EQL: [Test] Add a test for identifier as eventType

[matriv]

Add a unit test to verify that an identifier surrounded with backquotes
is not a valid syntax for eventType value, as eventType is
schematically a string literal and not a field identifier.

Follows: #63169

[elasticmachine]

Pinging @elastic/es-ql (:Query Languages/EQL)

[costin]

LGTM

[astefan]

LGTM

[rw-access]

as eventType is
schematically a string literal and not a field identifier.

This schematic conclusion seems more like an implementation detail of EQL in Elasticsearch, and less a property of EQL the language proper. For some historical context, we had a few discussions in the early implementation last year for EQL in ES about how this concept translated into ES most naturally, and the conclusion we arrived at for event.category wasn't immediately obvious. We were debating if the event type name should become an index pattern or event.category.

FWIW, in some other implementations it makes more sense to treat this as an identifier, since the event type lives outside of the event data, and is not simply used a shorthand for event.category == "<event type name>", and always matches the regex for identifiers [A-Za-z_][A-Za-z_0-9]+`.

So I agree that it's not a field identifer, but moreso an event type identifier. There are also other kinds of identifiers or rather "names" in the language than just field identifiers/names: function names, pipe names and relationship names/types.