Commit Graph

7929 Commits

Author SHA1 Message Date
James Rodewig 2ba1b105ba
[DOCS] Note heap size must be set to same min and max (#64090) (#64476)
Co-authored-by: C.J. Jameson <cjcjameson@users.noreply.github.com>
2020-11-02 09:22:49 -05:00
Andrei Dan dca1724bdc
[DOCS]: ILM rollover max_age condition disregards origination date (#64404) (#64459)
(cherry picked from commit d061c11899d6616b6d4356665b4a78a521bbc06f)
Signed-off-by: Andrei Dan <andrei.dan@elastic.co>
2020-11-02 10:00:05 +00:00
James Rodewig f6cebd62cc
[DOCS] Change agg titles to sentence case (#64425) (#64431) 2020-10-30 13:46:12 -04:00
James Rodewig 0c28bccbc8
[DOCS] Rewrite aggs overview (#64318) (#64410)
- Replaces more abstract docs about object structure and values source with task-based examples.
- Relocates several sections from the current `misc.asciidoc` file.
- Alphabetically sorts agg categories in the nav.
- Removes the matrix agg family. Moves the stats matrix agg under the metric agg family
2020-10-30 10:31:16 -04:00
James Rodewig ed4f11f203
[DOCS] Move Kibana index mgmt docs to ES (#64380) (#64414) 2020-10-30 09:30:21 -04:00
István Zoltán Szabó 48f57d952e
[DOCS] Fixes 'the the' typo in transforms docs. (#64393) (#64398) 2020-10-30 11:21:04 +01:00
Andrei Dan 5134a74e84
Update 7.10 release notes after respin. (#64368) 2020-10-30 08:55:59 +00:00
Jason Tedor b910acbb5e
Clarify ingest-geoip database_file docs (#64340)
The docs for the geoip processor database_file option appear to indicate
that all geoip databases are in the config directory. This is leftover
legacy from when this was the case when ingest-geoip was a plugin, but
it is no longer true as the built-in databases now ship inside the
ingest-geoip module that is bundled by default. This commit clarifies
those docs.

Co-authored-by: Jakob Reiter <jakommo@users.noreply.github.com>
2020-10-29 13:30:20 -04:00
István Zoltán Szabó aeb955e07e
[DOCS] Adds note box about mappings to Transforms Painless examples (#64285) (#64363) 2020-10-29 17:35:38 +01:00
István Zoltán Szabó d007255e8f
[DOCS] Fixes typos in Transform Painless examples. (#64352) (#64358) 2020-10-29 16:58:19 +01:00
James Rodewig 68d72f1e01
[DOCS] Fix "the the" typos (#64344) (#64354) 2020-10-29 10:47:42 -04:00
James Rodewig 135a032fab
[DOCS] Fix whitespace in pattern replace token filter docs (#64345) (#64350) 2020-10-29 10:42:02 -04:00
James Rodewig a2b18e9ab9
[DOCS] Fix case for 'Boolean' (#64299) (#64342) 2020-10-29 10:05:57 -04:00
James Rodewig 9df7c943cb
[DOCS] Re-add sparse vector xref (#64307) (#64338) 2020-10-29 09:29:27 -04:00
debadair 536e100125
[DOCS] Add top-level Data management section. (#64185) (#64322)
* [DOCS] Add top-level Data management section.

* Edits

* Edits

* Fixed xrefs

* Apply suggestions from code review

Co-authored-by: Andrei Dan <andrei.dan@elastic.co>
Co-authored-by: Lee Hinman <dakrone@users.noreply.github.com>

* Update docs/reference/datatiers.asciidoc

* Update docs/reference/datatiers.asciidoc

Co-authored-by: Andrei Dan <andrei.dan@elastic.co>
Co-authored-by: Lee Hinman <dakrone@users.noreply.github.com>

Co-authored-by: Andrei Dan <andrei.dan@elastic.co>
Co-authored-by: Lee Hinman <dakrone@users.noreply.github.com>
2020-10-28 16:39:35 -07:00
James Rodewig e7f2beae05
[DOCS] Sort field data types in docs (#64288) (#64305)
Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
2020-10-28 13:54:12 -04:00
James Rodewig 0980b88e80
[DOCS] Fix `refresh` def in `update_by_query` docs (#64277) (#64296)
Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>

