Commit Graph

48 Commits

Author SHA1 Message Date
James Rodewig ab3f8f5067
[DOCS] EQL: Add case-insensitive `~` operator (#68217)
Documents the case-insensitive `~` operator for `in` and string functions.

Relates to #67869 and #68176
2021-01-29 13:50:57 -05:00
James Rodewig 9b3bb56179
[DOCS] EQL: Move to GA (#65955) 2020-12-09 08:48:23 -05:00
James Rodewig 6a09df8520
[DOCS] EQL: Add diagrams for sequence matching (#65898) 2020-12-07 07:55:38 -05:00
James Rodewig ef6fb59ec3
[DOCS] EQL: Document how sequence queries handle matches (#65794)
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-12-04 09:34:38 -05:00
James Rodewig 2044caa667
[DOCS] EQL: Document ? wildcard (#65698) 2020-12-03 12:14:38 -05:00
Howard bcea87f3a3
[DOCS] Fix EQL syntax formatting (#65711) 2020-12-02 08:51:39 -05:00
James Rodewig 1c3ddf8ff1
[DOCS] EQL: Flatten EQL syntax headings (#65693) 2020-12-01 12:56:12 -05:00
James Rodewig a18b87ddc1
[DOCS] Flatten EQL syntax headings (#65497) 2020-11-25 10:30:24 -05:00
James Rodewig b9ee0b3b48
[DOCS] EQL: Add lookup support to `:` operator (#65262) 2020-11-24 10:48:41 -05:00
James Rodewig ce644909dc
[DOCS] EQL: Add wildcard support to `:` operator (#65237) 2020-11-19 08:26:13 -05:00
James Rodewig b2b676d7d6 [DOCS] Remove italics formatting 2020-11-03 15:49:52 -05:00
James Rodewig 1c0380dc21
[DOCS] EQL: Fix operator docs (#64286) 2020-10-28 10:27:17 -04:00
James Rodewig c6a13d1cee
[DOCS] EQL: Remove `match` fn (#63271) 2020-10-14 09:57:29 -04:00
James Rodewig f41de1bdce
[DOCS] EQL: Add `:` operator, remove wildcard operator (#63195) 2020-10-14 09:06:37 -04:00
James Rodewig 8527183f91
[DOCS] EQL: Remove Endgame EQL refs (#63636) 2020-10-14 08:34:11 -04:00
James Rodewig e0cc841a60
[DOCS] EQL: Document multi-value field support (#63622) 2020-10-13 12:26:07 -04:00
James Rodewig 04c8ad3ced
[DOCS] EQL: Move to beta (#63284) 2020-10-12 08:55:16 -04:00
James Rodewig 0aa0811aba
[DOCS] Make EQL case-sensitive by default (#63270) 2020-10-05 15:29:48 -04:00
James Rodewig cb9e61fae5
[DOCS] EQL: Update grammary for escaped event categories (#63202) 2020-10-02 15:03:29 -04:00
James Rodewig daef606de7
[DOCS] EQL: Replace ?"..." with """...""" for raw strings (#63191) 2020-10-02 11:20:24 -04:00
James Rodewig 1b878c8775
[DOCS] EQL: Reorganize EQL syntax sections (#63179) 2020-10-02 09:46:27 -04:00
James Rodewig d8cfd569e6
[DOCS] Document escaped backticks for identifiers (#63079) 2020-09-30 11:56:23 -04:00
James Rodewig 844558069b
[DOCS] EQL: Clarify EQL docs (#62961) 2020-09-28 15:29:35 -04:00
James Rodewig acac14a35f [DOCS] EQL: Note = is not an equality operator 2020-09-22 13:54:19 -04:00
James Rodewig 6b36be281a
[DOCS] EQL: Disallow chained comparisons (#62570) 2020-09-18 08:26:48 -04:00
James Rodewig 0e1aa14bc8
[DOCS] EQL: Remove support for single quote strings (#62479) 2020-09-17 09:19:04 -04:00
James Rodewig db52f8485b [DOCS] EQL: Clarify wildcard operator 2020-09-16 11:05:00 -04:00
James Rodewig 9e325bb810 [DOCS] EQL: Make operator refs consistent 2020-09-16 11:03:09 -04:00
James Rodewig 7274b42a14 [DOCS] EQL: Move comparison operator defs 2020-09-16 10:54:02 -04:00
James Rodewig b5fc25cf1f
[DOCS] Remove collapsible examples in EQL syntax docs (#62220) 2020-09-10 09:39:17 -04:00
James Rodewig 21deb3b7ea
[DOCS] EQL: Clarify until keyword docs (#61794) 2020-09-01 13:37:24 -04:00
James Rodewig 904c866060 [DOCS] Fix EQL syntax admon 2020-08-26 13:39:23 -04:00
James Rodewig dca46c29ff
[DOCS] Refactor EQL docs (#60700)
Changes:

