Browse Source

[DOCS] Add EQL limitations page (#52001)

Documents limitations for EQL in Elasticsearch.
James Rodewig 5 years ago
parent
commit
6b62ec53db
2 changed files with 31 additions and 0 deletions
  1. 2 0
      docs/reference/eql/index.asciidoc
  2. 29 0
      docs/reference/eql/limitations.asciidoc

+ 2 - 0
docs/reference/eql/index.asciidoc

@@ -32,7 +32,9 @@ Consider using EQL if you:
 * <<eql-requirements>>
 * <<eql-search>>
 * <<eql-syntax>>
+* <<eql-limitations>>
 
 include::requirements.asciidoc[]
 include::search.asciidoc[]
 include::syntax.asciidoc[]
+include::limitations.asciidoc[]

+ 29 - 0
docs/reference/eql/limitations.asciidoc

@@ -0,0 +1,29 @@
+[role="xpack"]
+[testenv="basic"]
+[[eql-limitations]]
+== EQL limitations
+++++
+<titleabbrev>Limitations</titleabbrev>
+++++
+
+experimental::[]
+
+[discrete]
+[[eql-unsupported-syntax]]
+=== Unsupported syntax
+
+{es} supports a subset of {eql-ref}/index.html[EQL syntax]. {es} cannot run EQL
+queries that contain:
+
+* {eql-ref}/functions.html[Functions]
+
+* {eql-ref}/joins.html[Joins]
+
+* {eql-ref}/basic-syntax.html#event-relationships[Lineage-related keywords]:
+** `child of`
+** `descendant of`
+** `event of`
+
+* {eql-ref}/pipes.html[Pipes]
+
+* {eql-ref}/sequences.html[Sequences]