honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] Note that EQL timestamp field can also be date_nanos

This commit is contained in:
James Rodewig 2020-07-15 09:53:19 -04:00
parent 4e58f967de
commit 8cac702171
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/reference/eql/requirements.asciidoc
View File

@ -33,7 +33,7 @@ A field containing the event classification, such as `process`, `file`, or
Timestamp::
A field containing the date and/or time the event occurred. This is typically
mapped as a <<date,`date`>> field.
mapped as a <<date,`date`>> or <<date_nanos,`date_nanos`>> field.
[NOTE]
====

10
docs/reference/eql/search.asciidoc
View File

@ -409,8 +409,8 @@ GET /sec_logs/_eql/search
[[eql-search-specify-event-category-field]]
=== Specify an event category field
The EQL search API uses `event.category` as the required
<<eql-required-fields,event category field>> by default. You can use the
By default, the EQL search API uses `event.category` as the
<<eql-required-fields,event category field>>. You can use the
`event_category_field` parameter to specify another event category field.
.*Example*
@ -435,9 +435,9 @@ GET /sec_logs/_eql/search
[[eql-search-specify-timestamp-field]]
=== Specify a timestamp field
The EQL search API uses `@timestamp` as the required <<eql-required-fields,event
timestamp field>> by default. You can use the `timestamp_field` parameter to
specify another timestamp field.
By default, EQL searches use `@timestamp` as the <<eql-required-fields,event
timestamp field>>. You can use the EQL search API's `timestamp_field` parameter
to specify another timestamp field.
.*Example*
[%collapsible]