5e09762a27
[DOCS] EQL: Align comments in `between` fn examples
2020-05-15 09:20:45 -04:00
24cd45345e
[DOCS] EQL: Remove references to arrays/multi-value fields ( #56772 )
2020-05-15 09:09:07 -04:00
2a943a58a4
[DOCS] EQL: Document `number` function ( #56770 )
...
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-05-14 15:44:04 -04:00
8e005db3e6
[DOCS] EQL: Document math functions ( #55810 ) ( #56337 )
...
Documents the following EQL functions:
* `add`
* `divide`
* `module`
* `multiply`
* `subtract`
2020-05-07 09:18:43 -04:00
8686200a32
[DOCS] EQL: Document `concat` function ( #56239 )
...
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-05-05 16:45:29 -04:00
cd3663e5fa
[DOCS] EQL: Document `match` function ( #56134 )
2020-05-05 12:03:02 -04:00
4dfdd46dc3
[DOCS] EQL: Remove case sensitivity from function docs ( #55063 )
...
Per #54411 , we plan to handle case sensitivity via a parameter for the
EQL search API (with the possible exception of the `between` function).
This removes references and examples related to case sensitivity from
the EQL functions docs.
2020-05-05 09:26:49 -04:00
65b47d20a6
[DOCS] Update attribute for multi arg footnotes ( #55860 )
2020-04-29 10:25:36 -04:00
1808a1f36b
[DOCS] EQL: Correct `cidrMatch` function heading ( #55935 )
2020-04-29 10:02:06 -04:00
c16b1edae0
[DOCS] EQL: Fix whitespace in `stringContains` docs
2020-04-27 15:53:59 -04:00
5981412bf7
[DOCS] EQL: Document `stringContains` function ( #54968 )
2020-04-24 15:09:05 -04:00
e4ebe55d04
[DOCS] EQL: Document `cidrMatch` function ( #54216 ) ( #55739 )
2020-04-24 14:01:11 -04:00
4f2ab96f38
[DOCS] EQL: Document `indexOf` function ( #55071 )
2020-04-15 11:29:50 -04:00
3fbd8b371f
[DOCS] Use consistent line breaks in EQL function docs
2020-04-14 10:17:45 -04:00
57d6493e29
[DOCS] EQL: Document `string` function ( #55086 )
2020-04-13 11:23:45 -04:00
2655dfa2fe
[DOCS] EQL: Reword field support for EQL functions ( #55074 )
...
Changes boilerplate sentence of "If using a field as the argument, this
parameter only supports..." to "...this parameter supports only...".
The latter is a bit more clear and readable.
2020-04-10 15:33:29 -04:00
c440754784
[DOCS] EQL: Document `wildcard` function ( #54086 )
2020-04-10 09:18:29 -04:00
964cf565c9
[DOCS] EQL: Document `between` function ( #54950 )
2020-04-08 13:49:15 -04:00
4982b720ef
[DOCS] EQL: Document `length` function ( #54225 )
2020-04-01 11:35:36 -04:00
b43eb5ac32
[DOCS] EQL: Document `endsWith` function ( #54521 )
2020-04-01 10:43:37 -04:00
95622d8782
[DOCS] EQL: Document `startsWith` function ( #54518 ) ( #54578 )
2020-04-01 09:30:27 -04:00
30a32040d3
[DOCS] EQL: Document `substring` function ( #53867 )
...
Adds documentation for the EQL `substring` function.
Supporting changes:
* Creates a new "EQL function reference" page
* Updates the title of the "EQL syntax reference" page for consistency
* Adds a brief "Functions" section to the EQL syntax docs
* Updates EQL limitations docs to state that only array functions are
unsupported
2020-03-25 12:23:59 -04:00
James Rodewig