Co-authored-by: Rudolf Meijering <skaapgif@gmail.com>
2020-10-28 13:52:35 -04:00
James Rodewig 41db9f99da
[DOCS] Fix glossary formatting (#64118) (#64293) 2020-10-28 11:21:00 -04:00
James Rodewig 22e931ed72
[DOCS] EQL: Fix operator docs (#64286) (#64290) 2020-10-28 10:44:22 -04:00
Jason Tedor 72009a9edd
Clarify preferred method for setting heap size (#64256)
This commit clarifies that the preferred method for setting the heap
size is via jvm.options.d and that using the ES_JAVA_OPTS environment
variable is discouraged for production deployments.
2020-10-28 08:50:49 -04:00
Jason Tedor 04a9845a49
Adjust defaults for tiered data roles (#64015)
This commit adjusts the defaults for the tiered data roles so that they
are enabled by default, or if the node has the legacy data role. This
ensures that the default experience is that the tiered data roles are
enabled.

To fully specifiy the behavior for the tiered data roles then:
 - starting a new node with the defaults: enabled
 - starting a new node with node.roles configured: enabled if and only
   if the tiered data roles are explicitly configured, independently
   of the node having the data role
 - starting a new node with node.data enabled: enabled unless the
   tiered data roles are explicitly disabled
 - starting a new node with node.data disabled: disabled unless the
   tiered data roles are explicitly enabled
2020-10-27 12:48:31 -04:00
Adam Locke ce4ec307a2
Fixing typo in file name. (#64230) 2020-10-27 11:22:44 -04:00
James Rodewig 50d806dc9f
[DOCS] Fix pattern replace token filter intro (#64189) (#64218)
Removes an incorrect statement about anchoring regex patterns on tokens.

Co-authored-by: Elasticsearch addict <amitmbm87@gmail.com>
2020-10-27 10:35:34 -04:00
David Roberts 2422f62bab
[ML] Copy ml-cpp release note into ES docs (#64198)
Copies the release note for elastic/ml-cpp#1546 to where
it needs to be to get published
2020-10-27 12:11:22 +00:00
Andrei Dan 89e3a3178f
Add indexing speed improvement to the 7.10 release highlights (#63621)
Add indexing speed improvement to the 7.10 release highlights

Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
2020-10-26 15:11:40 +00:00
James Rodewig bec3eca234 [DOCS] Remove unneeded words in EQL docs 2020-10-24 20:28:23 -04:00
James Rodewig 8e726c3f14 [DOCS] Minor data stream docs fixes 2020-10-24 19:50:58 -04:00
James Rodewig 2cecbc8c83
[DOCS] Remove unneeded link 2020-10-24 17:06:30 -04:00
James Rodewig 361fa021fa
[DOCS] Tighten data streams copy (#64085) (#64111) 2020-10-24 14:39:13 -04:00
James Rodewig f19f170811
[DOCS] Tighten async EQL copy (#64106) (#64108) 2020-10-24 14:28:43 -04:00
James Rodewig d6143bb49d
[DOCS] Tighten EQL copy (#64081) (#64104) 2020-10-24 11:09:51 -04:00
debadair 0f5d98e40c
[DOCS] Add searchable snapshots topic. (#63040) (#64088)
* [DOCS] Add searchable snapshots topic.

* [DOCS] Add definitions & remove fully-remote storage.

* [DOCS] Fixed duplicate anchor.

* Expand conceptual docs for searchable snapshots

* Rewordings

* Glossary tidy-up

* Beta

* Reword

* More performance idea to a TIP

* use -> manage

* red -> not green

* Missing space?

* Update docs/reference/glossary.asciidoc

* Fix beta label

* Use more attributes, fix link titles

* Apply suggestions from code review

Co-authored-by: debadair <debadair@elastic.co>

* Reformat

* Minor rewordings

* More minor rewordings

* Address Henning's comments

Co-authored-by: David Turner <david.turner@elastic.co>
Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>

Co-authored-by: David Turner <david.turner@elastic.co>
Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
2020-10-22 15:00:15 -07:00
James Rodewig 6e61292096
[DOCS] Fix `ignore_unavailable` param in get index and get alias APIs (#64075) (#64079) 2020-10-22 16:21:14 -04:00
James Rodewig 044dfb4637
[DOCS] Fix cache setting name in 7.9 migration docs (#64063) (#64073)
The setting name is script.context.$CONTEXT.cache_max_size rather than
script.context.$CONTEXT.context_max_size.

