honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
OpenSearch/docs/reference/eql/limitations.asciidoc

32 lines
716 B
Plaintext
Raw Normal View History

[DOCS] Add EQL limitations page (#52001) Documents limitations for EQL in Elasticsearch.
2020-02-12 08:45:15 -05:00
[role="xpack"]
[testenv="basic"]
[[eql-limitations]]
== EQL limitations
++++
<titleabbrev>Limitations</titleabbrev>
++++
experimental::[]
[discrete]
[[eql-unsupported-syntax]]
=== Unsupported syntax
{es} supports a subset of {eql-ref}/index.html[EQL syntax]. {es} cannot run EQL
queries that contain:
[DOCS] EQL: Document `substring` function (#53867) Adds documentation for the EQL `substring` function. Supporting changes: * Creates a new "EQL function reference" page * Updates the title of the "EQL syntax reference" page for consistency * Adds a brief "Functions" section to the EQL syntax docs * Updates EQL limitations docs to state that only array functions are unsupported
2020-03-25 12:23:59 -04:00
* Array functions:
** {eql-ref}/functions.html#arrayContains[`arrayContains`]
** {eql-ref}/functions.html#arrayCount[`arrayCount`]
** {eql-ref}/functions.html#arraySearch[`arraySearch`]
[DOCS] Add EQL limitations page (#52001) Documents limitations for EQL in Elasticsearch.
2020-02-12 08:45:15 -05:00
* {eql-ref}/joins.html[Joins]
* {eql-ref}/basic-syntax.html#event-relationships[Lineage-related keywords]:
** `child of`
** `descendant of`
** `event of`
* {eql-ref}/pipes.html[Pipes]
* {eql-ref}/sequences.html[Sequences]