honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: date_nanos timestamp is not supported (#63101) (#63103)

This commit is contained in:
James Rodewig 2020-09-30 17:45:00 -04:00 committed by GitHub
parent 8c6e197f51
commit 700bfb156d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/reference/eql/eql-search-api.asciidoc
View File

@ -260,8 +260,8 @@ Events in the API response are sorted by this field's value, converted to
milliseconds since the {wikipedia}/Unix_time[Unix epoch], in milliseconds since the {wikipedia}/Unix_time[Unix epoch], in
ascending order. ascending order.
The timestamp field is typically mapped as a <<date,`date`>> or The timestamp field should be mapped as a <<date,`date`>>. The
<<date_nanos,`date_nanos`>> field. <<date_nanos,`date_nanos`>> field type is not supported.
-- --
[[eql-search-api-wait-for-completion-timeout]] [[eql-search-api-wait-for-completion-timeout]]

5
docs/reference/eql/eql.asciidoc
View File

@ -405,8 +405,9 @@ in the search request using the `timestamp_field` or `event_category_field`
parameters. parameters.
The event category field is typically mapped as a field type in the The event category field is typically mapped as a field type in the
<<keyword,`keyword`>> family. The timestamp field is typically mapped as a <<keyword,`keyword`>> family. The timestamp field should be mapped as a
<<date,`date`>> or <<date_nanos,`date_nanos`>> field. <<date,`date`>> field type. <<date_nanos,`date_nanos`>> timestamp fields are not
supported.
NOTE: You cannot use a <<nested,`nested`>> field or the sub-fields of a `nested` NOTE: You cannot use a <<nested,`nested`>> field or the sub-fields of a `nested`
field as the timestamp or event category field. See <<eql-nested-fields>>. field as the timestamp or event category field. See <<eql-nested-fields>>.