[DOCS] EQL: Remove wildcard function (#72121)

This commit is contained in:
James Rodewig 2021-04-22 15:49:07 -04:00 committed by GitHub
parent 39fee5e908
commit f8d2578ede
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 18 additions and 73 deletions

View file

@ -1022,76 +1022,3 @@ If using a field as the argument, this parameter supports only
<<number,`numeric`>> field data types.
*Returns:* integer, float, or `null`
[discrete]
[[eql-fn-wildcard]]
=== `wildcard`
Returns `true` if a source string matches one or more provided wildcard
expressions. Matching is case-sensitive by default.
*Example*
[source,eql]
----
// The * wildcard matches zero or more characters.
// process.name = "regsvr32.exe"
wildcard(process.name, "*regsvr32*") // returns true
wildcard(process.name, "*Regsvr32*") // returns false
wildcard(process.name, "*regsvr32*", "*explorer*") // returns true
wildcard(process.name, "*explorer*") // returns false
wildcard(process.name, "*explorer*", "*scrobj*") // returns false
// Make matching case-insensitive
wildcard~(process.name, "*Regsvr32*") // returns true
// The ? wildcard matches exactly one character.
// process.name = "regsvr32.exe"
wildcard(process.name, "regsvr32.e?e") // returns true
wildcard(process.name, "regsvr32.e?e", "e?plorer.exe") // returns true
wildcard(process.name, "regsvr32.exe?") // returns false
wildcard(process.name, "e?plorer.exe") // returns false
wildcard(process.name, "e?plorer.exe", "scrob?.dll") // returns false
// empty strings
wildcard("", "*start*") // returns false
wildcard("", "*") // returns true
wildcard("", "?") // returns false
wildcard("", "") // returns true
// null handling
wildcard(null, "*regsvr32*") // returns null
wildcard(process.name, null) // returns null
----
*Syntax*
[source,txt]
----
wildcard(<source>, <wildcard_exp>[, ...])
----
*Parameters*
`<source>`::
+
--
(Required, string)
Source string. If `null`, the function returns `null`.
If using a field as the argument, this parameter supports only the following
field data types:
* A type in the <<keyword,`keyword`>> family
* <<text,`text`>> field with a <<keyword,`keyword`>> sub-field
--
`<wildcard_exp>`::
+
--
(Required{multi-arg-ref}, string)
Wildcard expression used to match the source string. The `*` wildcard matches
zero or more characters. The `?` wildcard matches exactly one character.
If `null`, the function returns `null`. Fields are not supported as arguments.
--
*Returns:* boolean

View file

@ -17,6 +17,7 @@ coming[8.0.0]
* <<breaking_80_breaker_changes>>
* <<breaking_80_cluster_changes>>
* <<breaking_80_discovery_changes>>
* <<breaking_80_eql_changes>>
* <<breaking_80_http_changes>>
* <<breaking_80_ilm_changes>>
* <<breaking_80_indices_changes>>
@ -91,6 +92,7 @@ include::migrate_8_0/analysis.asciidoc[]
include::migrate_8_0/breaker.asciidoc[]
include::migrate_8_0/cluster.asciidoc[]
include::migrate_8_0/discovery.asciidoc[]
include::migrate_8_0/eql.asciidoc[]
include::migrate_8_0/http.asciidoc[]
include::migrate_8_0/ilm.asciidoc[]
include::migrate_8_0/indices.asciidoc[]

View file

@ -0,0 +1,16 @@
[discrete]
[[breaking_80_eql_changes]]
==== EQL changes
//tag::notable-breaking-changes[]
.The `wildcard` function has been removed.
[%collapsible]
====
*Details* +
The `wildcard` function was deprecated in {es} 7.13.0 and has been removed.
*Impact* +
Use the <<eql-syntax-pattern-comparison-keywords,`like`>> or
<<eql-syntax-pattern-comparison-keywords,`regex`>> keyword instead.
====
// end::notable-breaking-changes[]