2629a95e14
[DOCS] EQL: Document `until` keyword support ( #59320 ) ( #59408 )
2020-07-13 09:05:47 -04:00
896d0ffd9b
[DOCS] EQL: Prepare docs for release ( #59259 ) ( #59407 )
...
Changes:
* Swaps the `dev` admonitions for `experimental` admonitions
* Removes `ifdef` statements preventing the docs from appearing in
released branches
2020-07-13 09:04:15 -04:00
9d5c091f7a
[DOCS] Add data streams to EQL search docs ( #58611 ) ( #59404 )
2020-07-13 09:03:55 -04:00
c0e0bca84c
Remove search_after and implicit_join_key_field ( #59232 ) ( #59280 )
...
(cherry picked from commit 6ede6c59eff321b9fedad30e19508b9e4f788b54)
2020-07-09 12:34:01 +03:00
93a5eb0688
[DOCS] EQL: Document `size` limit for pipes ( #59085 ) ( #59236 )
...
Changes:
* Documents the `size` default as `10`.
* Updates `size` param def to note its relation to pipes.
* Updates the `head` and `tail` pipe docs to modify sequences.
* Documents the `fetch_size` parameter.
Relates to #59014 and #59063
2020-07-08 12:22:57 -04:00
b27de36b5d
[DOCS] EQL: Document `maxspan` keyword ( #58931 ) ( #59223 )
2020-07-08 11:04:28 -04:00
37be56ab97
[DOCS] EQL: Document unsupported var comparison ( #58941 ) ( #59224 )
...
ES EQL queries do not support the comparison of a variable, such as
a field value, to another variable.
This adds a related para and example to the EQL syntax docs.
2020-07-08 11:04:05 -04:00
6ed356ffc3
[DOCS] Replace `datatype` with `data type` ( #58972 ) ( #59184 )
2020-07-07 14:59:35 -04:00
2c43421208
[DOCS] Change Beats links to refactored getting started docs ( #58790 )
2020-07-02 17:11:25 -07:00
770f9f11af
[DOCS] Fix xref format in async EQL search docs
2020-06-30 09:37:47 -04:00
d8731853a3
[DOCS] EQL: Document `head` and `tail` pipes ( #58673 ) ( #58739 )
2020-06-30 09:12:54 -04:00
735a3f344d
[DOCS] EQL: Remove fields from EQL search response ( #58667 ) ( #58669 )
2020-06-29 09:34:20 -04:00
3c81b91474
EQL: Add Head/Tail pipe support ( #58536 )
...
Introduce pipe support, in particular head and tail
(which can also be chained).
(cherry picked from commit 4521ca3367147d4d6531cf0ab975d8d705f400ea)
(cherry picked from commit d6731d659d012c96b19879d13cfc9e1eaf4745a4)
2020-06-27 09:49:14 +03:00
b37b318d0d
[DOCS] EQL: Remove references to partial async EQL results ( #58548 ) ( #58609 )
...
Removes references to partial results from the async EQL search docs.
If an EQL search does not complete during the `wait_for_completion_timeout`
timeout period, it returns no results.
2020-06-26 11:11:55 -04:00
c613e0915a
[DOCS] EQL: Document search API's `tiebreaker_field` param ( #57935 ) ( #58540 )
2020-06-26 09:25:24 -04:00
20af856abd
[7.x] EQL: Adds an ability to execute an asynchronous EQL search ( #58192 )
...
Adds async support to EQL searches
Closes #49638
Co-authored-by: James Rodewig james.rodewig@elastic.co
2020-06-25 14:11:57 -04:00
44c3bb29e2
[DOCS] EQL: Correct EQL search API's `size` param def
...
The `size` parameter can be used to limit matching events or sequences.
2020-06-10 10:12:54 -04:00
641ed484d8
[DOCS] EQL: Add `dev` admonition to EQL pages ( #57531 ) ( #57533 )
...
Adds the `dev` admonition to EQL features, which are in development
under a feature flag.
2020-06-02 11:03:12 -04:00
fd6dabf158
[DOCS] EQL: Fix hits param for sequences ( #57410 ) ( #57524 )
2020-06-02 09:38:00 -04:00
db5bf92acf
[7.x][DOCS] Replace docdir attribute with es-repo-dir ( #57489 ) ( #57494 )
2020-06-01 16:42:53 -07:00
cc12361a82
[DOCS] EQL: Fix whitespace in EQL snippet
2020-05-19 17:04:49 -04:00
771ddbf083
[DOCS] EQL: Add sequence example to tutorial ( #56965 ) ( #56966 )
...
Adds an example using the sequence syntax to the 'Run an EQL search'
tutorial.
