Browse Source

[DOCS] EQL: Note EQL uses `fields` parameter (#74194)

James Rodewig 4 years ago
parent
commit
c7d59f0a4d
1 changed files with 9 additions and 0 deletions
  1. 9 0
      docs/reference/eql/syntax.asciidoc

+ 9 - 0
docs/reference/eql/syntax.asciidoc

@@ -794,6 +794,15 @@ For a list of supported pipes, see <<eql-pipe-ref>>.
 
 EQL does not support the following features and syntax.
 
+[discrete]
+[[eql-uses-fields-parameter]]
+==== EQL uses the `fields` parameter
+
+EQL retrieves field values using the search API's <<search-fields-param,`fields`
+parameter>>. Any limitations on the `fields` parameter also apply to EQL
+queries. For example, if `_source` is disabled for any returned fields or at
+index level, the values cannot be retrieved.
+
 [discrete]
 [[eql-compare-fields]]
 ==== Comparing fields