honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: Correct EQL search API's `size` param def 

The `size` parameter can be used to limit matching events or sequences.
This commit is contained in:
James Rodewig 2020-06-10 10:08:46 -04:00
parent c0f368bbf3
commit 44c3bb29e2
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
docs/reference/eql/eql-search-api.asciidoc
View File

@ -121,8 +121,13 @@ Reserved for future use.
`size`:: `size`::
(Optional, integer or float) (Optional, integer or float)
Maximum number of matching events to return. Defaults to `50`. Values must be For <<eql-basic-syntax,basic queries>>, the maximum number of matching events to
greater than `0`. return.
+
For <<eql-sequences,sequence queries>>, the maximum number of matching sequences
to return.
+
Defaults to `50`. Values must be greater than `0`.
[[eql-search-api-timestamp-field]] [[eql-search-api-timestamp-field]]
`timestamp_field`:: `timestamp_field`::