fix minor anonymizer bug

Signed-off-by: xinyual <xinyual@amazon.com>

Author: xinyual

ppl/src/main/java/org/opensearch/sql/ppl/utils/PPLQueryDataAnonymizer.java

@@ -251,7 +251,7 @@ public String visitTableFunction(TableFunction node, String context) {
   public String visitSearch(Search node, String context) {
     String source = node.getChild().get(0).accept(this, context);
     String queryString = node.getQueryString();
-    String anonymized = queryString.replaceAll(":\\S+", ":" + MASK_LITERAL);
+    String anonymized = queryString.replaceAll(":\\S+", "=" + MASK_LITERAL);
     return StringUtils.format("%s %s", source, anonymized);
   }
 

ppl/src/test/java/org/opensearch/sql/ppl/utils/PPLQueryDataAnonymizerTest.java

@@ -33,7 +33,7 @@ public class PPLQueryDataAnonymizerTest {
 
   @Test
   public void testSearchCommand() {
-    assertEquals("source=table a:***", anonymize("search source=t a=1"));
+    assertEquals("source=table a=***", anonymize("search source=t a=1"));
   }
 
   @Test
@@ -795,7 +795,7 @@ private String anonymizeStatement(String query, boolean isExplain) {
   @Test
   public void testSearchWithAbsoluteTimeRange() {
     assertEquals(
-        "source=table (@timestamp:*** AND (@timestamp:***",
+        "source=table (@timestamp=*** AND (@timestamp=***",
         anonymize("search source=t earliest='2012-12-10 15:00:00' latest=now"));
   }