Browse Source

[DOCS] EQL: Remove case sensitivity from function docs (#55063)

Per #54411, we plan to handle case sensitivity via a parameter for the
EQL search API (with the possible exception of the `between` function).

This removes references and examples related to case sensitivity from
the EQL functions docs.
James Rodewig 5 years ago
parent
commit
a7729c8e31
1 changed files with 2 additions and 6 deletions
  1. 2 6
      docs/reference/eql/functions.asciidoc

+ 2 - 6
docs/reference/eql/functions.asciidoc

@@ -183,8 +183,7 @@ CIDR block you wish to search. If `null`, the function returns `null`.
 [[eql-fn-endswith]]
 [[eql-fn-endswith]]
 === `endsWith`
 === `endsWith`
 
 
-Returns `true` if a source string ends with a provided substring. Matching is
-case insensitive.
+Returns `true` if a source string ends with a provided substring.
 
 
 [%collapsible]
 [%collapsible]
 ====
 ====
@@ -192,7 +191,6 @@ case insensitive.
 [source,eql]
 [source,eql]
 ----
 ----
 endsWith("regsvr32.exe", ".exe")          // returns true
 endsWith("regsvr32.exe", ".exe")          // returns true
-endsWith("regsvr32.exe", ".EXE")          // returns true
 endsWith("regsvr32.exe", ".dll")          // returns false
 endsWith("regsvr32.exe", ".dll")          // returns false
 endsWith("", "")                          // returns true
 endsWith("", "")                          // returns true
 
 
@@ -420,8 +418,7 @@ field datatypes:
 [[eql-fn-startswith]]
 [[eql-fn-startswith]]
 === `startsWith`
 === `startsWith`
 
 
-Returns `true` if a source string begins with a provided substring. Matching is
-case insensitive.
+Returns `true` if a source string begins with a provided substring.
 
 
 [%collapsible]
 [%collapsible]
 ====
 ====
@@ -429,7 +426,6 @@ case insensitive.
 [source,eql]
 [source,eql]
 ----
 ----
 startsWith("regsvr32.exe", "regsvr32")  // returns true
 startsWith("regsvr32.exe", "regsvr32")  // returns true
-startsWith("regsvr32.exe", "RegSvr32")  // returns true
 startsWith("regsvr32.exe", "explorer")  // returns false
 startsWith("regsvr32.exe", "explorer")  // returns false
 startsWith("", "")                      // returns true
 startsWith("", "")                      // returns true