Commit Graph

108 Commits

Author SHA1 Message Date
James Rodewig f881a695e1
[DOCS] Add redirects for wildcard and constant keyword (#61815) 2020-09-01 15:32:35 -04:00
James Rodewig 21deb3b7ea
[DOCS] EQL: Clarify until keyword docs (#61794) 2020-09-01 13:37:24 -04:00
James Rodewig 904c866060 [DOCS] Fix EQL syntax admon 2020-08-26 13:39:23 -04:00
James Rodewig f79d70225b [DOCS] Remove dupe EQl fn/pipe TOC 2020-08-26 12:44:51 -04:00
James Rodewig 35b35148b9
[DOCS] Remove response params for #61428 (#61524) 2020-08-25 09:30:38 -04:00
Costin Leau 997376fbe6
EQL: Replace SearchHit in response with Event (#61428)
The building block of the eql response is currently the SearchHit. This
is a problem since it is tied to an actual search, and thus has scoring,
highlighting, shard information and a lot of other things that are not
relevant for EQL.
This becomes a problem when doing sequence queries since the response is
not generated from one search query and thus there are no SearchHits to
speak of.
Emulating one is not just conceptually incorrect but also problematic
since most of the data is missed or made-up.

As such this PR introduces a simple class, Event, that maps nicely to
the terminology while hiding the ES internals (the use of SearchHit or
GetResult/GetResponse depending on the API used).

Fix #59764
Fix #59779

Co-authored-by: Igor Motov <igor@motovs.org>
2020-08-25 14:27:56 +03:00
James Rodewig a7d4e8b148
[DOCS] Remove collapsible sections in EQL fn docs (#61498) 2020-08-24 14:19:29 -04:00
James Rodewig c688cb6bfd
[DOCS] Fix hyphenation for "time series" (#61472) 2020-08-24 10:34:41 -04:00
James Rodewig 77bb7320dd
[DOCS] Fix EQL threat detection example (#61367) 2020-08-20 09:55:49 -04:00
Andrei Stefan d54957d61f
EQL: Return sequence join keys in the original type (#61268) 2020-08-18 18:20:43 +03:00
James Rodewig a94e5cb7c4
[DOCS] Replace Wikipedia links with attribute (#61171) 2020-08-17 09:44:24 -04:00
James Rodewig 36f02c7869 [DOCS] Reword in EQL threat detection example 2020-08-14 15:50:31 -04:00
James Rodewig 46c438f16b [DOCS] Reword EQL example 2020-08-14 13:24:05 -04:00
James Rodewig e8a907e34a
[DOCS] EQL: Add threat detection example (#59105) 2020-08-14 13:00:34 -04:00
James Rodewig fcc3b6c80c [DOCS] Fix EQL required fields language 2020-08-12 09:47:37 -04:00
James Rodewig 7c494434d6 [DOCS] Remove unneeded word in EQL docs 2020-08-11 12:18:46 -04:00
James Rodewig d09a6cfc7c
[DOCS] Make EQL example snippets more realistic (#60971) 2020-08-11 11:38:46 -04:00
James Rodewig dca46c29ff
[DOCS] Refactor EQL docs (#60700)
Changes:

* Moves sample data to reusable rest test
* Combines EQL index, requirements, and run a search pages
* Combines EQL syntax and limitations pages
* Adds related redirects
2020-08-05 10:11:02 -04:00
James Rodewig ae01606785
[DOCS] Replace `twitter` dataset in docs (#60604) 2020-08-03 12:49:56 -04:00
James Rodewig 441c3a21b1
[DOCS] Update my-index examples (#60132)
Changes the following example index names to `my-index-000001` for consistency:

* `my-index`
* `my_index`
* `myindex`
2020-07-27 14:46:39 -04:00
James Rodewig 2774cd6938
[DOCS] Swap `[float]` for `[discrete]` (#60124)
Changes instances of `[float]` in our docs for `[discrete]`.

Asciidoctor prefers the `[discrete]` tag for floating headings:
https://asciidoctor.org/docs/asciidoc-asciidoctor-diffs/#blocks
2020-07-23 11:48:22 -04:00
James Rodewig 861892add4
[DOCS] EQL: Remove collapsible sections from EQL search docs (#59819) 2020-07-20 08:50:19 -04:00
James Rodewig 5be36b41d4
[DOCS] EQL: Update EQL search response format (#59554) 2020-07-15 16:52:32 -04:00
James Rodewig d250f94374
[DOCS] Fix syntax and wording in EQL docs (#59623) 2020-07-15 14:27:02 -04:00
James Rodewig adc520b7c2 [DOCS] Note that EQL timestamp field can also be date_nanos 2020-07-15 09:53:43 -04:00
Costin Leau bccfbcd81f
EQL: Improve retrieval of results (#59552)
Instead of retrieving an entire SearchHit, get just a reference and 
postpone the document retrieval when assembling the final results.
Remove sort information from results to make them consistent.
Move TumblingWindow under the sequence package.

