honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-03-09 14:34:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
OpenSearch/docs/reference/eql
History
James Rodewig 92d570d6f3
[DOCS] EQL: Add search/index speed tip for functions (#54346) (#54575) 
EQL functions are an easy way for users to transform indexed data
at search time. However, using multiple functions can make
queries difficult to write and slows search speeds.

Users can circumvent this by indexing fields containing the transformed
data, but that usually slows index speeds.

This adds a related tip and example covering these tradeoffs.
2020-04-01 08:39:04 -04:00
..
functions.asciidoc
[DOCS] EQL: Document substring function (#53867)
2020-03-25 12:23:59 -04:00
index.asciidoc
[DOCS] EQL: Document substring function (#53867)
2020-03-25 12:23:59 -04:00
limitations.asciidoc
[DOCS] EQL: Document substring function (#53867)
2020-03-25 12:23:59 -04:00
requirements.asciidoc
[DOCS] Update EQL default event category and timestamp values (#53102)
2020-03-04 09:17:37 -05:00
search.asciidoc
[DOCS] Adds Beats tip to EQL search docs (#53292)
2020-03-10 05:16:18 -04:00
syntax.asciidoc
[DOCS] EQL: Add search/index speed tip for functions (#54346) (#54575)
2020-04-01 08:39:04 -04:00