[DOCS] Add EQL limitations page (#52001)
Documents limitations for EQL in Elasticsearch.
This commit is contained in:
parent
20453d3ac8
commit
ca34817659
|
@ -32,7 +32,9 @@ Consider using EQL if you:
|
|||
* <<eql-requirements>>
|
||||
* <<eql-search>>
|
||||
* <<eql-syntax>>
|
||||
* <<eql-limitations>>
|
||||
|
||||
include::requirements.asciidoc[]
|
||||
include::search.asciidoc[]
|
||||
include::syntax.asciidoc[]
|
||||
include::limitations.asciidoc[]
|
||||
|
|
|
@ -0,0 +1,29 @@
|
|||
[role="xpack"]
|
||||
[testenv="basic"]
|
||||
[[eql-limitations]]
|
||||
== EQL limitations
|
||||
++++
|
||||
<titleabbrev>Limitations</titleabbrev>
|
||||
++++
|
||||
|
||||
experimental::[]
|
||||
|
||||
[discrete]
|
||||
[[eql-unsupported-syntax]]
|
||||
=== Unsupported syntax
|
||||
|
||||
{es} supports a subset of {eql-ref}/index.html[EQL syntax]. {es} cannot run EQL
|
||||
queries that contain:
|
||||
|
||||
* {eql-ref}/functions.html[Functions]
|
||||
|
||||
* {eql-ref}/joins.html[Joins]
|
||||
|
||||
* {eql-ref}/basic-syntax.html#event-relationships[Lineage-related keywords]:
|
||||
** `child of`
|
||||
** `descendant of`
|
||||
** `event of`
|
||||
|
||||
* {eql-ref}/pipes.html[Pipes]
|
||||
|
||||
* {eql-ref}/sequences.html[Sequences]
|
Loading…
Reference in New Issue