mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-06-28 17:34:17 -04:00
[DOCS] EQL: Remove wildcard function (#72121)
This commit is contained in:
parent
39fee5e908
commit
f8d2578ede
3 changed files with 18 additions and 73 deletions
|
@ -1022,76 +1022,3 @@ If using a field as the argument, this parameter supports only
|
|||
<<number,`numeric`>> field data types.
|
||||
|
||||
*Returns:* integer, float, or `null`
|
||||
|
||||
[discrete]
|
||||
[[eql-fn-wildcard]]
|
||||
=== `wildcard`
|
||||
|
||||
Returns `true` if a source string matches one or more provided wildcard
|
||||
expressions. Matching is case-sensitive by default.
|
||||
|
||||
*Example*
|
||||
[source,eql]
|
||||
----
|
||||
// The * wildcard matches zero or more characters.
|
||||
// process.name = "regsvr32.exe"
|
||||
wildcard(process.name, "*regsvr32*") // returns true
|
||||
wildcard(process.name, "*Regsvr32*") // returns false
|
||||
wildcard(process.name, "*regsvr32*", "*explorer*") // returns true
|
||||
wildcard(process.name, "*explorer*") // returns false
|
||||
wildcard(process.name, "*explorer*", "*scrobj*") // returns false
|
||||
|
||||
// Make matching case-insensitive
|
||||
wildcard~(process.name, "*Regsvr32*") // returns true
|
||||
|
||||
// The ? wildcard matches exactly one character.
|
||||
// process.name = "regsvr32.exe"
|
||||
wildcard(process.name, "regsvr32.e?e") // returns true
|
||||
wildcard(process.name, "regsvr32.e?e", "e?plorer.exe") // returns true
|
||||
wildcard(process.name, "regsvr32.exe?") // returns false
|
||||
wildcard(process.name, "e?plorer.exe") // returns false
|
||||
wildcard(process.name, "e?plorer.exe", "scrob?.dll") // returns false
|
||||
|
||||
// empty strings
|
||||
wildcard("", "*start*") // returns false
|
||||
wildcard("", "*") // returns true
|
||||
wildcard("", "?") // returns false
|
||||
wildcard("", "") // returns true
|
||||
|
||||
// null handling
|
||||
wildcard(null, "*regsvr32*") // returns null
|
||||
wildcard(process.name, null) // returns null
|
||||
----
|
||||
|
||||
*Syntax*
|
||||
[source,txt]
|
||||
----
|
||||
wildcard(<source>, <wildcard_exp>[, ...])
|
||||
----
|
||||
|
||||
*Parameters*
|
||||
|
||||
`<source>`::
|
||||
+
|
||||
--
|
||||
(Required, string)
|
||||
Source string. If `null`, the function returns `null`.
|
||||
|
||||
If using a field as the argument, this parameter supports only the following
|
||||
field data types:
|
||||
|
||||
* A type in the <<keyword,`keyword`>> family
|
||||
* <<text,`text`>> field with a <<keyword,`keyword`>> sub-field
|
||||
--
|
||||
|
||||
`<wildcard_exp>`::
|
||||
+
|
||||
--
|
||||
(Required{multi-arg-ref}, string)
|
||||
Wildcard expression used to match the source string. The `*` wildcard matches
|
||||
zero or more characters. The `?` wildcard matches exactly one character.
|
||||
|
||||
If `null`, the function returns `null`. Fields are not supported as arguments.
|
||||
--
|
||||
|
||||
*Returns:* boolean
|
||||
|
|
|
@ -17,6 +17,7 @@ coming[8.0.0]
|
|||
* <<breaking_80_breaker_changes>>
|
||||
* <<breaking_80_cluster_changes>>
|
||||
* <<breaking_80_discovery_changes>>
|
||||
* <<breaking_80_eql_changes>>
|
||||
* <<breaking_80_http_changes>>
|
||||
* <<breaking_80_ilm_changes>>
|
||||
* <<breaking_80_indices_changes>>
|
||||
|
@ -91,6 +92,7 @@ include::migrate_8_0/analysis.asciidoc[]
|
|||
include::migrate_8_0/breaker.asciidoc[]
|
||||
include::migrate_8_0/cluster.asciidoc[]
|
||||
include::migrate_8_0/discovery.asciidoc[]
|
||||
include::migrate_8_0/eql.asciidoc[]
|
||||
include::migrate_8_0/http.asciidoc[]
|
||||
include::migrate_8_0/ilm.asciidoc[]
|
||||
include::migrate_8_0/indices.asciidoc[]
|
||||
|
|
16
docs/reference/migration/migrate_8_0/eql.asciidoc
Normal file
16
docs/reference/migration/migrate_8_0/eql.asciidoc
Normal file
|
@ -0,0 +1,16 @@
|
|||
[discrete]
|
||||
[[breaking_80_eql_changes]]
|
||||
==== EQL changes
|
||||
|
||||
//tag::notable-breaking-changes[]
|
||||
.The `wildcard` function has been removed.
|
||||
[%collapsible]
|
||||
====
|
||||
*Details* +
|
||||
The `wildcard` function was deprecated in {es} 7.13.0 and has been removed.
|
||||
|
||||
*Impact* +
|
||||
Use the <<eql-syntax-pattern-comparison-keywords,`like`>> or
|
||||
<<eql-syntax-pattern-comparison-keywords,`regex`>> keyword instead.
|
||||
====
|
||||
// end::notable-breaking-changes[]
|
Loading…
Add table
Add a link
Reference in a new issue