Browse Source

[DOCS] Add admonition for EQL exact matches on text fields (#53402)

Adds a important admonition to the EQL syntax page noting that
the equal (`==`) operator should not be used to match `text` field
values.

Relates to #52709 and #53020
James Rodewig 5 years ago
parent
commit
b58e95d25c
1 changed files with 14 additions and 1 deletions
  1. 14 1
      docs/reference/eql/syntax.asciidoc

+ 14 - 1
docs/reference/eql/syntax.asciidoc

@@ -10,7 +10,7 @@ experimental::[]
 
 [IMPORTANT]
 ====
-{es} supports a subset of EQL syntax.
+{es} supports a subset of EQL syntax. See <<eql-limitations>>.
 ====
 
 [discrete]
@@ -72,6 +72,19 @@ You can specify and combine these criteria using the following operators:
 <   <=   ==   !=   >=   >
 ----
 
+[IMPORTANT]
+====
+Avoid using the equal operator (`==`) to perform exact matching on `text` field
+values.
+
+By default, {es} changes the values of <<text,`text`>> fields as part of
+<<analysis, analysis>>. This can make finding exact matches for `text` field
+values difficult.
+
+To search `text` fields, consider using a <<eql-search-filter-query-dsl,query
+DSL filter>> that contains a <<query-dsl-match-query,`match`>> query.
+====
+
 .*Definitions*
 [%collapsible]
 ====