Commit Graph

10 Commits

Author SHA1 Message Date
James Rodewig 25c6a125c5
[DOCS] EQL: Document `until` keyword support (#59320) 2020-07-13 08:42:27 -04:00
James Rodewig 747e61508a
[DOCS] EQL: Prepare docs for release (#59259)
Changes:

* Swaps the `dev` admonitions for `experimental` admonitions
* Removes `ifdef` statements preventing the docs from appearing in
  released branches
2020-07-13 08:40:38 -04:00
James Rodewig 284ee85efd
[DOCS] Add data streams to EQL search docs (#58611) 2020-07-13 08:38:01 -04:00
James Rodewig 7c23933ec7
[DOCS] EQL: Document `maxspan` keyword (#58931) 2020-07-08 08:52:36 -04:00
James Rodewig cc3bd3974f
[DOCS] EQL: Document `head` and `tail` pipes (#58673) 2020-06-30 08:35:37 -04:00
James Rodewig 982f168fd8
[DOCS] EQL: Add `dev` admonition to EQL pages (#57531)
Adds the `dev` admonition to EQL features, which are in development
under a feature flag.
2020-06-02 10:47:53 -04:00
James Rodewig 15431f2447
[DOCS] EQL: Document sequences (#56721)
Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
2020-05-14 11:01:07 -04:00
James Rodewig e12419b276
[DOCS] EQL: Document nested field support (#56138)
Notes that you cannot use EQL in ES to search the values of `nested`
fields or their sub-fields. However, indices containing `nested` field
mappings are otherwise supported.
2020-05-05 11:26:20 -04:00
James Rodewig f91d8ee3e7
[DOCS] EQL: Document `substring` function (#53867)
Adds documentation for the EQL `substring` function.

Supporting changes:

* Creates a new "EQL function reference" page
* Updates the title of the "EQL syntax reference" page for consistency
* Adds a brief "Functions" section to the EQL syntax docs
* Updates EQL limitations docs to state that only array functions are
  unsupported
2020-03-25 12:07:20 -04:00
James Rodewig 6b62ec53db
[DOCS] Add EQL limitations page (#52001)
Documents limitations for EQL in Elasticsearch.
2020-02-12 08:45:15 -05:00