[DOCS] Add admonition for EQL exact matches on text fields (#53402) (#55670)

Adds a important admonition to the EQL syntax page noting that
the equal (`==`) operator should not be used to match `text` field
values.

Relates to #52709 and #53020
This commit is contained in:
James Rodewig 2020-04-23 10:59:50 -04:00 committed by GitHub
parent dc899781f2
commit e74fdacabd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 1 deletions

View File

@ -10,7 +10,7 @@ experimental::[]
[IMPORTANT] [IMPORTANT]
==== ====
{es} supports a subset of EQL syntax. {es} supports a subset of EQL syntax. See <<eql-limitations>>.
==== ====
[discrete] [discrete]
@ -72,6 +72,19 @@ You can specify and combine these criteria using the following operators:
< <= == != >= > < <= == != >= >
---- ----
[IMPORTANT]
====
Avoid using the equal operator (`==`) to perform exact matching on `text` field
values.
By default, {es} changes the values of <<text,`text`>> fields as part of
<<analysis, analysis>>. This can make finding exact matches for `text` field
values difficult.
To search `text` fields, consider using a <<eql-search-filter-query-dsl,query
DSL filter>> that contains a <<query-dsl-match-query,`match`>> query.
====
.*Definitions* .*Definitions*
[%collapsible] [%collapsible]
==== ====