From 24cd45345ee36c243d01f63dfb7a83e8e80e477c Mon Sep 17 00:00:00 2001 From: James Rodewig Date: Fri, 15 May 2020 09:08:02 -0400 Subject: [PATCH] [DOCS] EQL: Remove references to arrays/multi-value fields (#56772) --- docs/reference/eql/functions.asciidoc | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/docs/reference/eql/functions.asciidoc b/docs/reference/eql/functions.asciidoc index 413945849f4..aa740118fad 100644 --- a/docs/reference/eql/functions.asciidoc +++ b/docs/reference/eql/functions.asciidoc @@ -135,8 +135,6 @@ field datatypes: * <> * <> field with a <> or <> sub-field - -Fields containing <> use the first array item only. -- ``:: @@ -153,8 +151,6 @@ field datatypes: * <> * <> field with a <> or <> sub-field - -<> are not supported. -- ``:: @@ -171,8 +167,6 @@ field datatypes: * <> * <> field with a <> or <> sub-field - -<> are not supported. -- ``:: @@ -416,10 +410,6 @@ endsWith(file.name, ".dll") // returns false endsWith("regsvr32.exe", file.extension) // returns true endsWith("ntdll.dll", file.name) // returns false -// file.name = [ "ntdll.dll", "regsvr32.exe" ] -endsWith(file.name, ".dll") // returns true -endsWith(file.name, ".exe") // returns false - // null handling endsWith("regsvr32.exe", null) // returns null endsWith("", null) // returns null @@ -448,8 +438,6 @@ field datatypes: * <> * <> field with a <> or <> sub-field - -Fields containing <> use the first array item only. -- ``:: @@ -621,8 +609,6 @@ field datatypes: * <> * <> field with a <> or <> sub-field - -<> are not supported. -- *Returns:* integer or `null` @@ -925,10 +911,6 @@ startsWith(process.name, "explorer") // returns false startsWith("regsvr32.exe", process.name) // returns true startsWith("explorer.exe", process.name) // returns false -// process.name = [ "explorer.exe", "regsvr32.exe" ] -startsWith(process.name, "explorer") // returns true -startsWith(process.name, "regsvr32") // returns false - // null handling startsWith("regsvr32.exe", null) // returns null startsWith("", null) // returns null @@ -957,8 +939,6 @@ field datatypes: * <> * <> field with a <> or <> sub-field - -Fields containing <> use the first array item only. -- ``::