Commit Graph

229 Commits

Author SHA1 Message Date
James Rodewig e5eb0bbf04
[main] EQL doc wrong description in query example (#101579) (#101709)
Co-authored-by: Ming <42666128+zethsqx@users.noreply.github.com>
2023-11-02 09:47:22 -04:00
Abdon Pijpelink 1955bd8ad4
[DOCS] New docs for remote clusters using API key authentication (#98330)
* New docs structure for remote clusters

* Fix broken cross-book link errors

* More broken cross-book link errors

* Remove redirects for new pages

* Link to generic remote cluster docs instead

* Drop 'API' from the abbreviated title

* Add 'Establish trust with a remote cluster' section

* Restructure 'Establish trust' section into Prprequisite/local/remote instructions

* Add 'Configure roles and users' section

* Add 'Connect to a remote cluster' section

* Move version compatibility to prerequisites

* Fix test errors

* Incorporate review feedback

* Mention version 8.10 or later in the intro for API keys

* Add license prerequisite
2023-08-24 12:30:03 +02:00
Abdon Pijpelink 2f320f1bf6
Revert "Revert "[DOCS] Add docs for EQL missing events"" (#98029)
* Revert "Revert "[DOCS] Add docs for EQL missing events (#97372)" (#98028)"

This reverts commit 46c81938d9.

* Changed response for missing events
2023-08-07 15:19:08 +02:00
Abdon Pijpelink 5ba98c569e
[DOCS] Skip testing the response of EQL sequence sample requests (#98112) 2023-08-02 15:58:52 +02:00
Abdon Pijpelink 46c81938d9
Revert "[DOCS] Add docs for EQL missing events (#97372)" (#98028)
This reverts commit 950c0b415a.
2023-07-28 11:57:13 +02:00
Abdon Pijpelink 950c0b415a
[DOCS] Add docs for EQL missing events (#97372) 2023-07-28 10:58:41 +02:00
David Kyle 85cb7e28f2
Mute DocsClientYamlTestSuiteIT test {yaml=reference/eql/eql/line_338} (#97717) 2023-07-17 14:20:25 +01:00
debadair 777598d602
[DOCS] Remove redirect pages (#88738)
* [DOCS] Remove manual redirects

* [DOCS] Removed refs to modules-discovery-hosts-providers

* [DOCS] Fixed broken internal refs

* Fixing bad cross links in ES book, and adding redirects.asciidoc[] back into docs/reference/index.asciidoc.

* Update docs/reference/search/point-in-time-api.asciidoc

Co-authored-by: James Rodewig <james.rodewig@elastic.co>

* Update docs/reference/setup/restart-cluster.asciidoc

Co-authored-by: James Rodewig <james.rodewig@elastic.co>

* Update docs/reference/sql/endpoints/translate.asciidoc

Co-authored-by: James Rodewig <james.rodewig@elastic.co>

* Update docs/reference/snapshot-restore/restore-snapshot.asciidoc

Co-authored-by: James Rodewig <james.rodewig@elastic.co>

* Update repository-azure.asciidoc

* Update node-tool.asciidoc

* Update repository-azure.asciidoc

---------

Co-authored-by: amyjtechwriter <61687663+amyjtechwriter@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Amy Jonsson <amy.jonsson@elastic.co>
Co-authored-by: James Rodewig <james.rodewig@elastic.co>
2023-05-24 12:32:46 +01:00
Abdon Pijpelink 273711b347
[DOCS] Add docs for EQL max_samples_per_key parameter (#92634)
* [DOCS] Add docs for EQL max_samples_per_key parameter

* Add 'in total' clarification
2023-01-04 11:11:24 +01:00
Abdon Pijpelink ca955b9470
[DOCS] Documentation for EQL samples (#92504)
* Add samples section to EQL page

* Add EQL samples syntax

* Improve wording and structure

* Reword Required field section

* Improve wording

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2023-01-03 09:52:31 +01:00
Luigi Dell'Aquila 6e5c3d952c
Update docs about EQL CCS (#91542) 2022-11-15 14:07:26 +01:00
Paramdeep Singh 34ff7a9d98
Consolidated Circuit Breaker documentation to include EQL and ML infer (#90809)
Fixes #85851 

Co-authored-by: Iraklis Psaroudakis <kingherc@gmail.com>
2022-10-14 14:33:52 +03:00
debadair 9fc5e2f75b
[DOCS] Fix link to AtomicRed JSON file (#88817)
* [DOCS] Fix link to AtomicRed JSON file

* Update docs/reference/eql/detect-threats-with-eql.asciidoc

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2022-07-26 10:54:18 -07:00
James Rodewig f9a64b2e86
[DOCS] Fix `ignore_unavailable` parameter definition (#84071)
The current `ignore_unavailable` definition is a bit misleading. The parameter primarily determines if a request that targets a missing or closed index returns an error.
2022-02-17 08:24:06 -05:00
Julie Tibshirani 8ca693b271
Add docs for kNN search endpoint (#80378)
This commit adds docs for the new `_knn_search` endpoint.

