honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: Remove support for single quote strings (#62479) (#62543)

This commit is contained in:
James Rodewig 2020-09-17 09:34:40 -04:00 committed by GitHub
parent 417ce9396d
commit cd953272cd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
docs/reference/eql/syntax.asciidoc
View File

@ -250,14 +250,15 @@ process where ( 4.0 / process.args_count ) == 1
[[eql-syntax-strings]]
==== Strings
Strings are enclosed with double quotes (`"`) or single quotes (`'`).
Strings are enclosed with double quotes (`"`).
[source,eql]
----
"hello world"
"hello world with 'substring'"
----
Strings enclosed in single quotes (`'`) are not supported.
[discrete]
[[eql-syntax-wildcards]]
===== Wildcards
@ -315,10 +316,13 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
|`\t` | A tab character
|`\\` | A backslash (`\`) character
|`\"` | A double quote (`"`) character
|`\'` | A single quote (`'`) character
|====
====
IMPORTANT: The single quote (`'`) character is reserved for future use. You
cannot use an escaped single quote (`\'`) for literal strings. Use an escaped
double quote (`\"`) instead.
[discrete]
[[eql-syntax-raw-strings]]
===== Raw strings
@ -328,11 +332,11 @@ literal characters.
[source,eql]
----
?"String with a literal 'blackslash' \ character included"
?"String with a literal blackslash \ character included"
----
You can escape single quotes (`'`) and double quotes (`"`) with a backslash, but
the backslash remains in the resulting string.
You can escape double quotes (`"`) with a backslash, but the backslash remains
in the resulting string.
[source,eql]
----
@ -670,6 +674,17 @@ You cannot use EQL to search the values of a <<nested,`nested`>> field or the
sub-fields of a `nested` field. However, data streams and indices containing
`nested` field mappings are otherwise supported.
[discrete]
[[single-quote-strings]]
==== Single quote strings
In {es} EQL, the single quote (`'`) character is reserved for future use.
Strings enclosed in single quotes are not supported. Enclose strings in
double quotes (`"`) instead.
You cannot use an escaped single quote (`\'`) for literal strings. Use an
escaped double quote (`\"`) instead.
[discrete]
[[eql-unsupported-syntax]]
==== Unsupported syntax