honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: Remove support for single quote strings (#62479) (#62543)

This commit is contained in:
James Rodewig 2020-09-17 09:34:40 -04:00 committed by GitHub
parent 417ce9396d
commit cd953272cd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
docs/reference/eql/syntax.asciidoc
View File

@ -250,14 +250,15 @@ process where ( 4.0 / process.args_count ) == 1
[[eql-syntax-strings]] [[eql-syntax-strings]]
==== Strings ==== Strings
Strings are enclosed with double quotes (`"`) or single quotes (`'`). Strings are enclosed with double quotes (`"`).
[source,eql] [source,eql]
---- ----
"hello world" "hello world"
"hello world with 'substring'"
---- ----
Strings enclosed in single quotes (`'`) are not supported.
[discrete] [discrete]
[[eql-syntax-wildcards]] [[eql-syntax-wildcards]]
===== Wildcards ===== Wildcards
@ -315,10 +316,13 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
|`\t` | A tab character |`\t` | A tab character
|`\\` | A backslash (`\`) character |`\\` | A backslash (`\`) character
|`\"` | A double quote (`"`) character |`\"` | A double quote (`"`) character
|`\'` | A single quote (`'`) character
|==== |====
==== ====
IMPORTANT: The single quote (`'`) character is reserved for future use. You
cannot use an escaped single quote (`\'`) for literal strings. Use an escaped
double quote (`\"`) instead.
[discrete] [discrete]
[[eql-syntax-raw-strings]] [[eql-syntax-raw-strings]]
===== Raw strings ===== Raw strings
@ -328,11 +332,11 @@ literal characters.
[source,eql] [source,eql]
---- ----
?"String with a literal 'blackslash' \ character included" ?"String with a literal blackslash \ character included"
---- ----
You can escape single quotes (`'`) and double quotes (`"`) with a backslash, but You can escape double quotes (`"`) with a backslash, but the backslash remains
the backslash remains in the resulting string. in the resulting string.
[source,eql] [source,eql]
---- ----
@ -670,6 +674,17 @@ You cannot use EQL to search the values of a <<nested,`nested`>> field or the
sub-fields of a `nested` field. However, data streams and indices containing sub-fields of a `nested` field. However, data streams and indices containing
`nested` field mappings are otherwise supported. `nested` field mappings are otherwise supported.
[discrete]
[[single-quote-strings]]
==== Single quote strings
In {es} EQL, the single quote (`'`) character is reserved for future use.
Strings enclosed in single quotes are not supported. Enclose strings in
double quotes (`"`) instead.
You cannot use an escaped single quote (`\'`) for literal strings. Use an
escaped double quote (`\"`) instead.
[discrete] [discrete]
[[eql-unsupported-syntax]] [[eql-unsupported-syntax]]
==== Unsupported syntax ==== Unsupported syntax