diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc index cbb5fb780ae..a72a9bc656c 100644 --- a/docs/reference/eql/syntax.asciidoc +++ b/docs/reference/eql/syntax.asciidoc @@ -10,7 +10,7 @@ experimental::[] [IMPORTANT] ==== -{es} supports a subset of EQL syntax. +{es} supports a subset of EQL syntax. See <>. ==== [discrete] @@ -72,6 +72,19 @@ You can specify and combine these criteria using the following operators: < <= == != >= > ---- +[IMPORTANT] +==== +Avoid using the equal operator (`==`) to perform exact matching on `text` field +values. + +By default, {es} changes the values of <> fields as part of +<>. This can make finding exact matches for `text` field +values difficult. + +To search `text` fields, consider using a <> that contains a <> query. +==== + .*Definitions* [%collapsible] ====