2020-01-27 16:03:23 -05:00
|
|
|
[role="xpack"]
|
|
|
|
|
[testenv="basic"]
|
|
|
|
|
[[eql]]
|
|
|
|
|
= EQL for event-based search
|
|
|
|
|
++++
|
|
|
|
|
<titleabbrev>EQL</titleabbrev>
|
|
|
|
|
++++
|
|
|
|
|
|
|
|
|
|
experimental::[]
|
|
|
|
|
|
|
|
|
|
{eql-ref}/index.html[Event Query Language (EQL)] is a query language used for
|
|
|
|
|
logs and other event-based data.
|
|
|
|
|
|
|
|
|
|
You can use EQL in {es} to easily express relationships between events and
|
|
|
|
|
quickly match events with shared properties. You can use EQL and query
|
|
|
|
|
DSL together to better filter your searches.
|
|
|
|
|
|
|
|
|
|
[float]
|
|
|
|
|
[[when-to-use-eql]]
|
|
|
|
|
=== When to use EQL
|
|
|
|
|
|
|
|
|
|
Consider using EQL if you:
|
|
|
|
|
|
|
|
|
|
* Use {es} for threat hunting or other security use cases
|
|
|
|
|
* Search time-series data or logs, such as network or system logs
|
|
|
|
|
* Want an easy way to explore relationships between events
|
|
|
|
|
|
|
|
|
|
[float]
|
|
|
|
|
[[eql-toc]]
|
|
|
|
|
=== In this section
|
|
|
|
|
|
2020-02-05 08:12:09 -05:00
|
|
|
* <<eql-requirements>>
|
2020-02-12 08:40:10 -05:00
|
|
|
* <<eql-search>>
|
2020-02-05 08:12:09 -05:00
|
|
|
* <<eql-syntax>>
|
2020-02-12 08:45:15 -05:00
|
|
|
* <<eql-limitations>>
|
2020-01-27 16:03:23 -05:00
|
|
|
|
|
|
|
|
include::requirements.asciidoc[]
|
2020-02-12 08:40:10 -05:00
|
|
|
include::search.asciidoc[]
|
2020-02-05 08:12:09 -05:00
|
|
|
include::syntax.asciidoc[]
|
2020-02-12 08:45:15 -05:00
|
|
|
include::limitations.asciidoc[]
|