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
2020-10-22 13:56:06 -04:00
James Rodewig ce6b13e993
[DOCS] Remove 7.9.3 coming tag (#64057) (#64060) 2020-10-22 08:46:29 -04:00
James Rodewig fa8ad3abde
[DOCS] Add release notes for 7.9.3 (#63834) (#64021)
Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
Co-authored-by: Marios Trivyzas <matriv@gmail.com>
2020-10-21 17:05:08 -04:00
Lisa Cawley 25be69ceaf [DOCS] Add tips for num_top_classes classification parameter (#63781) 2020-10-21 10:03:19 -07:00
markharwood b933bd9f45
Search - make term/prefix/wildcard/regex query parsing more lenient (#63926)
Remove errors when case_insensitive flag set to false

Closes #63893
2020-10-21 13:33:19 +01:00
István Zoltán Szabó 6f977fc6f7
[7.10][DOCS] Adds ML related release highlights to What's new. (#63934)
Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
2020-10-20 15:46:31 +02:00
Adam Locke e064db27b1
Move clone snapshot API page. (#63902) (#63936) 2020-10-20 09:03:56 -04:00
James Rodewig 3369216087 [DOCS] Fix typo 2020-10-19 14:44:43 -04:00
Adam Locke c28c3422bb
[DOCS] [7.10] Combining important config settings into a single page (#63849) (#63883)
* [DOCS] Combining important config settings into a single page (#63849)

* Combining important config settings into a single page.

* Updating ids for two pages causing link errors and implementing redirects.

* Updating links to use IDs instead of xrefs.
2020-10-19 12:59:44 -04:00
James Rodewig af9e96d681
[DOCS] EQL: Update `allow_no_indices` default (#63748) (#63891)
Co-authored-by: Adam Locke <adam.locke@elastic.co>
2020-10-19 12:31:22 -04:00
Aref Razavi 2950818d44 Remove useless parentheses in bucket_key formula (#63868) 2020-10-19 11:53:33 +02:00
István Zoltán Szabó eef670f004
[DOCS] Clarifies destination index mappings for Transforms. (#63794) (#63804) 2020-10-19 10:03:08 +02:00
Julie Tibshirani ff312512c5 Mark the search 'fields' option as beta. (#63699)
We've identified two important enhancements that may affect the API. We expect
any API changes from these enhancements to be minor, but want to leave open the
possibility for small breaks. For example, we may end up returning unmapped
fields by default, or omitting nested fields from the root hit. The impact to
users should be quite small.

We're tracking the issues we need to resolve before removing the 'beta' label
here: #60985.
2020-10-18 14:09:27 -07:00
Jay Greenberg 3e5e54b884 [DOCS] Add monitoring note (#61793) 2020-10-16 13:36:28 -07:00
James Rodewig 07e4129328
[DOCS] Remove 7.9.2 coming tags (#62872) (#63830)
Removes coming tags from 7.9.2 Release Notes.

Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co>
2020-10-16 12:44:53 -04:00
James Rodewig 309bb9bb3a
[7.10] Release notes for 7.9.2 (#62664) (#63827)
Co-authored-by: Dan Hermann <danhermann@users.noreply.github.com>
2020-10-16 12:18:36 -04:00
Mayya Sharipova c0c1a7a9a6 Apply boost only once for distance_feature query (#63767)
Currently if distance_feature query contains boost,
it incorrectly  gets applied twice: in AbstractQueryBuilder::toQuery and
we also pass this boost to Lucene's LongPoint.newDistanceFeatureQuery.
As a result we get incorrect scores.

This fixes this error to ensure that boost is applied only once.

Closes #63691
2020-10-16 10:02:55 -04:00
Andrei Dan f4a856d423
Update 7.10 release notes after respin (#63725) (#63757)
Adds PRs diff to the release notes.

