From a22b90d3cc337cf2a329f1c31537ef2db39b95e3 Mon Sep 17 00:00:00 2001
From: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Date: Fri, 2 Oct 2020 14:03:58 -0400
Subject: [PATCH] [DOCS] EQL: Replace ?"..." with """...""" for raw strings
 (#63191) (#63198)

---
 docs/reference/eql/syntax.asciidoc | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc
index 690661d46d3..22a7bb93c46 100644
--- a/docs/reference/eql/syntax.asciidoc
+++ b/docs/reference/eql/syntax.asciidoc
@@ -283,7 +283,7 @@ any where true
 [[eql-syntax-strings]]
 ==== Strings
 
-Strings are enclosed with double quotes (`"`).
+Strings are enclosed in double quotes (`"`).
 
 [source,eql]
 ----
@@ -322,28 +322,22 @@ double quote (`\"`) instead.
 [[eql-syntax-raw-strings]]
 ===== Raw strings
 
-Raw strings are preceded by a question mark (`?`) and treat backslashes (`\`) as
-literal characters.
+Raw strings treat special characters, such as backslashes (`\`), as literal
+characters. Raw strings are enclosed in three double quotes (`"""`).
 
 [source,eql]
 ----
-?"String with a literal blackslash \ character included"
+"""Raw string with a literal double quote " and blackslash \ included"""
 ----
 
-You can escape double quotes (`"`) with a backslash, but the backslash remains
-in the resulting string.
+A raw string cannot contain three consecutive double quotes (`"""`). Instead,
+use a regular string with the `\"` escape sequence.
 
 [source,eql]
 ----
-?"\""
+"String containing \"\"\" three double quotes"
 ----
 
-[NOTE]
-====
-Raw strings cannot contain only a single backslash or end in an odd number of
-backslashes.
-====
-
 [discrete]
 [[eql-syntax-wildcards]]
 ===== Wildcards