mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-05 20:48:22 +00:00
30a32040d3
Adds documentation for the EQL `substring` function. Supporting changes: * Creates a new "EQL function reference" page * Updates the title of the "EQL syntax reference" page for consistency * Adds a brief "Functions" section to the EQL syntax docs * Updates EQL limitations docs to state that only array functions are unsupported
32 lines
716 B
Plaintext
32 lines
716 B
Plaintext
[role="xpack"]
|
|
[testenv="basic"]
|
|
[[eql-limitations]]
|
|
== EQL limitations
|
|
++++
|
|
<titleabbrev>Limitations</titleabbrev>
|
|
++++
|
|
|
|
experimental::[]
|
|
|
|
[discrete]
|
|
[[eql-unsupported-syntax]]
|
|
=== Unsupported syntax
|
|
|
|
{es} supports a subset of {eql-ref}/index.html[EQL syntax]. {es} cannot run EQL
|
|
queries that contain:
|
|
|
|
* Array functions:
|
|
** {eql-ref}/functions.html#arrayContains[`arrayContains`]
|
|
** {eql-ref}/functions.html#arrayCount[`arrayCount`]
|
|
** {eql-ref}/functions.html#arraySearch[`arraySearch`]
|
|
|
|
* {eql-ref}/joins.html[Joins]
|
|
|
|
* {eql-ref}/basic-syntax.html#event-relationships[Lineage-related keywords]:
|
|
** `child of`
|
|
** `descendant of`
|
|
** `event of`
|
|
|
|
* {eql-ref}/pipes.html[Pipes]
|
|
|
|
* {eql-ref}/sequences.html[Sequences] |