honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-02-25 06:16:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: Align comments in between fn examples

Browse Source
This commit is contained in:
James Rodewig 2020-05-15 09:12:07 -04:00
parent 24cd45345e
commit 5e09762a27
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
docs/reference/eql/functions.asciidoc
View File

@ -90,14 +90,14 @@ source string.
[source,eql]
----
// file.path = "C:\\Windows\\System32\\cmd.exe"
between(file.path, "system32\\\\", ".exe") // returns "cmd"
between(file.path, "workspace\\\\", ".exe") // returns ""
between(file.path, "system32\\\\", ".exe") // returns "cmd"
between(file.path, "workspace\\\\", ".exe") // returns ""
// Greedy matching defaults to false.
between(file.path, "\\\\", "\\\\", false) // returns "Windows"
between(file.path, "\\\\", "\\\\", false) // returns "Windows"
// Sets greedy matching to true
between(file.path, "\\\\", "\\\\", true) // returns "Windows\\System32"
between(file.path, "\\\\", "\\\\", true) // returns "Windows\\System32"
// Case sensitivity defaults to false.
between(file.path, "system32\\\\", ".exe", false, false) // returns "cmd"
@ -106,11 +106,11 @@ between(file.path, "system32\\\\", ".exe", false, true) // returns ""
between(file.path, "System32\\\\", ".exe", false, true) // returns "cmd"
// empty source string
between("", "system32\\\\", ".exe") // returns ""
between("", "", "") // returns ""
between("", "system32\\\\", ".exe") // returns ""
between("", "", "") // returns ""
// null handling
between(null, "system32\\\\", ".exe") // returns null
between(null, "system32\\\\", ".exe") // returns null
----
*Syntax*