EQL: Divergent ignore_unavailable behavior

[rylnd]

EQL queries appear to have differing behavior for the ignore_unavailable option as compared to a standard query.

While a user can perform a regular search across unavailable indexes:

# SETUP: indexes match the auditbeat-* pattern, while none matches foo*

GET auditbeat-*,foo*/_search
// success

GET auditbeat-*,foo*/_eql/search
// index_not_found_exception: no such index [foo*]

This only appears to be an issue with wildcard indexes, since passing a concrete (unavailable) index works as expected:

GET auditbeat-*,foo*/_eql/search
// index_not_found_exception: no such index [foo*]

GET auditbeat-*,foo/_eql/search
// success

Update: one more data point: allow_no_indices can be used to bypass this behavior:

GET auditbeat-*,foo*/_eql/search
// index_not_found_exception: no such index [foo*]

GET auditbeat-*,foo*/_eql/search?allow_no_indices=true
// success

Note: this is a followup to this issue, particularly: this comment.

[elasticmachine]

Pinging @elastic/es-ql (:Query Languages/EQL)

[costin]

This has been solved through #63561 and #63529