Add KQL syntax highlighting for kuery code blocks (#2677)

Replace the JSON fallback for `kuery` code blocks with a dedicated
highlight.js language definition based on the KQL grammar from Kibana.

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

docs/testing/custom-highlighters.md

@@ -73,6 +73,38 @@ modulo(10, 0.5)
 
 
 
+## KQL
+
+Simple field-value query:
+
+```kuery
+status: active
+```
+
+Boolean operators and quoted strings:
+
+```kuery
+status: active and extension: "php"
+```
+
+Wildcards and negation:
+
+```kql
+machine.os: win* and not status: 503
+```
+
+Nested queries:
+
+```kql
+items: { name: "laptop" and price > 500 }
+```
+
+Grouped values with range operators:
+
+```kuery
+response: (200 or 404) and bytes >= 1000
+```
+
  ## ESQL
 
 

src/Elastic.Documentation.Site/Assets/hljs.ts

@@ -165,6 +165,52 @@ hljs.registerLanguage('painless', function () {
     }
 })
 
+hljs.registerLanguage('kuery', function () {
+    return {
+        case_insensitive: true,
+        keywords: {
+            keyword: 'and or not',
+            literal: ['true', 'false', 'null'],
+        },
+        contains: [
+            // Field names followed by : or range operators
+            {
+                scope: 'attribute',
+                match: /[a-zA-Z_][a-zA-Z0-9._]*(?=\s*(?::|<=|>=|<|>))/,
+            },
+            // Quoted strings
+            {
+                scope: 'string',
+                begin: /"/,
+                end: /"/,
+                contains: [
+                    {
+                        scope: 'char.escape',
+                        match: /\\[\\"\t\r\n]|\\u[0-9a-fA-F]{4}/,
+                    },
+                ],
+            },
+            // Range and match operators
+            {
+                scope: 'operator',
+                match: /<=|>=|<|>|:/,
+            },
+            // Wildcards
+            {
+                scope: 'operator',
+                match: /\*/,
+            },
+            // Parentheses and braces (grouping / nested queries)
+            {
+                scope: 'punctuation',
+                match: /[(){}]/,
+            },
+            NUMBER,
+        ],
+    }
+})
+hljs.registerAliases(['kql'], { languageName: 'kuery' })
+
 hljs.addPlugin(mergeHTMLPlugin)
 
 // The unescaped HTML warning is caused by the mergeHTMLPlugin which we are using

src/Elastic.Markdown/Myst/CodeBlocks/EnhancedCodeBlockParser.cs

@@ -98,7 +98,6 @@ public override bool Close(BlockProcessor processor, Block block)
 			"terminal" => "bash",
 			"painless" => "java",
 			//TODO support these natively
-			"kuery" => "json",
 			"lucene" => "json",
 			_ => codeBlock.Language
 		};

src/Elastic.Markdown/Myst/CodeBlocks/SupportedLanguages.cs

@@ -44,12 +44,13 @@ public static class CodeBlock
 		{ "xml", "html, xhtml, rss, atom, xjb, xsd, xsl, plist, svg" }, // HTML, XML
 		{ "yml", "yaml" }, // YAML
 
-		//CUSTOM, Elastic language we wrote highlighters for
-		{ "apiheader", "" },
-		{ "eql", "" },
-		{ "esql", "" },
-		{ "mermaid", "" },
-		{ "painless", "" }
+	//CUSTOM, Elastic language we wrote highlighters for
+	{ "apiheader", "" },
+	{ "eql", "" },
+	{ "esql", "" },
+	{ "kuery", "kql" },
+	{ "mermaid", "" },
+	{ "painless", "" }
 	};
 
 	public static HashSet<string> Languages { get; } = new(