Supplements other examples added with #56721
2020-05-19 16:14:57 -04:00
cc43d67eb1
[DOCS] Add leading slashes to EQL API examples
2020-05-19 15:38:37 -04:00
22f54ba205
[DOCS] EQL: Fix API example headings
2020-05-18 16:29:29 -04:00
c50f86fbba
[DOCS] EQL: Document `case_sensitive` param ( #56697 ) ( #56818 )
2020-05-15 11:47:19 -04:00
5e09762a27
[DOCS] EQL: Align comments in `between` fn examples
2020-05-15 09:20:45 -04:00
24cd45345e
[DOCS] EQL: Remove references to arrays/multi-value fields ( #56772 )
2020-05-15 09:09:07 -04:00
2a943a58a4
[DOCS] EQL: Document `number` function ( #56770 )
...
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-05-14 15:44:04 -04:00
2921747b23
[7.x] [DOCS] EQL: Document sequences ( #56721 ) ( #56774 )
...
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-05-14 11:51:40 -04:00
d247e8f7a6
[DOCS] Sort EQL search API params alphabetically
2020-05-12 13:52:18 -04:00
8e005db3e6
[DOCS] EQL: Document math functions ( #55810 ) ( #56337 )
...
Documents the following EQL functions:
* `add`
* `divide`
* `module`
* `multiply`
* `subtract`
2020-05-07 09:18:43 -04:00
8686200a32
[DOCS] EQL: Document `concat` function ( #56239 )
...
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-05-05 16:45:29 -04:00
dac4ed282e
[DOCS] EQL: Add collapsible sections to EQL tutorial docs ( #56235 )
...
Adds collapsible sections to the snippet examples of the EQL tutorial
docs.
Also adds a leading slash to EQL API snippet examples.
2020-05-05 16:29:51 -04:00
e7df8b388e
[DOCS] EQL: Add collapsible sections to EQL search API response ( #56232 )
...
Add collapsible sections to the response parameter docs
of the EQL search API.
Also clarifies some language regarding documents and
events.
2020-05-05 16:01:55 -04:00
cd3663e5fa
[DOCS] EQL: Document `match` function ( #56134 )
2020-05-05 12:03:02 -04:00
44414acd3b
[DOCS] EQL: Document nested field support ( #56138 )
...
Notes that you cannot use EQL in ES to search the values of `nested`
fields or their sub-fields. However, indices containing `nested` field
mappings are otherwise supported.
2020-05-05 11:46:06 -04:00
4dfdd46dc3
[DOCS] EQL: Remove case sensitivity from function docs ( #55063 )
...
Per #54411 , we plan to handle case sensitivity via a parameter for the
EQL search API (with the possible exception of the `between` function).
This removes references and examples related to case sensitivity from
the EQL functions docs.
2020-05-05 09:26:49 -04:00
61cf646f17
[DOCS] EQL: Add advantages to overview ( #53452 ) ( #56052 )
...
Adds a concise list of EQL advantages, based on the "EQL Advantages"
section in the [EQL for the masses][0] blog post.
The intent is to inform users how EQL could benefit at a high level.
[0]: https://www.elastic.co/blog/eql-for-the-masses
Co-Authored-By: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-04-30 13:19:31 -04:00
65b47d20a6
[DOCS] Update attribute for multi arg footnotes ( #55860 )
2020-04-29 10:25:36 -04:00
1808a1f36b
[DOCS] EQL: Correct `cidrMatch` function heading ( #55935 )
2020-04-29 10:02:06 -04:00
c16b1edae0
[DOCS] EQL: Fix whitespace in `stringContains` docs
2020-04-27 15:53:59 -04:00
c1b0548db0
[DOCS] Document EQL search REST API ( #52384 )
2020-04-24 15:36:01 -04:00
5981412bf7
[DOCS] EQL: Document `stringContains` function ( #54968 )
2020-04-24 15:09:05 -04:00
e4ebe55d04
[DOCS] EQL: Document `cidrMatch` function ( #54216 ) ( #55739 )
2020-04-24 14:01:11 -04:00
e74fdacabd
[DOCS] Add admonition for EQL exact matches on text fields ( #53402 ) ( #55670 )
...
Adds a important admonition to the EQL syntax page noting that
the equal (`==`) operator should not be used to match `text` field
values.
Relates to #52709 and #53020
2020-04-23 10:59:50 -04:00
4f2ab96f38
[DOCS] EQL: Document `indexOf` function ( #55071 )
2020-04-15 11:29:50 -04:00
3fbd8b371f
[DOCS] Use consistent line breaks in EQL function docs
2020-04-14 10:17:45 -04:00
57d6493e29
[DOCS] EQL: Document `string` function ( #55086 )
2020-04-13 11:23:45 -04:00
2655dfa2fe
[DOCS] EQL: Reword field support for EQL functions ( #55074 )
...
Changes boilerplate sentence of "If using a field as the argument, this
parameter only supports..." to "...this parameter supports only...".
The latter is a bit more clear and readable.
2020-04-10 15:33:29 -04:00
c440754784
[DOCS] EQL: Document `wildcard` function ( #54086 )
2020-04-10 09:18:29 -04:00
James Rodewig
Andrei Stefan
DeDe Morton
Costin Leau
Igor Motov
Lisa Cawley