(cherry picked from commit 1ede4b332e5f87591710723e1a6ff9353384e2ff)
Signed-off-by: Andrei Dan <andrei.dan@elastic.co>
2020-10-16 09:06:08 +01:00
James Rodewig da84622764
[DOCS] Document `discovery.seed_hosts` only supports YAML sequences and arrays (#63746) (#63776) 2020-10-15 16:56:48 -04:00
James Rodewig 41ee8df334
[DOCS] Clarifies the effect of per-field boosting (#63733) (#63744)
The original description of per-field boosting is incorrect. Boosting a
field does not imply that it is more important relative to other fields.
It simply means that the score is multiplied by the supplied boost
value. Due to the differences in each field's term and document
statistics, it's not possible to imply relative importance of fields
based on the per-field boost value alone.

Co-authored-by: Josh Devins <josh.devins@elastic.co>
2020-10-15 09:46:36 -04:00
James Rodewig eb3ae9a204
[DOCS] Replace xref with external link (#63736) 2020-10-15 08:47:04 -04:00
Andrei Dan 2cc0ccb110
Docs: sync breaking changes from release notes (#63479)
This syncs breaking changes from release notes

Co-authored-by: Lisa Cawley <lcawley@elastic.co>
Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
2020-10-15 08:45:26 +01:00
Andrei Dan e011d0328b
Add release notes for 7.10.0 (#63460)
This adds the release notes for 7.10.0

Co-authored-by: David Roberts <dave.roberts@elastic.co>
Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Co-authored-by: lcawl <lcawley@elastic.co>
2020-10-15 08:38:43 +01:00
Christoph Büscher fe75bf5cf3 [Docs] Correct default scroll_size for update by query (#63656)
The current _update_by_query documentation mentions a scroll_size default of 100 and later another default of 1000.
We use the default of 1000 defined in AbstractBulkByScrollRequest and this PR changes the documentation accordingly.

Closes #63637
2020-10-14 16:43:36 +02:00
James Rodewig bd7633482b
[DOCS] EQL: Remove `match` fn (#63271) (#63677) 2020-10-14 10:13:00 -04:00
James Rodewig 5fc25442c4 [DOCS] Reword EQL intro 2020-10-14 10:03:21 -04:00
James Rodewig f9adb36d7d
[DOCS] Update `ignore_unavailable` default for EQL search API (#63210) (#63674) 2020-10-14 09:56:46 -04:00
James Rodewig 5de05ba69c
[DOCS] EQL: Add `:` operator, remove wildcard operator (#63195) (#63666) 2020-10-14 09:31:20 -04:00
James Rodewig e4b4351a43
[DOCS] EQL: Remove Endgame EQL refs (#63636) (#63664) 2020-10-14 08:48:56 -04:00
James Rodewig 8455cf8ff0 [DOCS] Remove unneeded word in EQL docs 2020-10-13 13:57:41 -04:00
James Rodewig 086df0636e
[DOCS] EQL: Document multi-value field support (#63622) (#63633) 2020-10-13 12:44:48 -04:00
Andras Palinkas 4aabc050a0 SQL: Escaped wildcard (*) not accepted in LIKE (#63428)
For a query like `SELECT name FROM test WHERE name LIKE ''%c*'` ES SQL
generates an error. `*` is not a special character in a `LIKE` construct
and it's expected to not needing to be escaped, so the previous query
should work as is.
In the LIKE pattern any `*` character was treated as invalid character
and the usage of `%` or `_` was suggested instead. But `*` is a valid,
acceptable non-wildcard on the right side of the `LIKE` operator.

Fix: #55108
(cherry picked from commit 190d9fe3deb31aed0d8f312007360625d4fff217)
2020-10-13 10:47:03 -04:00
Andrei Dan b3aa575f0d
Add release 7.10 highlights (#63468)
Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Co-authored-by: Jay Modi <jaymode@users.noreply.github.com>
Co-authored-by: Adrien Grand <jpountz@gmail.com>
2020-10-13 13:25:08 +01:00
Przemysław Witek acbd48f834
[ML] Allow setting num_top_classes to a special value -1 (#63587) (#63602) 2020-10-13 13:57:50 +02:00
Adrien Grand 652af26369
Add space efficiency release highlight to 7.10. (#63475)
This release highlight is brought in by Lucene 8.7.

