[DOCS] Fix syntax and wording in EQL docs (#59623) (#59650)

This commit is contained in:
James Rodewig 2020-07-15 14:45:56 -04:00 committed by GitHub
parent 93d419b9c8
commit e30af2fc35
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 15 additions and 14 deletions

View File

@ -13,8 +13,8 @@ EQL is schema-less and works well with most common log formats.
[TIP] [TIP]
==== ====
While no schema is required to use EQL in {es}, we recommend the While no schema is required to use EQL in {es}, we recommend the
{ecs-ref}[Elastic Common Schema (ECS)]. The EQL search API is designed to work {ecs-ref}[Elastic Common Schema (ECS)]. The <<eql-search-api,EQL search API>> is
with core ECS fields by default. designed to work with core ECS fields by default.
==== ====
[discrete] [discrete]
@ -38,6 +38,6 @@ mapped as a <<date,`date`>> or <<date_nanos,`date_nanos`>> field.
[NOTE] [NOTE]
==== ====
You cannot use a <<nested,`nested`>> field data type or the sub-fields of a You cannot use a <<nested,`nested`>> field data type or the sub-fields of a
`nested` field dataype as the timestamp or event category field. See `nested` field as the timestamp or event category field. See
<<eql-nested-fields>>. <<eql-nested-fields>>.
==== ====

View File

@ -8,7 +8,8 @@ experimental::[]
To start using EQL in {es}, first ensure your event data meets To start using EQL in {es}, first ensure your event data meets
<<eql-requirements,EQL requirements>>. You can then use the <<eql-search-api,EQL <<eql-requirements,EQL requirements>>. You can then use the <<eql-search-api,EQL
search API>> to search event data stored in one or more {es} data streams or search API>> to search event data stored in one or more {es} data streams or
indices. indices. The API requires a query written in {es}'s supported <<eql-syntax,EQL
syntax>>.
.*Example* .*Example*
[%collapsible] [%collapsible]

View File

@ -74,7 +74,7 @@ You can specify and combine these criteria using the following operators:
You cannot use comparison operators to compare a variable, such as a field You cannot use comparison operators to compare a variable, such as a field
value, to another variable, even if those variables are modified using a value, to another variable, even if those variables are modified using a
<eql-functions,function>>. <<eql-functions,function>>.
.*Example* .*Example*
[%collapsible] [%collapsible]
@ -102,12 +102,12 @@ process where process.parent.name == "foo" and process.name == "foo"
[IMPORTANT] [IMPORTANT]
==== ====
Avoid using the equal operator (`==`) to perform exact matching on `text` field Avoid using the equal operator (`==`) to perform exact matching on
values. <<text,`text`>> field values.
By default, {es} changes the values of <<text,`text`>> fields as part of By default, {es} changes the values of `text` fields as part of <<analysis,
<<analysis, analysis>>. This can make finding exact matches for `text` field analysis>>. This can make finding exact matches for `text` field values
values difficult. difficult.
To search `text` fields, consider using a <<eql-search-filter-query-dsl,query To search `text` fields, consider using a <<eql-search-filter-query-dsl,query
DSL filter>> that contains a <<query-dsl-match-query,`match`>> query. DSL filter>> that contains a <<query-dsl-match-query,`match`>> query.
@ -350,8 +350,8 @@ the backslash remains in the resulting string.
[NOTE] [NOTE]
==== ====
Raw strings cannot contain only a single backslash. Additionally, raw strings Raw strings cannot contain only a single backslash or end in an odd number of
cannot end in an odd number of backslashes. backslashes.
==== ====
[discrete] [discrete]
@ -375,8 +375,8 @@ dots (`.`), hyphens (`-`), or spaces, must be escaped using backticks (+++`+++).
You can use EQL sequences to describe and match an ordered series of events. You can use EQL sequences to describe and match an ordered series of events.
Each item in a sequence is an event category and event condition, Each item in a sequence is an event category and event condition,
surrounded by square brackets. Events are listed in ascending chronological surrounded by square brackets (`[ ]`). Events are listed in ascending
order, with the most recent event listed last. chronological order, with the most recent event listed last.
[source,eql] [source,eql]
---- ----