Commit Graph

68 Commits

Author SHA1 Message Date
Bogdan Pintea 7a5ac3e4a9
EQL: Minimise CCS roundtrips (#76076)
This introduces an optimisation of the EQL requests when these target
one remote cluster only (i.e. no mixed local and remote indices or
multiple remote clusters). In this case, the EQL request is forwarded
to the remote cluster and executed there, instead of having the local
cluster perform multiple queries to the remote cluster.
2021-08-18 14:01:43 +02:00
James Rodewig 96c4ee3e5c
[DOCS] Document `_mvt` API (#75384)
* [DOCS] Document `_mvt` API

Documents the `_mvt` API endpoint added with #73872.

Relates to #75242.

* Reword

* Rename API

* Fix doc.url in JSON spec

* Reword

* Reword

* Add content type to JSON spec

* Edits

* Fix typo

* Reword

* Update docs after meeting

* Fix typos

* Fix `size` default

* Updates for #75522

* Fixes

* Clean up JSON spec

* Fix extent tag

* [DOCS] Add `<field>` constraints

* Minor clarification

* Update for #75697

* Reword

* Update for #75621

* Reword default sort

* Update for #75367

* Remove unneeded whitespace

* Add experimental admon and if flags

* [DOCS] Remove ifdefs

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2021-08-05 15:04:07 -04:00
James Rodewig 3971522c65
[DOCS] EQL: Document cross-cluster search support (#74995) (#75045)
Closes #74842.
2021-07-07 09:41:07 -04:00
Marios Trivyzas dd302dcfef
EQL: [Docs] Add documentation for the CircuitBreaker (#74897)
Add documentation for the newly introduced CircuitBreaker, which is
used to restrict the memory usage for an EQL sequence query to avoid
OutOfMemory exceptions.

Follows: #74381
2021-07-07 09:20:25 +02:00
James Rodewig 5729bb8d49
[DOCS] Update alias references (#73427)
Updates several `index aliases` references to `aliases`.
2021-05-27 16:00:57 -04:00
James Rodewig 39a0314d30
[DOCS] Update alias xrefs (#73380)
Updates several internal 'alias' xrefs to point to the aliases guide rather than
API docs.
2021-05-25 16:19:00 -04:00
James Rodewig 07fade1d27
[DOCS] EQL/SQL: Document `runtime_fields` parameter (#71487) 2021-04-19 09:15:12 -04:00
James Rodewig 6504b541e9
[DOCS] EQL: Use data streams in docs (#70822) 2021-03-25 09:41:06 -04:00
James Rodewig 783769d8d9
[DOCS] Add `fields` parameter to EQL search API (#69634) 2021-03-01 12:00:27 -05:00
James Rodewig 31fc59efdf
[DOCS] Fix capitalization for Query DSL (#69236) 2021-02-18 18:57:19 -05:00
Mayya Sharipova 6521d2af27
Introduce eql search status API (#68065)
Introduce eql search status API,
that reports the status of eql stored or async search.

GET _eql/search/status/<id>

The API is restricted to the monitoring_user role.

For a running eql search, a response has the following format:

{
  "id" : <id>,
  "is_running" : true,
  "is_partial" : true,
  "start_time_in_millis" : 1611690235000,
  "expiration_time_in_millis" : 1611690295000
}

For a completed eql search, a response has the following format:

{
  "id" : <id>,
  "is_running" : false,
  "is_partial" : false,
  "expiration_time_in_millis" : 1611690295000,
  "completion_status" : 200
}

Closes #66955
2021-02-11 09:30:13 -05:00
James Rodewig 6378c57ca0
[DOCS] EQL: Add `filter_path` param to EQL search API docs (#68537) 2021-02-04 13:39:01 -05:00
James Rodewig c4ab89f3f7
[DOCS] EQL: Add security privileges to EQL search docs (#68017) 2021-01-27 16:25:05 -05:00
James Rodewig 14b381a2ad
[DOCS] EQL: Change `result_position` default to `tail` (#66550) 2020-12-18 08:38:45 -05:00
James Rodewig 9b3bb56179
[DOCS] EQL: Move to GA (#65955) 2020-12-09 08:48:23 -05:00
James Rodewig 36d308bc23
[DOCS] EQL: Update docs for null tiebreakers (#65078) 2020-11-17 09:31:49 -05:00
James Rodewig 254807956f
[DOCS] EQL: Document result_position param (#65075) 2020-11-17 09:07:51 -05:00
James Rodewig fb1936bed1
[DOCS] EQL: Fix tiebreaker field docs (#64671)
Corrects the EQL docs to remove `event.sequence` as the default `tiebreaker_field` value.
2020-11-06 09:05:18 -05:00
James Rodewig 1ea83359bb
[DOCS] Fix case for 'Boolean' (#64299) 2020-10-29 09:04:43 -04:00
James Rodewig 71aaa4ae0a
[DOCS] EQL: Update `allow_no_indices` default (#63748)
Co-authored-by: Adam Locke <adam.locke@elastic.co>
2020-10-19 12:14:23 -04:00
James Rodewig 857c2d1cd4
[DOCS] Update `ignore_unavailable` default for EQL search API (#63210) 2020-10-14 09:36:11 -04:00
James Rodewig 8527183f91
[DOCS] EQL: Remove Endgame EQL refs (#63636) 2020-10-14 08:34:11 -04:00
James Rodewig 04c8ad3ced
[DOCS] EQL: Move to beta (#63284) 2020-10-12 08:55:16 -04:00
James Rodewig 0aa0811aba
[DOCS] Make EQL case-sensitive by default (#63270) 2020-10-05 15:29:48 -04:00
James Rodewig cb9e61fae5
[DOCS] EQL: Update grammary for escaped event categories (#63202) 2020-10-02 15:03:29 -04:00
James Rodewig 15d4d9597c
[DOCS] EQL: date_nanos timestamp is not supported (#63101) 2020-09-30 17:31:24 -04:00
Marios Trivyzas ad5ae4d887
EQL: Remove support for `=` for comparisons (#62756)
Since `=` is rarely used and is undocumented we its support for
equality comparisons keeping `==` as the only option. `=` is now only
used for assignments like in `maxspan=10m`.

