浏览代码

[DOCS] EQL: Correct EQL search API's `size` param def

The `size` parameter can be used to limit matching events or sequences.
James Rodewig 5 年之前
父节点
当前提交
bc0eeb4d37
共有 1 个文件被更改,包括 7 次插入2 次删除
  1. 7 2
      docs/reference/eql/eql-search-api.asciidoc

+ 7 - 2
docs/reference/eql/eql-search-api.asciidoc

@@ -121,8 +121,13 @@ Reserved for future use.
 
 `size`::
 (Optional, integer or float)
-Maximum number of matching events to return. Defaults to `50`. Values must be
-greater than `0`.
+For <<eql-basic-syntax,basic queries>>, the maximum number of matching events to
+return.
++
+For <<eql-sequences,sequence queries>>, the maximum number of matching sequences
+to return.
++
+Defaults to `50`. Values must be greater than `0`.
 
 [[eql-search-api-timestamp-field]]
 `timestamp_field`::