It focuses on being an API reference and is light on details in terms of how
exactly the kNN search works, and how the endpoint contrasts with
`script_score` queries. We plan to add a high-level guide on kNN search that
will explain this in depth.

Relates to #78473.
2021-11-09 09:28:12 -08:00
James Rodewig f56a0f4b66
[DOCS] Remove `testenv` annotations from doc snippet tests (#80023)
Removes `testenv` annotations and related code. These annotations originally let you skip x-pack snippet tests in the docs. However, that's no longer possible.

Relates to #79309, #31619
2021-11-05 18:38:50 -04:00
James Rodewig a509205f52
[DOCS] EQL: Document optional fields (#80150)
Adds new sections for optional fields and optional `by` fields. Also revises some existing content to define **join keys**.

Closes #79910

Relates to #79677
2021-11-03 08:48:48 -04:00
James Rodewig 2aff5b290d
[DOCS] EQL: Update headings for syntax docs (#80100)
Changes several H3s in the EQL syntax page to H4s. We previously bumped up several H4s to H3s to display them in the "On this page" TOC. With elastic/docs#2237, the TOC now displays H4s.

Relates to #65497.
2021-10-29 17:06:54 -04:00
James Rodewig 58abbe941f
[DOCS] Fix cluster update settings refs (#79580)
The API is named 'cluster update settings,' not 'update cluster settings.'
2021-10-20 13:16:35 -04:00
James Rodewig 2834b6d505
[DOCS] EQL: Consistently use 'statement' (#79020)
* [DOCS] EQL: Consistently use 'statement'

We describe `with runs` as a 'statement.' This updates `with maxspan`
to use the same terminology.

* whitespace
2021-10-12 20:17:22 -04:00
James Rodewig e7ab7c82a7
[DOCS] Update `runs` syntax (#78922)
Updates the EQL syntax docs for PR #78895.
2021-10-11 10:40:10 -04:00
James Rodewig c33e340a47
[DOCS] EQL: Document `runs` keyword (#78478) (#78518)
Documents the `runs` keyword for running the same event criteria successively in a sequence query.

Relates to #75082.

# Conflicts:
#	docs/reference/release-notes/highlights.asciidoc
2021-09-30 10:23:14 -04:00
Adam Locke 6940673e8a
[DOCS] Update remote cluster docs (#77043)
* [DOCS] Update remote cluster docs

* Add files, rename files, write new stuff

* Plethora of changes

* Add test and update snippets

* Redirects, moved files, and test updates

* Moved file to x-pack for tests

* Remove older CCS page and add redirects

* Cleanup, link updates, and some rewrites

* Update image

* Incorporating user feedback and rewriting much of the remote clusters page

* More changes from review feedback

* Numerous updates, including request examples for CCS and Kibana

* More changes from review feedback

* Minor clarifications on security for remote clusters

* Incorporate review feedback

Co-authored-by: Yang Wang <ywangd@gmail.com>

* Some review feedback and some editorial changes

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Yang Wang <ywangd@gmail.com>
2021-09-22 16:02:33 -04:00
James Rodewig f02b10d68a
[DOCS] EQL: Remove multi-value field limitation (#76663)
Changes:
* Removes the limitation for multi-value fields.
* Adds a recommendation to avoid complex expressions for Boolean comparisons to the `string` fn.

Relates to #76610.
2021-08-19 09:20:48 -04:00
Bogdan Pintea 7a5ac3e4a9
EQL: Minimise CCS roundtrips (#76076)
This introduces an optimisation of the EQL requests when these target
one remote cluster only (i.e. no mixed local and remote indices or
multiple remote clusters). In this case, the EQL request is forwarded
to the remote cluster and executed there, instead of having the local
cluster perform multiple queries to the remote cluster.
2021-08-18 14:01:43 +02:00
James Rodewig 96c4ee3e5c
[DOCS] Document `_mvt` API (#75384)
* [DOCS] Document `_mvt` API

Documents the `_mvt` API endpoint added with #73872.

Relates to #75242.