Co-authored-by: Andrei Dan <andrei.dan@elastic.co>
2020-10-13 13:42:21 +02:00
István Zoltán Szabó 7139c1d7db
[DOCS] Adds AUC ROC classification metric to the API examples (#63563) (#63596) 2020-10-13 12:18:29 +02:00
James Rodewig 25ead6abb7
[DOCS] Fix typo in search profile docs (#63522) (#63559)
Co-authored-by: ondrejbardon <70531797+ondrejbardon@users.noreply.github.com>
2020-10-12 10:13:13 -04:00
James Rodewig 9c170706dd
[DOCS] EQL: Move to beta (#63284) (#63552) 2020-10-12 09:12:26 -04:00
Ryan Ernst 01dde647a6
Remove glibc warning (#63447)
Now that the bundled jdk is switched to the Oracle JDK, the glibc
warning is no longer relevant. This commit removes the warning.
2020-10-08 14:45:43 -07:00
Lee Hinman 27f13267f0
Add release note highlights for data tiers (#63427)
This adds release note highlights for the data tiers formalization feature.

Relates to #60848
2020-10-08 14:39:09 -06:00
István Zoltán Szabó fe67d055f5 [DOCS] Adds huber and msle metrics to Evaluate API example calls (#63414) 2020-10-08 17:09:39 +02:00
Dan Hermann 25fc6746cc
[DOCS] allow_duplicates option for append processor (#62336) (#63486) 2020-10-08 09:01:43 -05:00
James Rodewig 5e623522d2
[DOCS] Move searchable snapshots to beta (#63436) (#63478) 2020-10-08 09:27:52 -04:00
Przemysław Witek bd761cce1d
[ML] Validate that AucRoc has the data necessary to be calculated (#63302) (#63454) 2020-10-08 09:52:15 +02:00
James Rodewig 58eaba9950
[DOCS] Add xref to data tiers content (#63426) (#63434) 2020-10-07 13:24:52 -04:00
Lisa Cawley 51e6274f1e
[DOCS] Add props for ILM searchable snapshot links (#63431) 2020-10-07 10:23:50 -07:00
Lisa Cawley edb6a5b674
[DOCS] Add props for searchable snapshots API links (#63420) (#63424) 2020-10-07 09:34:58 -07:00
Andrei Dan 6e80de0e34
DOCS: general overview of data tiers and roles (#63086) (#63422)
This adds general overview documentation for data tiers,
the data tiers specific node roles, and their application in
ILM.

Co-authored-by: Lee Hinman <dakrone@users.noreply.github.com>
Co-authored-by: debadair <debadair@elastic.co>
(cherry picked from commit d588cab74722bfb1d3ca0fea15d10c66af937306)
Signed-off-by: Andrei Dan <andrei.dan@elastic.co>
2020-10-07 17:31:15 +01:00
Alan Woodward 88b45dfa61
Convert TextFieldMapper to parametrized form (#63269) (#63392)
As a result of this, we can remove a chunk of code from TypeParsers as well. Tests
for search/index mode analyzers have moved into their own file. This commit also
rationalises the serialization checks for parameters into a single SerializerCheck
interface that takes the values includeDefaults, isConfigured and the value
itself.

Relates to #62988
2020-10-07 13:26:25 +01:00
Tim Brooks 855ab31f84
Add ess marker to indexing_pressure.memory.limit (#61127)
Adds marker indicating this setting is supported on Cloud.
2020-10-06 21:01:51 -06:00
James Rodewig 26a157da7b
[DOCS] Update snowball links (#63351) (#63355) 2020-10-06 16:21:37 -04:00
Gordon Brown 5c8b0662df
Deprecate REST access to System Indices (#63274) (Original #60945)
This PR adds deprecation warnings when accessing System Indices via the REST layer. At this time, these warnings are only enabled for Snapshot builds by default, to allow projects external to Elasticsearch additional time to adjust their access patterns.

