parent
93d419b9c8
commit
e30af2fc35
|
@ -13,8 +13,8 @@ EQL is schema-less and works well with most common log formats.
|
||||||
[TIP]
|
[TIP]
|
||||||
====
|
====
|
||||||
While no schema is required to use EQL in {es}, we recommend the
|
While no schema is required to use EQL in {es}, we recommend the
|
||||||
{ecs-ref}[Elastic Common Schema (ECS)]. The EQL search API is designed to work
|
{ecs-ref}[Elastic Common Schema (ECS)]. The <<eql-search-api,EQL search API>> is
|
||||||
with core ECS fields by default.
|
designed to work with core ECS fields by default.
|
||||||
====
|
====
|
||||||
|
|
||||||
[discrete]
|
[discrete]
|
||||||
|
@ -38,6 +38,6 @@ mapped as a <<date,`date`>> or <<date_nanos,`date_nanos`>> field.
|
||||||
[NOTE]
|
[NOTE]
|
||||||
====
|
====
|
||||||
You cannot use a <<nested,`nested`>> field data type or the sub-fields of a
|
You cannot use a <<nested,`nested`>> field data type or the sub-fields of a
|
||||||
`nested` field dataype as the timestamp or event category field. See
|
`nested` field as the timestamp or event category field. See
|
||||||
<<eql-nested-fields>>.
|
<<eql-nested-fields>>.
|
||||||
====
|
====
|
||||||
|
|
|
@ -8,7 +8,8 @@ experimental::[]
|
||||||
To start using EQL in {es}, first ensure your event data meets
|
To start using EQL in {es}, first ensure your event data meets
|
||||||
<<eql-requirements,EQL requirements>>. You can then use the <<eql-search-api,EQL
|
<<eql-requirements,EQL requirements>>. You can then use the <<eql-search-api,EQL
|
||||||
search API>> to search event data stored in one or more {es} data streams or
|
search API>> to search event data stored in one or more {es} data streams or
|
||||||
indices.
|
indices. The API requires a query written in {es}'s supported <<eql-syntax,EQL
|
||||||
|
syntax>>.
|
||||||
|
|
||||||
.*Example*
|
.*Example*
|
||||||
[%collapsible]
|
[%collapsible]
|
||||||
|
|
|
@ -74,7 +74,7 @@ You can specify and combine these criteria using the following operators:
|
||||||
|
|
||||||
You cannot use comparison operators to compare a variable, such as a field
|
You cannot use comparison operators to compare a variable, such as a field
|
||||||
value, to another variable, even if those variables are modified using a
|
value, to another variable, even if those variables are modified using a
|
||||||
<eql-functions,function>>.
|
<<eql-functions,function>>.
|
||||||
|
|
||||||
.*Example*
|
.*Example*
|
||||||
[%collapsible]
|
[%collapsible]
|
||||||
|
@ -102,12 +102,12 @@ process where process.parent.name == "foo" and process.name == "foo"
|
||||||
|
|
||||||
[IMPORTANT]
|
[IMPORTANT]
|
||||||
====
|
====
|
||||||
Avoid using the equal operator (`==`) to perform exact matching on `text` field
|
Avoid using the equal operator (`==`) to perform exact matching on
|
||||||
values.
|
<<text,`text`>> field values.
|
||||||
|
|
||||||
By default, {es} changes the values of <<text,`text`>> fields as part of
|
By default, {es} changes the values of `text` fields as part of <<analysis,
|
||||||
<<analysis, analysis>>. This can make finding exact matches for `text` field
|
analysis>>. This can make finding exact matches for `text` field values
|
||||||
values difficult.
|
difficult.
|
||||||
|
|
||||||
To search `text` fields, consider using a <<eql-search-filter-query-dsl,query
|
To search `text` fields, consider using a <<eql-search-filter-query-dsl,query
|
||||||
DSL filter>> that contains a <<query-dsl-match-query,`match`>> query.
|
DSL filter>> that contains a <<query-dsl-match-query,`match`>> query.
|
||||||
|
@ -350,8 +350,8 @@ the backslash remains in the resulting string.
|
||||||
|
|
||||||
[NOTE]
|
[NOTE]
|
||||||
====
|
====
|
||||||
Raw strings cannot contain only a single backslash. Additionally, raw strings
|
Raw strings cannot contain only a single backslash or end in an odd number of
|
||||||
cannot end in an odd number of backslashes.
|
backslashes.
|
||||||
====
|
====
|
||||||
|
|
||||||
[discrete]
|
[discrete]
|
||||||
|
@ -375,8 +375,8 @@ dots (`.`), hyphens (`-`), or spaces, must be escaped using backticks (+++`+++).
|
||||||
|
|
||||||
You can use EQL sequences to describe and match an ordered series of events.
|
You can use EQL sequences to describe and match an ordered series of events.
|
||||||
Each item in a sequence is an event category and event condition,
|
Each item in a sequence is an event category and event condition,
|
||||||
surrounded by square brackets. Events are listed in ascending chronological
|
surrounded by square brackets (`[ ]`). Events are listed in ascending
|
||||||
order, with the most recent event listed last.
|
chronological order, with the most recent event listed last.
|
||||||
|
|
||||||
[source,eql]
|
[source,eql]
|
||||||
----
|
----
|
||||||
|
|
Loading…
Reference in New Issue