honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: Replace ?"..." with """...""" for raw strings (#63191) (#63198)

This commit is contained in:
James Rodewig 2020-10-02 14:03:58 -04:00 committed by GitHub
parent 0b6e2b8f16
commit a22b90d3cc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
docs/reference/eql/syntax.asciidoc
View File

@ -283,7 +283,7 @@ any where true
[[eql-syntax-strings]] [[eql-syntax-strings]]
==== Strings ==== Strings
Strings are enclosed with double quotes (`"`). Strings are enclosed in double quotes (`"`).
[source,eql] [source,eql]
---- ----
@ -322,28 +322,22 @@ double quote (`\"`) instead.
[[eql-syntax-raw-strings]] [[eql-syntax-raw-strings]]
===== Raw strings ===== Raw strings
Raw strings are preceded by a question mark (`?`) and treat backslashes (`\`) as Raw strings treat special characters, such as backslashes (`\`), as literal
literal characters. characters. Raw strings are enclosed in three double quotes (`"""`).
[source,eql] [source,eql]
---- ----
?"String with a literal blackslash \ character included" """Raw string with a literal double quote " and blackslash \ included"""
---- ----
You can escape double quotes (`"`) with a backslash, but the backslash remains A raw string cannot contain three consecutive double quotes (`"""`). Instead,
in the resulting string. use a regular string with the `\"` escape sequence.
[source,eql] [source,eql]
---- ----
?"\"" "String containing \"\"\" three double quotes"
---- ----
[NOTE]
====
Raw strings cannot contain only a single backslash or end in an odd number of
backslashes.
====
[discrete] [discrete]
[[eql-syntax-wildcards]] [[eql-syntax-wildcards]]
===== Wildcards ===== Wildcards