Browse Source

[DOCS] EQL: Remove wildcard function (#72121)

James Rodewig 4 years ago
parent
commit
f8d2578ede

+ 0 - 73
docs/reference/eql/functions.asciidoc

@@ -1022,76 +1022,3 @@ If using a field as the argument, this parameter supports only
 <<number,`numeric`>> field data types.
 
 *Returns:* integer, float, or `null`
-
-[discrete]
-[[eql-fn-wildcard]]
-=== `wildcard`
-
-Returns `true` if a source string matches one or more provided wildcard
-expressions. Matching is case-sensitive by default.
-
-*Example*
-[source,eql]
-----
-// The * wildcard matches zero or more characters.
-// process.name = "regsvr32.exe"
-wildcard(process.name, "*regsvr32*")                // returns true
-wildcard(process.name, "*Regsvr32*")                // returns false
-wildcard(process.name, "*regsvr32*", "*explorer*")  // returns true
-wildcard(process.name, "*explorer*")                // returns false
-wildcard(process.name, "*explorer*", "*scrobj*")    // returns false
-
-// Make matching case-insensitive
-wildcard~(process.name, "*Regsvr32*")                // returns true
-
-// The ? wildcard matches exactly one character.
-// process.name = "regsvr32.exe"
-wildcard(process.name, "regsvr32.e?e")                  // returns true
-wildcard(process.name, "regsvr32.e?e", "e?plorer.exe")  // returns true
-wildcard(process.name, "regsvr32.exe?")                 // returns false
-wildcard(process.name, "e?plorer.exe")                  // returns false
-wildcard(process.name, "e?plorer.exe", "scrob?.dll")    // returns false
-
-// empty strings
-wildcard("", "*start*")                             // returns false
-wildcard("", "*")                                   // returns true
-wildcard("", "?")                                   // returns false
-wildcard("", "")                                    // returns true
-
-// null handling
-wildcard(null, "*regsvr32*")                        // returns null
-wildcard(process.name, null)                        // returns null
-----
-
-*Syntax*
-[source,txt]
-----
-wildcard(<source>, <wildcard_exp>[, ...])
-----
-
-*Parameters*
-
-`<source>`::
-+
---
-(Required, string)
-Source string. If `null`, the function returns `null`.
-
-If using a field as the argument, this parameter supports only the following
-field data types:
-
-* A type in the <<keyword,`keyword`>> family
-* <<text,`text`>> field with a <<keyword,`keyword`>> sub-field
---
-
-`<wildcard_exp>`::
-+
---
-(Required{multi-arg-ref}, string)
-Wildcard expression used to match the source string. The `*` wildcard matches
-zero or more characters. The `?` wildcard matches exactly one character.
-
-If `null`, the function returns `null`. Fields are not supported as arguments.
---
-
-*Returns:* boolean

+ 2 - 0
docs/reference/migration/migrate_8_0.asciidoc

@@ -17,6 +17,7 @@ coming[8.0.0]
 * <<breaking_80_breaker_changes>>
 * <<breaking_80_cluster_changes>>
 * <<breaking_80_discovery_changes>>
+* <<breaking_80_eql_changes>>
 * <<breaking_80_http_changes>>
 * <<breaking_80_ilm_changes>>
 * <<breaking_80_indices_changes>>
@@ -91,6 +92,7 @@ include::migrate_8_0/analysis.asciidoc[]
 include::migrate_8_0/breaker.asciidoc[]
 include::migrate_8_0/cluster.asciidoc[]
 include::migrate_8_0/discovery.asciidoc[]
+include::migrate_8_0/eql.asciidoc[]
 include::migrate_8_0/http.asciidoc[]
 include::migrate_8_0/ilm.asciidoc[]
 include::migrate_8_0/indices.asciidoc[]

+ 16 - 0
docs/reference/migration/migrate_8_0/eql.asciidoc

@@ -0,0 +1,16 @@
+[discrete]
+[[breaking_80_eql_changes]]
+==== EQL changes
+
+//tag::notable-breaking-changes[]
+.The `wildcard` function has been removed.
+[%collapsible]
+====
+*Details* +
+The `wildcard` function was deprecated in {es} 7.13.0 and has been removed.
+
+*Impact* +
+Use the <<eql-syntax-pattern-comparison-keywords,`like`>> or
+<<eql-syntax-pattern-comparison-keywords,`regex`>> keyword instead.
+====
+// end::notable-breaking-changes[]