honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] EQL: Fix hits param for sequences (#57410) (#57524)

This commit is contained in:
James Rodewig 2020-06-02 09:38:00 -04:00 committed by GitHub
parent 8584da40af
commit fd6dabf158
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
docs/reference/eql/eql-search-api.asciidoc
View File

@ -174,7 +174,7 @@ If `true`, the request timed out before completion.
`hits`::
(object)
Contains matching events and metadata.
Contains matching events and sequences. Also contains related metadata.
+
.Properties of `hits`
[%collapsible%open]
@ -182,7 +182,7 @@ Contains matching events and metadata.
`total`::
(object)
Metadata about the number of matching events.
Metadata about the number of matching events or sequences.
+
.Properties of `total`
[%collapsible%open]
@ -190,18 +190,21 @@ Metadata about the number of matching events.
`value`::
(integer)
Total number of matching events.
For <<eql-basic-syntax,basic queries>>, the total number of matching events.
+
For <<eql-sequences,sequence queries>>, the total number of matching sequences.
`relation`::
+
--
(string)
Indicates whether the number of events returned is accurate or a lower bound.
Indicates whether the number of events or sequences returned is accurate or a
lower bound.
Returned values are:
`eq`::: Accurate
`gte`::: Lower bound, including returned events
`gte`::: Lower bound, including returned events or sequences
--
=====