Add data streams wildcard pattern yml test (#61269) (#61280)

(cherry picked from commit e13a365eeb6d8c6a7c9a91f94f0e8e78e3fe4773)

x-pack/plugin/eql/qa/rest/src/test/resources/rest-api-spec/test/eql/20_data_streams.yml

@@ -1,5 +1,5 @@
 ---
-"Verify data stream resolvability in EQL search API":
+setup:
   - skip:
       version: " - 7.99.99"
       reason: "change to 7.8.99 after backport"
@@ -22,7 +22,6 @@
   - do:
       indices.create_data_stream:
         name: simple-data-stream1
-  - is_true: acknowledged
 
   - do:
       bulk:
@@ -36,6 +35,8 @@
             "@timestamp": 2020-02-03T12:34:56Z
             user: SYSTEM
 
+---
+"Verify data stream resolvability in EQL search API":
   - do:
       eql.search:
         index: simple-data-stream1
@@ -51,3 +52,21 @@
       indices.delete_data_stream:
         name: simple-data-stream1
   - is_true: acknowledged
+
+---
+"Data stream EQL search with wildcard pattern":
+  - do:
+      eql.search:
+        index: simple-data-s*
+        body:
+          query: "process where user = 'SYSTEM'"
+
+  - match: {timed_out: false}
+  - match: {hits.total.value: 1}
+  - match: {hits.total.relation: "eq"}
+  - match: {hits.events.0._source.user: "SYSTEM"}
+
+  - do:
+      indices.delete_data_stream:
+        name: simple-data-stream1
+  - is_true: acknowledged