* Moves sample data to reusable rest test
* Combines EQL index, requirements, and run a search pages
* Combines EQL syntax and limitations pages
* Adds related redirects
2020-08-05 10:11:02 -04:00
James Rodewig d250f94374
[DOCS] Fix syntax and wording in EQL docs (#59623) 2020-07-15 14:27:02 -04:00
James Rodewig 25c6a125c5
[DOCS] EQL: Document `until` keyword support (#59320) 2020-07-13 08:42:27 -04:00
James Rodewig 747e61508a
[DOCS] EQL: Prepare docs for release (#59259)
Changes:

* Swaps the `dev` admonitions for `experimental` admonitions
* Removes `ifdef` statements preventing the docs from appearing in
  released branches
2020-07-13 08:40:38 -04:00
James Rodewig c5df35eba1
[DOCS] EQL: Document unsupported var comparison (#58941)
ES EQL queries do not support the comparison of a variable, such as
a field value, to another variable.

This adds a related para and example to the EQL syntax docs.
2020-07-08 08:54:22 -04:00
James Rodewig 7c23933ec7
[DOCS] EQL: Document `maxspan` keyword (#58931) 2020-07-08 08:52:36 -04:00
James Rodewig cc3bd3974f
[DOCS] EQL: Document `head` and `tail` pipes (#58673) 2020-06-30 08:35:37 -04:00
James Rodewig 982f168fd8
[DOCS] EQL: Add `dev` admonition to EQL pages (#57531)
Adds the `dev` admonition to EQL features, which are in development
under a feature flag.
2020-06-02 10:47:53 -04:00
James Rodewig 15431f2447
[DOCS] EQL: Document sequences (#56721)
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-05-14 11:01:07 -04:00
James Rodewig 883bb29152
[DOCS] EQL: Document math functions (#55810)
Documents the following EQL functions:

* `add`
* `divide`
* `module`
* `multiply`
* `subtract`
2020-05-07 08:53:08 -04:00
James Rodewig b58e95d25c
[DOCS] Add admonition for EQL exact matches on text fields (#53402)
Adds a important admonition to the EQL syntax page noting that
the equal (`==`) operator should not be used to match `text` field
values.

Relates to #52709 and #53020
2020-04-23 09:53:02 -04:00
James Rodewig 658a331245
[DOCS] EQL: Add search/index speed tip for functions (#54346)
EQL functions are an easy way for users to transform indexed data
at search time. However, using multiple functions can make
queries difficult to write and slows search speeds.

Users can circumvent this by indexing fields containing the transformed
data, but that usually slows index speeds.

This adds a related tip and example covering these tradeoffs.
2020-04-01 08:21:35 -04:00
James Rodewig f91d8ee3e7
[DOCS] EQL: Document `substring` function (#53867)
Adds documentation for the EQL `substring` function.

Supporting changes:

* Creates a new "EQL function reference" page
* Updates the title of the "EQL syntax reference" page for consistency
* Adds a brief "Functions" section to the EQL syntax docs
* Updates EQL limitations docs to state that only array functions are
  unsupported
2020-03-25 12:07:20 -04:00
James Rodewig c6334ee4b7
[DOCS] Document `any` keyword in EQL syntax (#52821)
* [DOCS] Document `any` keyword in EQL syntax

Adds documentation for the `any` keyword to the EQL syntax docs.

Includes:

* Definition of an event type and its relationship to the event type
  field.
* Example matching all event types using `any` keyword
* Example matching event types beginning with a digit
* Example using `any` with `where true`

* Remove references to `event_type_field` default

* Reuse "Events starting with digits" section

* Updates for #53073
2020-03-05 04:44:35 -05:00
Aleksandr Maus 82c645e3ef
EQL: consistent naming for event type vs event category (#53073)
Related to https://github.com/elastic/elasticsearch/issues/52941
2020-03-03 19:44:12 -05:00
James Rodewig 99c1ee88e8
[DOCS] Add EQL syntax page (#51821)
Adds documentation for basic EQL syntax.

Joins, sequences, and other syntax to be added as its supported
in future development.

Co-Authored-By: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-02-05 08:12:09 -05:00