honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: Disallow chained comparisons (#62570) (#62625)

This commit is contained in:
James Rodewig 2020-09-18 08:47:27 -04:00 committed by GitHub
parent 18a52f7477
commit 9d6f94ffa3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/reference/eql/syntax.asciidoc
View File

@ -98,7 +98,12 @@ Returns `true` if the value to the left of the operator is greater than the
value to the right. Otherwise returns `false`.
====
You cannot use comparison operators to compare a variable, such as a field
You cannot chain comparison operators. Instead, use a
<<eql-syntax-logical-operators,logical operator>> between comparisons. For
example, `foo < bar <= baz` is not supported. However, you can rewrite the
expression as `foo < bar and bar <= baz`, which is supported.
You also cannot use comparison operators to compare a variable, such as a field
value, to another variable, even if those variables are modified using a
<<eql-functions,function>>.