (it is very bad, I dont want to land in serverless) and the other the existing bug. I want to test the latter well so it might take more time to get merged in main

[drewdaemon]

Makes sense, I'll split them out and we'll get the first fix in

[drewdaemon]

Waiting on #234986