honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
OpenSearch/docs/reference/eql/requirements.asciidoc

37 lines
923 B
Plaintext
Raw Normal View History

[DOCS] Add top-level EQL docs page. Adds EQL requirements page. (#51334) * Creates a top-level page for EQL in the ES reference. This page contains a high-level introduction and will include a nav for other EQL docs pages as they're built. * Creates a requirements page. This page outlines the fields needed to use EQL in ES.
2020-01-27 16:03:23 -05:00
[role="xpack"]
[testenv="basic"]
[[eql-requirements]]
== EQL requirements
++++
<titleabbrev>Requirements</titleabbrev>
++++
[DOCS] Add basic EQL search tutorial docs (#51574) I plan to add additional sections to this page with future PRs: * Specify timestamp and event type fields * Specify a join key field * Filter using query DSL * Paginate a large response See #51057.
2020-02-12 08:40:10 -05:00
experimental::[]
[DOCS] Reorganize EQL requirements page
2020-03-03 06:59:17 -05:00
EQL is schema-less and works well with most common log formats.
[TIP]
====
While no schema is required to use EQL in {es}, we recommend the
{ecs-ref}[Elastic Common Schema (ECS)]. The EQL search API is designed to work
with core ECS fields by default.
====
[DOCS] Add top-level EQL docs page. Adds EQL requirements page. (#51334) * Creates a top-level page for EQL in the ES reference. This page contains a high-level introduction and will include a nav for other EQL docs pages as they're built. * Creates a requirements page. This page outlines the fields needed to use EQL in ES.
2020-01-27 16:03:23 -05:00
[discrete]
[[eql-required-fields]]
=== Required fields
In {es}, EQL assumes each document in an index corresponds to an event.
To search an index using EQL, each document in the index must contain the
following field archetypes:
[DOCS] Update EQL default event category and timestamp values (#53102) Updates the documented default `event_category_field` and `timestamp_field` values for the EQL search API. Also updates related guidance in the EQL requirement docs. Relates to #53073.
2020-03-04 09:16:27 -05:00
Event category::
[DOCS] Add top-level EQL docs page. Adds EQL requirements page. (#51334) * Creates a top-level page for EQL in the ES reference. This page contains a high-level introduction and will include a nav for other EQL docs pages as they're built. * Creates a requirements page. This page outlines the fields needed to use EQL in ES.
2020-01-27 16:03:23 -05:00
A field containing the event classification, such as `process`, `file`, or
`network`. This is typically mapped as a <<keyword,`keyword`>> field.
Timestamp::
A field containing the date and/or time the event occurred. This is typically
mapped as a <<date,`date`>> field.