fdbea16e15
[DOCS] Move EQL event category section ( #70955 )
...
Combines the basic syntax and event category sections for better visibility.
2021-03-29 09:40:34 -04:00
321f46e187
[DOCS] EQL: Document Unicode escape sequences ( #70694 )
2021-03-23 08:10:03 -04:00
cbfe969634
[DOCS] EQL: Remove unneded words in escape sequence table
2021-03-22 16:45:49 -04:00
3ff1a17a79
[DOCS] EQL: Document field existence checks ( #69614 )
2021-02-25 12:04:22 -05:00
8e09c3d7bd
[DOCS] EQL: Clarify support for text fields ( #69229 )
2021-02-18 18:57:49 -05:00
13a077bd59
[DOCS] EQL: Update differences from Endgame EQL syntax ( #69124 )
2021-02-17 10:11:51 -05:00
5eb0a9528a
[DOCS] EQL: Document `like` and `regex` keywords ( #68932 ) ( #69052 )
2021-02-16 11:34:03 -05:00
293fcd4c41
[DOCS] EQL: Minor doc fixes ( #68927 )
2021-02-11 13:44:01 -05:00
babf3eb081
[DOCS] EQL: Remove duplicate case-sensitivity info ( #68860 )
2021-02-10 14:27:29 -05:00
ab3f8f5067
[DOCS] EQL: Add case-insensitive `~` operator ( #68217 )
...
Documents the case-insensitive `~` operator for `in` and string functions.
Relates to #67869 and #68176
2021-01-29 13:50:57 -05:00
9b3bb56179
[DOCS] EQL: Move to GA ( #65955 )
2020-12-09 08:48:23 -05:00
6a09df8520
[DOCS] EQL: Add diagrams for sequence matching ( #65898 )
2020-12-07 07:55:38 -05:00
ef6fb59ec3
[DOCS] EQL: Document how sequence queries handle matches ( #65794 )
...
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-12-04 09:34:38 -05:00
2044caa667
[DOCS] EQL: Document ? wildcard ( #65698 )
2020-12-03 12:14:38 -05:00
bcea87f3a3
[DOCS] Fix EQL syntax formatting ( #65711 )
2020-12-02 08:51:39 -05:00
1c3ddf8ff1
[DOCS] EQL: Flatten EQL syntax headings ( #65693 )
2020-12-01 12:56:12 -05:00
a18b87ddc1
[DOCS] Flatten EQL syntax headings ( #65497 )
2020-11-25 10:30:24 -05:00
b9ee0b3b48
[DOCS] EQL: Add lookup support to `:` operator ( #65262 )
2020-11-24 10:48:41 -05:00
ce644909dc
[DOCS] EQL: Add wildcard support to `:` operator ( #65237 )
2020-11-19 08:26:13 -05:00
b2b676d7d6
[DOCS] Remove italics formatting
2020-11-03 15:49:52 -05:00
1c0380dc21
[DOCS] EQL: Fix operator docs ( #64286 )
2020-10-28 10:27:17 -04:00
c6a13d1cee
[DOCS] EQL: Remove `match` fn ( #63271 )
2020-10-14 09:57:29 -04:00
f41de1bdce
[DOCS] EQL: Add `:` operator, remove wildcard operator ( #63195 )
2020-10-14 09:06:37 -04:00
8527183f91
[DOCS] EQL: Remove Endgame EQL refs ( #63636 )
2020-10-14 08:34:11 -04:00
e0cc841a60
[DOCS] EQL: Document multi-value field support ( #63622 )
2020-10-13 12:26:07 -04:00
04c8ad3ced
[DOCS] EQL: Move to beta ( #63284 )
2020-10-12 08:55:16 -04:00
0aa0811aba
[DOCS] Make EQL case-sensitive by default ( #63270 )
2020-10-05 15:29:48 -04:00
cb9e61fae5
[DOCS] EQL: Update grammary for escaped event categories ( #63202 )
2020-10-02 15:03:29 -04:00
daef606de7
[DOCS] EQL: Replace ?"..." with """...""" for raw strings ( #63191 )
2020-10-02 11:20:24 -04:00
1b878c8775
[DOCS] EQL: Reorganize EQL syntax sections ( #63179 )
2020-10-02 09:46:27 -04:00
d8cfd569e6
[DOCS] Document escaped backticks for identifiers ( #63079 )
2020-09-30 11:56:23 -04:00
844558069b
[DOCS] EQL: Clarify EQL docs ( #62961 )
2020-09-28 15:29:35 -04:00
acac14a35f
[DOCS] EQL: Note = is not an equality operator
2020-09-22 13:54:19 -04:00
6b36be281a
[DOCS] EQL: Disallow chained comparisons ( #62570 )
2020-09-18 08:26:48 -04:00
0e1aa14bc8
[DOCS] EQL: Remove support for single quote strings ( #62479 )
2020-09-17 09:19:04 -04:00
db52f8485b
[DOCS] EQL: Clarify wildcard operator
2020-09-16 11:05:00 -04:00
9e325bb810
[DOCS] EQL: Make operator refs consistent
2020-09-16 11:03:09 -04:00
7274b42a14
[DOCS] EQL: Move comparison operator defs
2020-09-16 10:54:02 -04:00
b5fc25cf1f
[DOCS] Remove collapsible examples in EQL syntax docs ( #62220 )
2020-09-10 09:39:17 -04:00
21deb3b7ea
[DOCS] EQL: Clarify until keyword docs ( #61794 )
2020-09-01 13:37:24 -04:00
904c866060
[DOCS] Fix EQL syntax admon
2020-08-26 13:39:23 -04:00
dca46c29ff
[DOCS] Refactor EQL docs ( #60700 )
...
Changes:
* Moves sample data to reusable rest test
* Combines EQL index, requirements, and run a search pages
* Combines EQL syntax and limitations pages
* Adds related redirects
2020-08-05 10:11:02 -04:00
d250f94374
[DOCS] Fix syntax and wording in EQL docs ( #59623 )
2020-07-15 14:27:02 -04:00
25c6a125c5
[DOCS] EQL: Document `until` keyword support ( #59320 )
2020-07-13 08:42:27 -04:00
747e61508a
[DOCS] EQL: Prepare docs for release ( #59259 )
...
Changes:
* Swaps the `dev` admonitions for `experimental` admonitions
* Removes `ifdef` statements preventing the docs from appearing in
released branches
2020-07-13 08:40:38 -04:00
c5df35eba1
[DOCS] EQL: Document unsupported var comparison ( #58941 )
...
ES EQL queries do not support the comparison of a variable, such as
a field value, to another variable.
This adds a related para and example to the EQL syntax docs.
2020-07-08 08:54:22 -04:00
7c23933ec7
[DOCS] EQL: Document `maxspan` keyword ( #58931 )
2020-07-08 08:52:36 -04:00
cc3bd3974f
[DOCS] EQL: Document `head` and `tail` pipes ( #58673 )
2020-06-30 08:35:37 -04:00
982f168fd8
[DOCS] EQL: Add `dev` admonition to EQL pages ( #57531 )
...
Adds the `dev` admonition to EQL features, which are in development
under a feature flag.
2020-06-02 10:47:53 -04:00
15431f2447
[DOCS] EQL: Document sequences ( #56721 )
...
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-05-14 11:01:07 -04:00
James Rodewig
Howard
James Rodewig