honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: Replace ?"..." with """...""" for raw strings (#63191) (#63198)

This commit is contained in:
James Rodewig 2020-10-02 14:03:58 -04:00 committed by GitHub
parent 0b6e2b8f16
commit a22b90d3cc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
docs/reference/eql/syntax.asciidoc
View File

@ -283,7 +283,7 @@ any where true
[[eql-syntax-strings]]
==== Strings
Strings are enclosed with double quotes (`"`).
Strings are enclosed in double quotes (`"`).
[source,eql]
----
@ -322,28 +322,22 @@ double quote (`\"`) instead.
[[eql-syntax-raw-strings]]
===== Raw strings
Raw strings are preceded by a question mark (`?`) and treat backslashes (`\`) as
literal characters.
Raw strings treat special characters, such as backslashes (`\`), as literal
characters. Raw strings are enclosed in three double quotes (`"""`).
[source,eql]
----
?"String with a literal blackslash \ character included"
"""Raw string with a literal double quote " and blackslash \ included"""
----
You can escape double quotes (`"`) with a backslash, but the backslash remains
in the resulting string.
A raw string cannot contain three consecutive double quotes (`"""`). Instead,
use a regular string with the `\"` escape sequence.
[source,eql]
----
?"\""
"String containing \"\"\" three double quotes"
----
[NOTE]
====
Raw strings cannot contain only a single backslash or end in an odd number of
backslashes.
====
[discrete]
[[eql-syntax-wildcards]]
===== Wildcards