From eca0401d5694677e15dba905d7b37a91b932f4c1 Mon Sep 17 00:00:00 2001 From: James Rodewig <40268737+jrodewig@users.noreply.github.com> Date: Tue, 1 Dec 2020 11:56:12 -0500 Subject: [PATCH] [DOCS] EQL: Remove outdated wildcard ref (#65684) (#65691) --- docs/reference/eql/functions.asciidoc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/docs/reference/eql/functions.asciidoc b/docs/reference/eql/functions.asciidoc index a3e707c6891..8d0f1a6da36 100644 --- a/docs/reference/eql/functions.asciidoc +++ b/docs/reference/eql/functions.asciidoc @@ -1015,10 +1015,6 @@ expressions. Matching is case-sensitive. *Example* [source,eql] ---- -// The two following expressions are equivalent. -process.name == "*regsvr32*" or process.name == "*explorer*" -wildcard(process.name, "*regsvr32*", "*explorer*") - // process.name = "regsvr32.exe" wildcard(process.name, "*regsvr32*") // returns true wildcard(process.name, "*regsvr32*", "*explorer*") // returns true