Ver Fonte

[DOCS] EQL: Document unsupported var comparison (#58941)

ES EQL queries do not support the comparison of a variable, such as
a field value, to another variable.

This adds a related para and example to the EQL syntax docs.
James Rodewig há 5 anos atrás
pai
commit
c5df35eba1
1 ficheiros alterados com 28 adições e 0 exclusões
  1. 28 0
      docs/reference/eql/syntax.asciidoc

+ 28 - 0
docs/reference/eql/syntax.asciidoc

@@ -72,6 +72,34 @@ You can specify and combine these criteria using the following operators:
 <   <=   ==   !=   >=   >
 ----
 
+You cannot use comparison operators to compare a variable, such as a field
+value, to another variable, even if those variables are modified using a
+<eql-functions,function>>.
+
+.*Example*
+[%collapsible]
+====
+The following EQL query compares the `process.parent_name` field
+value to a static value, `foo`. This comparison is supported.
+
+However, the query also compares the `process.parent.name` field value to the
+`process.name` field. This comparison is not supported and will return an
+error for the entire query.
+
+[source,eql]
+----
+process where process.parent.name == "foo" and process.parent.name == process.name
+----
+
+Instead, you can rewrite the query to compare both the `process.parent.name`
+and `process.name` fields to static values.
+
+[source,eql]
+----
+process where process.parent.name == "foo" and process.name == "foo"
+----
+====
+
 [IMPORTANT]
 ====
 Avoid using the equal operator (`==`) to perform exact matching on `text` field