Closes: #62650
2020-09-22 17:37:37 +02:00
James Rodewig 09547886b0
[DOCS] EQL: Update keyword family field types (#62254)
Updates several keyword/constant keyword references to use any field type in the
keyword family.
2020-09-14 09:35:23 -04:00
James Rodewig f881a695e1
[DOCS] Add redirects for wildcard and constant keyword (#61815) 2020-09-01 15:32:35 -04:00
James Rodewig 35b35148b9
[DOCS] Remove response params for #61428 (#61524) 2020-08-25 09:30:38 -04:00
Costin Leau 997376fbe6
EQL: Replace SearchHit in response with Event (#61428)
The building block of the eql response is currently the SearchHit. This
is a problem since it is tied to an actual search, and thus has scoring,
highlighting, shard information and a lot of other things that are not
relevant for EQL.
This becomes a problem when doing sequence queries since the response is
not generated from one search query and thus there are no SearchHits to
speak of.
Emulating one is not just conceptually incorrect but also problematic
since most of the data is missed or made-up.

As such this PR introduces a simple class, Event, that maps nicely to
the terminology while hiding the ES internals (the use of SearchHit or
GetResult/GetResponse depending on the API used).

Fix #59764
Fix #59779

Co-authored-by: Igor Motov <igor@motovs.org>
2020-08-25 14:27:56 +03:00
Andrei Stefan d54957d61f
EQL: Return sequence join keys in the original type (#61268) 2020-08-18 18:20:43 +03:00
James Rodewig a94e5cb7c4
[DOCS] Replace Wikipedia links with attribute (#61171) 2020-08-17 09:44:24 -04:00
James Rodewig d09a6cfc7c
[DOCS] Make EQL example snippets more realistic (#60971) 2020-08-11 11:38:46 -04:00
James Rodewig dca46c29ff
[DOCS] Refactor EQL docs (#60700)
Changes:

* Moves sample data to reusable rest test
* Combines EQL index, requirements, and run a search pages
* Combines EQL syntax and limitations pages
* Adds related redirects
2020-08-05 10:11:02 -04:00
James Rodewig ae01606785
[DOCS] Replace `twitter` dataset in docs (#60604) 2020-08-03 12:49:56 -04:00
James Rodewig 441c3a21b1
[DOCS] Update my-index examples (#60132)
Changes the following example index names to `my-index-000001` for consistency:

* `my-index`
* `my_index`
* `myindex`
2020-07-27 14:46:39 -04:00
James Rodewig 5be36b41d4
[DOCS] EQL: Update EQL search response format (#59554) 2020-07-15 16:52:32 -04:00
Costin Leau bccfbcd81f
EQL: Improve retrieval of results (#59552)
Instead of retrieving an entire SearchHit, get just a reference and 
postpone the document retrieval when assembling the final results.
Remove sort information from results to make them consistent.
Move TumblingWindow under the sequence package.

Co-authored-by: James Rodewig <james.rodewig@elastic.co>
2020-07-14 23:26:25 +03:00
James Rodewig 747e61508a
[DOCS] EQL: Prepare docs for release (#59259)
Changes:

* Swaps the `dev` admonitions for `experimental` admonitions
* Removes `ifdef` statements preventing the docs from appearing in
  released branches
2020-07-13 08:40:38 -04:00
James Rodewig 284ee85efd
[DOCS] Add data streams to EQL search docs (#58611) 2020-07-13 08:38:01 -04:00
Andrei Stefan 6ede6c59ef
Remove search_after and implicit_join_key_field (#59232) 2020-07-09 11:17:37 +03:00
James Rodewig 52bfe9eb9a
[DOCS] EQL: Document `size` limit for pipes (#59085)
Changes:
* Documents the `size` default as `10`.
* Updates `size` param def to note its relation to pipes.
* Updates the `head` and `tail` pipe docs to modify sequences.
* Documents the `fetch_size` parameter.

Relates to #59014 and #59063
2020-07-08 11:52:45 -04:00
James Rodewig f18e136400 [DOCS] Fix xref format in async EQL search docs 2020-06-30 09:36:08 -04:00
James Rodewig 29da275b0a
[DOCS] EQL: Remove fields from EQL search response (#58667) 2020-06-29 09:19:07 -04:00
Costin Leau 4521ca3367
EQL: Add Head/Tail pipe support (#58536)
Introduce pipe support, in particular head and tail
(which can also be chained).
2020-06-27 09:08:03 +03:00
James Rodewig 07874ec357
[DOCS] EQL: Document search API's `tiebreaker_field` param (#57935) 2020-06-25 08:44:34 -04:00
James Rodewig 7f5b72741e [DOCS] EQL: Correct EQL search API's `size` param def
The `size` parameter can be used to limit matching events or sequences.
2020-06-10 10:13:18 -04:00
Igor Motov d197a85ee5 Merge remote-tracking branch 'elastic/master' into feature/async-eql 2020-06-04 15:50:40 -04:00
James Rodewig b30cc2b399
[DOCS] EQL: Add `dev` admonition to EQL pages (#57531) (#57534)
Adds the `dev` admonition to EQL features, which are in development
under a feature flag.
2020-06-02 11:04:56 -04:00