diff --git a/docs/reference/eql/requirements.asciidoc b/docs/reference/eql/requirements.asciidoc index d2b6135aa0c..1afd928dcc3 100644 --- a/docs/reference/eql/requirements.asciidoc +++ b/docs/reference/eql/requirements.asciidoc @@ -13,8 +13,8 @@ EQL is schema-less and works well with most common log formats. [TIP] ==== While no schema is required to use EQL in {es}, we recommend the -{ecs-ref}[Elastic Common Schema (ECS)]. The EQL search API is designed to work -with core ECS fields by default. +{ecs-ref}[Elastic Common Schema (ECS)]. The <> is +designed to work with core ECS fields by default. ==== [discrete] @@ -38,6 +38,6 @@ mapped as a <> or <> field. [NOTE] ==== You cannot use a <> field data type or the sub-fields of a -`nested` field dataype as the timestamp or event category field. See +`nested` field as the timestamp or event category field. See <>. ==== diff --git a/docs/reference/eql/search.asciidoc b/docs/reference/eql/search.asciidoc index 44badf3f24c..28140bb5746 100644 --- a/docs/reference/eql/search.asciidoc +++ b/docs/reference/eql/search.asciidoc @@ -8,7 +8,8 @@ experimental::[] To start using EQL in {es}, first ensure your event data meets <>. You can then use the <> to search event data stored in one or more {es} data streams or -indices. +indices. The API requires a query written in {es}'s supported <>. .*Example* [%collapsible] diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc index 1b20f5a3c97..7d72f07332a 100644 --- a/docs/reference/eql/syntax.asciidoc +++ b/docs/reference/eql/syntax.asciidoc @@ -74,7 +74,7 @@ You can specify and combine these criteria using the following operators: You cannot use comparison operators to compare a variable, such as a field value, to another variable, even if those variables are modified using a ->. +<>. .*Example* [%collapsible] @@ -102,12 +102,12 @@ process where process.parent.name == "foo" and process.name == "foo" [IMPORTANT] ==== -Avoid using the equal operator (`==`) to perform exact matching on `text` field -values. +Avoid using the equal operator (`==`) to perform exact matching on +<> field values. -By default, {es} changes the values of <> fields as part of -<>. This can make finding exact matches for `text` field -values difficult. +By default, {es} changes the values of `text` fields as part of <>. This can make finding exact matches for `text` field values +difficult. To search `text` fields, consider using a <> that contains a <> query. @@ -350,8 +350,8 @@ the backslash remains in the resulting string. [NOTE] ==== -Raw strings cannot contain only a single backslash. Additionally, raw strings -cannot end in an odd number of backslashes. +Raw strings cannot contain only a single backslash or end in an odd number of +backslashes. ==== [discrete] @@ -375,8 +375,8 @@ dots (`.`), hyphens (`-`), or spaces, must be escaped using backticks (+++`+++). You can use EQL sequences to describe and match an ordered series of events. Each item in a sequence is an event category and event condition, -surrounded by square brackets. Events are listed in ascending chronological -order, with the most recent event listed last. +surrounded by square brackets (`[ ]`). Events are listed in ascending +chronological order, with the most recent event listed last. [source,eql] ----