[DOCS] EQL: Correct EQL search API's `size` param def

The `size` parameter can be used to limit matching events or sequences.
This commit is contained in:
James Rodewig 2020-06-10 10:08:46 -04:00
parent c0f368bbf3
commit 44c3bb29e2
1 changed files with 7 additions and 2 deletions

View File

@ -121,8 +121,13 @@ Reserved for future use.
`size`::
(Optional, integer or float)
Maximum number of matching events to return. Defaults to `50`. Values must be
greater than `0`.
For <<eql-basic-syntax,basic queries>>, the maximum number of matching events to
return.
+
For <<eql-sequences,sequence queries>>, the maximum number of matching sequences
to return.
+
Defaults to `50`. Values must be greater than `0`.
[[eql-search-api-timestamp-field]]
`timestamp_field`::