* Reword

* Rename API

* Fix doc.url in JSON spec

* Reword

* Reword

* Add content type to JSON spec

* Edits

* Fix typo

* Reword

* Update docs after meeting

* Fix typos

* Fix `size` default

* Updates for #75522

* Fixes

* Clean up JSON spec

* Fix extent tag

* [DOCS] Add `<field>` constraints

* Minor clarification

* Update for #75697

* Reword

* Update for #75621

* Reword default sort

* Update for #75367

* Remove unneeded whitespace

* Add experimental admon and if flags

* [DOCS] Remove ifdefs

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2021-08-05 15:04:07 -04:00
James Rodewig d9597da0ef
[DOCS] Update security prereqs for delete async EQL API (#75091) 2021-07-12 08:49:55 -04:00
James Rodewig 4e005c041c
[DOCS] EQL: Fix delete async EQL search snippet (#75093)
The delete async EQL search API doesn't support the `keep_alive` query parameter.
2021-07-07 16:49:22 -04:00
James Rodewig 3971522c65
[DOCS] EQL: Document cross-cluster search support (#74995) (#75045)
Closes #74842.
2021-07-07 09:41:07 -04:00
Marios Trivyzas dd302dcfef
EQL: [Docs] Add documentation for the CircuitBreaker (#74897)
Add documentation for the newly introduced CircuitBreaker, which is
used to restrict the memory usage for an EQL sequence query to avoid
OutOfMemory exceptions.

Follows: #74381
2021-07-07 09:20:25 +02:00
James Rodewig 845446aec3 [DOCS] EQL: Remove erroneous CSS reference 2021-07-01 17:05:44 -04:00
James Rodewig 70764de4b6
[DOCS] Move EQL APIs to separate page (#74846)
In preparation for #74845, we need to create formal API reference documentation for our SQL APIs.

Due to the number of SQL APIs, we'll likely need to create a separate nested page for them. For parity, this PR moves
our EQL APIs to a separate page as well. Previously, they were listed under our search APIs.
2021-07-01 13:59:35 -04:00
James Rodewig d522c28533 [DOCS] Reword EQL limitations intro. 2021-07-01 10:24:32 -04:00
James Rodewig c7d59f0a4d
[DOCS] EQL: Note EQL uses `fields` parameter (#74194) 2021-06-16 13:01:02 -04:00
James Rodewig 975ae227fc [DOCS] Fix typo in modulo example 2021-06-03 08:21:29 -04:00
James Rodewig 5729bb8d49
[DOCS] Update alias references (#73427)
Updates several `index aliases` references to `aliases`.
2021-05-27 16:00:57 -04:00
James Rodewig 39a0314d30
[DOCS] Update alias xrefs (#73380)
Updates several internal 'alias' xrefs to point to the aliases guide rather than
API docs.
2021-05-25 16:19:00 -04:00
James Rodewig dc1bf6eff9
[DOCS] EQL: Note CCS is not supported (#72975) 2021-05-12 09:19:29 -04:00
James Rodewig 965baad5c4
[DOCS] EQL: Update tiebreaker docs for implicit tiebreaker (#72808) 2021-05-06 14:48:46 -04:00
James Rodewig 44f3551786
[DOCS] EQL: Use ECS example in EQL syntax docs (#72414) 2021-04-28 14:02:12 -04:00
James Rodewig 889197f8d0 [DOCS] Fix formatting 2021-04-28 11:40:33 -04:00
James Rodewig 13179c71b6
[DOCS] EQL: Shorten response snippets (#72330)
Shortens several lengthy response snippets to better highlight the
relevant parts.
2021-04-27 16:02:45 -04:00
James Rodewig f8d2578ede
[DOCS] EQL: Remove wildcard function (#72121) 2021-04-22 15:49:07 -04:00
James Rodewig 3f2eb32afc
[DOCS] Sync EQL docs with `fields` param updates (#72008) 2021-04-21 09:13:27 -04:00
Adam Locke 6dfd92c46f
[DOCS] Focus retrieving selected fields on fields parameter (#71506)
* [DOCS] Focus retrieving selected fields on fields parameter

* Incorporating changes from reviews

* Adding clarifications from review feedback

* Slight wording revisions.

* Clarify language around format parameter and move text out of callout.
2021-04-20 15:11:35 -04:00
James Rodewig 07fade1d27
[DOCS] EQL/SQL: Document `runtime_fields` parameter (#71487) 2021-04-19 09:15:12 -04:00
James Rodewig de228ee153
[DOCS] Reorder EQL sections. Remove duplicated content. (#71477) 2021-04-08 10:45:33 -04:00
James Rodewig f41320616c
[DOCS] Refactor data stream setup tutorial (#71074) 2021-03-31 17:28:55 -04:00
James Rodewig 693807a6d3
[DOCS] Fix double spaces (#71082) 2021-03-31 09:57:47 -04:00
James Rodewig fdbea16e15
[DOCS] Move EQL event category section (#70955)
Combines the basic syntax and event category sections for better visibility.
2021-03-29 09:40:34 -04:00