honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
OpenSearch/docs/reference/eql/requirements.asciidoc

43 lines
1.1 KiB
Plaintext
Raw Normal View History

[DOCS] Add top-level EQL docs page. Adds EQL requirements page. (#51334) * Creates a top-level page for EQL in the ES reference. This page contains a high-level introduction and will include a nav for other EQL docs pages as they're built. * Creates a requirements page. This page outlines the fields needed to use EQL in ES.
2020-01-27 16:03:23 -05:00
[role="xpack"]
[testenv="basic"]
[[eql-requirements]]
== EQL requirements
++++
<titleabbrev>Requirements</titleabbrev>
++++
[DOCS] Add basic EQL search tutorial docs (#51574) I plan to add additional sections to this page with future PRs: * Specify timestamp and event type fields * Specify a join key field * Filter using query DSL * Paginate a large response See #51057.
2020-02-12 08:40:10 -05:00
experimental::[]
[DOCS] Reorganize EQL requirements page
2020-03-03 06:59:17 -05:00
EQL is schema-less and works well with most common log formats.
[TIP]
====
While no schema is required to use EQL in {es}, we recommend the
{ecs-ref}[Elastic Common Schema (ECS)]. The EQL search API is designed to work
with core ECS fields by default.
====
[DOCS] Add top-level EQL docs page. Adds EQL requirements page. (#51334) * Creates a top-level page for EQL in the ES reference. This page contains a high-level introduction and will include a nav for other EQL docs pages as they're built. * Creates a requirements page. This page outlines the fields needed to use EQL in ES.
2020-01-27 16:03:23 -05:00
[discrete]
[[eql-required-fields]]
=== Required fields
In {es}, EQL assumes each document in an index corresponds to an event.
To search an index using EQL, each document in the index must contain the
following field archetypes:
[DOCS] Update EQL default event category and timestamp values (#53102) Updates the documented default `event_category_field` and `timestamp_field` values for the EQL search API. Also updates related guidance in the EQL requirement docs. Relates to #53073.
2020-03-04 09:16:27 -05:00
Event category::
[DOCS] Add top-level EQL docs page. Adds EQL requirements page. (#51334) * Creates a top-level page for EQL in the ES reference. This page contains a high-level introduction and will include a nav for other EQL docs pages as they're built. * Creates a requirements page. This page outlines the fields needed to use EQL in ES.
2020-01-27 16:03:23 -05:00
A field containing the event classification, such as `process`, `file`, or
`network`. This is typically mapped as a <<keyword,`keyword`>> field.
Timestamp::
A field containing the date and/or time the event occurred. This is typically
mapped as a <<date,`date`>> field.
[DOCS] EQL: Document nested field support (#56138) Notes that you cannot use EQL in ES to search the values of `nested` fields or their sub-fields. However, indices containing `nested` field mappings are otherwise supported.
2020-05-05 11:46:06 -04:00
[NOTE]
====
You cannot use a <<nested,`nested`>> field datatype or the sub-fields of a
`nested` field dataype as the timestamp or event category field. See
<<eql-nested-fields>>.
====