Browse Source

[DOCS] EQL: Correct EQL search API's `size` param def

The `size` parameter can be used to limit matching events or sequences.
James Rodewig 5 years ago
parent
commit
7f5b72741e
1 changed files with 7 additions and 2 deletions
  1. 7 2
      docs/reference/eql/eql-search-api.asciidoc

+ 7 - 2
docs/reference/eql/eql-search-api.asciidoc

@@ -225,8 +225,13 @@ Reserved for future use.
 
 `size`::
 (Optional, integer or float)
-Maximum number of matching events to return. Defaults to `50`. Values must be
-greater than `0`.
+For <<eql-basic-syntax,basic queries>>, the maximum number of matching events to
+return.
++
+For <<eql-sequences,sequence queries>>, the maximum number of matching sequences
+to return.
++
+Defaults to `50`. Values must be greater than `0`.
 
 [[eql-search-api-timestamp-field]]
 `timestamp_field`::