[7.x] [KQL] Skip slow wildcard checks when query is only * (#96902)

src/plugins/data/common/es_query/kuery/functions/is.test.ts

@@ -70,6 +70,29 @@ describe('kuery functions', () => {
         expect(result).toEqual(expected);
       });
 
+      test('should return an ES match_all query for queries that match all fields and values', () => {
+        const expected = {
+          match_all: {},
+        };
+        const node = nodeTypes.function.buildNode('is', 'n*', '*');
+        const result = is.toElasticsearchQuery(node, {
+          ...indexPattern,
+          fields: indexPattern.fields.filter((field) => field.name.startsWith('n')),
+        });
+
+        expect(result).toEqual(expected);
+      });
+
+      test('should return an ES match_all query for * queries without an index pattern', () => {
+        const expected = {
+          match_all: {},
+        };
+        const node = nodeTypes.function.buildNode('is', '*', '*');
+        const result = is.toElasticsearchQuery(node);
+
+        expect(result).toEqual(expected);
+      });
+
       test('should return an ES multi_match query using default_field when fieldName is null', () => {
         const expected = {
           multi_match: {

src/plugins/data/common/es_query/kuery/functions/is.ts

@@ -46,12 +46,21 @@ export function toElasticsearchQuery(
   const {
     arguments: [fieldNameArg, valueArg, isPhraseArg],
   } = node;
+
+  const isExistsQuery = valueArg.type === 'wildcard' && valueArg.value === wildcard.wildcardSymbol;
+  const isAllFieldsQuery =
+    fieldNameArg.type === 'wildcard' && fieldNameArg.value === wildcard.wildcardSymbol;
+  const isMatchAllQuery = isExistsQuery && isAllFieldsQuery;
+
+  if (isMatchAllQuery) {
+    return { match_all: {} };
+  }
+
   const fullFieldNameArg = getFullFieldNameNode(
     fieldNameArg,
     indexPattern,
     context?.nested ? context.nested.path : undefined
   );
-  const fieldName = ast.toElasticsearchQuery(fullFieldNameArg);
   const value = !isUndefined(valueArg) ? ast.toElasticsearchQuery(valueArg) : valueArg;
   const type = isPhraseArg.value ? 'phrase' : 'best_fields';
   if (fullFieldNameArg.value === null) {
@@ -86,13 +95,8 @@ export function toElasticsearchQuery(
     });
   }
 
-  const isExistsQuery = valueArg.type === 'wildcard' && (value as any) === '*';
-  const isAllFieldsQuery =
-    (fullFieldNameArg.type === 'wildcard' && ((fieldName as unknown) as string) === '*') ||
-    (fields && indexPattern && fields.length === indexPattern.fields.length);
-  const isMatchAllQuery = isExistsQuery && isAllFieldsQuery;
-
-  if (isMatchAllQuery) {
+  // Special case for wildcards where there are no fields or all fields share the same prefix
+  if (isExistsQuery && (!fields?.length || fields?.length === indexPattern?.fields.length)) {
     return { match_all: {} };
   }