Deprecation warnings will be triggered by all REST requests which access registered System Indices, except for purpose-specific APIs which access System Indices as an implementation detail a few specific APIs which will continue to allow access to system indices by default:

- `GET _cluster/health`
- `GET {index}/_recovery`
- `GET _cluster/allocation/explain`
- `GET _cluster/state`
- `POST _cluster/reroute`
- `GET {index}/_stats`
- `GET {index}/_segments`
- `GET {index}/_shard_stores`
- `GET _cat/[indices,aliases,health,recovery,shards,segments]`

Deprecation warnings for accessing system indices take the form:
```
this request accesses system indices: [.some_system_index], but in a future major version, direct access to system indices will be prevented by default
```
2020-10-06 13:41:40 -06:00
James Rodewig 3e548592b6
[DOCS] Update link to Snowball documentation (#63305) (#63348)
The current link points to an obsolete site, which is no longer maintained.

Co-authored-by: Stefan Walter <67258699+rd-stefan-walter@users.noreply.github.com>
2020-10-06 13:41:06 -04:00
Adam Locke 4307b1d607
[DOCS] Updating permissions language for RPM install packages (#63277) (#63344)
* Updating permissions language for RPM install packages.

* Fix typo
2020-10-06 13:09:50 -04:00
Lisa Cawley 8f76c89cd3
[7.x][DOCS] Add feature_importance_baseline to get trained model API (#63279) (#63336)
Co-authored-by: Benjamin Trent <ben.w.trent@gmail.com>
2020-10-06 10:08:34 -07:00
David Kyle ea32b4ab82
[ML] Audit message when nightly maintenance times out (#63252) (#63330)
During deletion of old ml data set the delete by query timeout to 8 hours and
audit a job message when the nightly maintenance task times out.
2020-10-06 16:19:37 +01:00
István Zoltán Szabó a3a373b67f
[DOCS] Adds delta and offset parameters to Evaluate DFA API docs (#63317) (#63329) 2020-10-06 16:49:08 +02:00
Mayya Sharipova bea0ead08a
Fix fields retrieval on unsinged_long field (#63310)
This fixes fields retrieval on unsigned_long field

1) For docvalue_fields a custom UnsignedLongLeafFieldData::getLeafValueFetcher
is implemented that correctly retrieves doc values.

2) For stored fields, an error was fixed in UnsignedLongFieldMapper
 how stored values were stored. Before they were incorrectly
stored in the shifted format, now they are stored as original
values in String format.

Relates to #60050
Backport for #63119
2020-10-06 06:37:31 -04:00
Armin Braun 5c3a4c13dd
Clone Snapshot API (#61839) (#63291)
Snapshot clone API. Complete except for some TODOs around documentation (and adding HLRC support).

backport of #61839, #63217, #63037
2020-10-06 01:52:25 +02:00
James Rodewig df0861348c
[DOCS] Document static/dynamic watcher settings (#62218) (#63282) 2020-10-05 15:50:01 -04:00
James Rodewig a8bf9a6a91
[DOCS] Make EQL case-sensitive by default (#63270) (#63280) 2020-10-05 15:49:48 -04:00
Andrei Stefan 76bba601ab
Remove case_sensitive request option (#63218) (#63244)
Make EQL case sensitive by default and adapt some of the string functions
Remove the case sensitive option from Between string function
Add case_insensitive option to term and wildcard queries usage

(cherry picked from commit 7550e0664c8c2f1f13519036c759b1e76345551f)
2020-10-05 22:04:42 +03:00
James Rodewig f4ddb43240
[DOCS] Clarify `allow_no_indices` def (#63209) (#63258) 2020-10-05 13:00:53 -04:00
Lisa Cawley 69c56d55dc [DOCS] Clarify BWC of monitoring clusters (#63151) 2020-10-02 14:09:30 -07:00
Lisa Cawley 4de6104dae
[DOCS] Fix titles for ML APIs (#63152) (#63207) 2020-10-02 14:01:01 -07:00
James Rodewig ade91a2d9d
[DOCS] EQL: Update syntax for escaped event categories (#63202) (#63208) 2020-10-02 15:19:12 -04:00
James Rodewig a22b90d3cc
[DOCS] EQL: Replace ?"..." with """...""" for raw strings (#63191) (#63198) 2020-10-02 14:03:58 -04:00