honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
OpenSearch/docs/reference/eql/index.asciidoc

43 lines
988 B
Plaintext
Raw Normal View History

[DOCS] Add top-level EQL docs page. Adds EQL requirements page. (#51334) * Creates a top-level page for EQL in the ES reference. This page contains a high-level introduction and will include a nav for other EQL docs pages as they're built. * Creates a requirements page. This page outlines the fields needed to use EQL in ES.
2020-01-27 16:03:23 -05:00
[role="xpack"]
[testenv="basic"]
[[eql]]
= EQL for event-based search
++++
<titleabbrev>EQL</titleabbrev>
++++
experimental::[]
{eql-ref}/index.html[Event Query Language (EQL)] is a query language used for
logs and other event-based data.
You can use EQL in {es} to easily express relationships between events and
quickly match events with shared properties. You can use EQL and query
DSL together to better filter your searches.
[float]
[[when-to-use-eql]]
=== When to use EQL
Consider using EQL if you:
* Use {es} for threat hunting or other security use cases
* Search time-series data or logs, such as network or system logs
* Want an easy way to explore relationships between events
[float]
[[eql-toc]]
=== In this section
[DOCS] Add EQL syntax page (#51821) Adds documentation for basic EQL syntax. Joins, sequences, and other syntax to be added as its supported in future development. Co-Authored-By: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-02-05 08:12:09 -05:00
* <<eql-requirements>>
[DOCS] Add basic EQL search tutorial docs (#51574) I plan to add additional sections to this page with future PRs: * Specify timestamp and event type fields * Specify a join key field * Filter using query DSL * Paginate a large response See #51057.
2020-02-12 08:40:10 -05:00
* <<eql-search>>
[DOCS] Add EQL syntax page (#51821) Adds documentation for basic EQL syntax. Joins, sequences, and other syntax to be added as its supported in future development. Co-Authored-By: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-02-05 08:12:09 -05:00
* <<eql-syntax>>
[DOCS] EQL: Document `substring` function (#53867) Adds documentation for the EQL `substring` function. Supporting changes: * Creates a new "EQL function reference" page * Updates the title of the "EQL syntax reference" page for consistency * Adds a brief "Functions" section to the EQL syntax docs * Updates EQL limitations docs to state that only array functions are unsupported
2020-03-25 12:23:59 -04:00
* <<eql-function-ref>>
[DOCS] Add EQL limitations page (#52001) Documents limitations for EQL in Elasticsearch.
2020-02-12 08:45:15 -05:00
* <<eql-limitations>>
[DOCS] Add top-level EQL docs page. Adds EQL requirements page. (#51334) * Creates a top-level page for EQL in the ES reference. This page contains a high-level introduction and will include a nav for other EQL docs pages as they're built. * Creates a requirements page. This page outlines the fields needed to use EQL in ES.
2020-01-27 16:03:23 -05:00
include::requirements.asciidoc[]
[DOCS] Add basic EQL search tutorial docs (#51574) I plan to add additional sections to this page with future PRs: * Specify timestamp and event type fields * Specify a join key field * Filter using query DSL * Paginate a large response See #51057.
2020-02-12 08:40:10 -05:00
include::search.asciidoc[]
[DOCS] Add EQL syntax page (#51821) Adds documentation for basic EQL syntax. Joins, sequences, and other syntax to be added as its supported in future development. Co-Authored-By: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-02-05 08:12:09 -05:00
include::syntax.asciidoc[]
[DOCS] EQL: Document `substring` function (#53867) Adds documentation for the EQL `substring` function. Supporting changes: * Creates a new "EQL function reference" page * Updates the title of the "EQL syntax reference" page for consistency * Adds a brief "Functions" section to the EQL syntax docs * Updates EQL limitations docs to state that only array functions are unsupported
2020-03-25 12:23:59 -04:00
include::functions.asciidoc[]
[DOCS] Add EQL limitations page (#52001) Documents limitations for EQL in Elasticsearch.
2020-02-12 08:45:15 -05:00
include::limitations.asciidoc[]