|
@@ -405,8 +405,9 @@ in the search request using the `timestamp_field` or `event_category_field`
|
|
|
parameters.
|
|
|
|
|
|
The event category field is typically mapped as a field type in the
|
|
|
-<<keyword,`keyword`>> family. The timestamp field is typically mapped as a
|
|
|
-<<date,`date`>> or <<date_nanos,`date_nanos`>> field.
|
|
|
+<<keyword,`keyword`>> family. The timestamp field should be mapped as a
|
|
|
+<<date,`date`>> field type. <<date_nanos,`date_nanos`>> timestamp fields are not
|
|
|
+supported.
|
|
|
|
|
|
NOTE: You cannot use a <<nested,`nested`>> field or the sub-fields of a `nested`
|
|
|
field as the timestamp or event category field. See <<eql-nested-fields>>.
|