|
@@ -390,20 +390,15 @@ or event category field.
|
|
|
|
|
|
By default, the EQL search API returns matching hits by timestamp. If two or
|
|
|
more events share the same timestamp, {es} uses a tiebreaker field value to sort
|
|
|
-the events in ascending, lexicographic order.
|
|
|
+the events in ascending order. {es} orders events with no
|
|
|
+tiebreaker value after events with a value.
|
|
|
|
|
|
If you don't specify a tiebreaker field or the events also share the same
|
|
|
tiebreaker value, {es} considers the events concurrent. Concurrent events cannot
|
|
|
be part of the same sequence and may not be returned in a consistent sort order.
|
|
|
|
|
|
-To specify a tiebreaker field, use the `tiebreaker_field` parameter. If you
|
|
|
-specify a tiebreaker field for a sequence query, all events in the searched data
|
|
|
-streams or indices must contain a tiebreaker field value. For basic queries,
|
|
|
-{es} orders matching events with no tiebreaker value after events with a
|
|
|
-tiebreaker value.
|
|
|
-
|
|
|
-If you use the {ecs-ref}[ECS], we recommend using `event.sequence` as the
|
|
|
-tiebreaker field.
|
|
|
+To specify a tiebreaker field, use the `tiebreaker_field` parameter. If you use
|
|
|
+the {ecs-ref}[ECS], we recommend using `event.sequence` as the tiebreaker field.
|
|
|
|
|
|
[source,console]
|
|
|
----
|