Co-authored-by: James Rodewig <james.rodewig@elastic.co>
2020-07-14 23:26:25 +03:00
James Rodewig 25c6a125c5
[DOCS] EQL: Document `until` keyword support (#59320) 2020-07-13 08:42:27 -04:00
James Rodewig 747e61508a
[DOCS] EQL: Prepare docs for release (#59259)
Changes:

* Swaps the `dev` admonitions for `experimental` admonitions
* Removes `ifdef` statements preventing the docs from appearing in
  released branches
2020-07-13 08:40:38 -04:00
James Rodewig 284ee85efd
[DOCS] Add data streams to EQL search docs (#58611) 2020-07-13 08:38:01 -04:00
Andrei Stefan 6ede6c59ef
Remove search_after and implicit_join_key_field (#59232) 2020-07-09 11:17:37 +03:00
James Rodewig 52bfe9eb9a
[DOCS] EQL: Document `size` limit for pipes (#59085)
Changes:
* Documents the `size` default as `10`.
* Updates `size` param def to note its relation to pipes.
* Updates the `head` and `tail` pipe docs to modify sequences.
* Documents the `fetch_size` parameter.

Relates to #59014 and #59063
2020-07-08 11:52:45 -04:00
James Rodewig c5df35eba1
[DOCS] EQL: Document unsupported var comparison (#58941)
ES EQL queries do not support the comparison of a variable, such as
a field value, to another variable.

This adds a related para and example to the EQL syntax docs.
2020-07-08 08:54:22 -04:00
James Rodewig 7c23933ec7
[DOCS] EQL: Document `maxspan` keyword (#58931) 2020-07-08 08:52:36 -04:00
James Rodewig 2be9db01c8
[DOCS] Replace `datatype` with `data type` (#58972) 2020-07-07 13:52:10 -04:00
DeDe Morton b5e374d958
[DOCS] Change Beats links to refactored getting started docs (#58790) 2020-07-02 17:10:09 -07:00
James Rodewig f18e136400 [DOCS] Fix xref format in async EQL search docs 2020-06-30 09:36:08 -04:00
James Rodewig cc3bd3974f
[DOCS] EQL: Document `head` and `tail` pipes (#58673) 2020-06-30 08:35:37 -04:00
James Rodewig 29da275b0a
[DOCS] EQL: Remove fields from EQL search response (#58667) 2020-06-29 09:19:07 -04:00
Costin Leau d6731d659d Update JSON results in EQL docs 2020-06-27 09:45:50 +03:00
Costin Leau 4521ca3367
EQL: Add Head/Tail pipe support (#58536)
Introduce pipe support, in particular head and tail
(which can also be chained).
2020-06-27 09:08:03 +03:00
James Rodewig d14b7d5399
[DOCS] EQL: Remove references to partial async EQL results (#58548)
Removes references to partial results from the async EQL search docs.
If an EQL search does not complete during the `wait_for_completion_timeout`
timeout period, it returns no results.
2020-06-26 10:27:30 -04:00
James Rodewig 662cf81bbc
[DOCS] Fix EQL search snippet for tiebreaker example (#58545) 2020-06-25 09:23:50 -04:00
James Rodewig 07874ec357
[DOCS] EQL: Document search API's `tiebreaker_field` param (#57935) 2020-06-25 08:44:34 -04:00
James Rodewig 7f5b72741e [DOCS] EQL: Correct EQL search API's `size` param def
The `size` parameter can be used to limit matching events or sequences.
2020-06-10 10:13:18 -04:00
James Rodewig 6d7acd0d94
[DOCS] EQL: Document delete async search API (#57732) 2020-06-05 12:45:09 -04:00
Igor Motov d197a85ee5 Merge remote-tracking branch 'elastic/master' into feature/async-eql 2020-06-04 15:50:40 -04:00
James Rodewig b30cc2b399
[DOCS] EQL: Add `dev` admonition to EQL pages (#57531) (#57534)
Adds the `dev` admonition to EQL features, which are in development
under a feature flag.
2020-06-02 11:04:56 -04:00
James Rodewig 982f168fd8
[DOCS] EQL: Add `dev` admonition to EQL pages (#57531)
Adds the `dev` admonition to EQL features, which are in development
under a feature flag.
2020-06-02 10:47:53 -04:00
James Rodewig 34c4505a2f
[DOCS] EQL: Fix hits param for sequences (#57410) (#57525) 2020-06-02 09:38:21 -04:00
James Rodewig f1b8df93cd
[DOCS] EQL: Fix hits param for sequences (#57410) 2020-06-02 09:22:14 -04:00