diff --git a/docs/reference/eql/functions.asciidoc b/docs/reference/eql/functions.asciidoc index 67429ca53645..c6a8cb9a29ca 100644 --- a/docs/reference/eql/functions.asciidoc +++ b/docs/reference/eql/functions.asciidoc @@ -1022,76 +1022,3 @@ If using a field as the argument, this parameter supports only <> field data types. *Returns:* integer, float, or `null` - -[discrete] -[[eql-fn-wildcard]] -=== `wildcard` - -Returns `true` if a source string matches one or more provided wildcard -expressions. Matching is case-sensitive by default. - -*Example* -[source,eql] ----- -// The * wildcard matches zero or more characters. -// process.name = "regsvr32.exe" -wildcard(process.name, "*regsvr32*") // returns true -wildcard(process.name, "*Regsvr32*") // returns false -wildcard(process.name, "*regsvr32*", "*explorer*") // returns true -wildcard(process.name, "*explorer*") // returns false -wildcard(process.name, "*explorer*", "*scrobj*") // returns false - -// Make matching case-insensitive -wildcard~(process.name, "*Regsvr32*") // returns true - -// The ? wildcard matches exactly one character. -// process.name = "regsvr32.exe" -wildcard(process.name, "regsvr32.e?e") // returns true -wildcard(process.name, "regsvr32.e?e", "e?plorer.exe") // returns true -wildcard(process.name, "regsvr32.exe?") // returns false -wildcard(process.name, "e?plorer.exe") // returns false -wildcard(process.name, "e?plorer.exe", "scrob?.dll") // returns false - -// empty strings -wildcard("", "*start*") // returns false -wildcard("", "*") // returns true -wildcard("", "?") // returns false -wildcard("", "") // returns true - -// null handling -wildcard(null, "*regsvr32*") // returns null -wildcard(process.name, null) // returns null ----- - -*Syntax* -[source,txt] ----- -wildcard(, [, ...]) ----- - -*Parameters* - -``:: -+ --- -(Required, string) -Source string. If `null`, the function returns `null`. - -If using a field as the argument, this parameter supports only the following -field data types: - -* A type in the <> family -* <> field with a <> sub-field --- - -``:: -+ --- -(Required{multi-arg-ref}, string) -Wildcard expression used to match the source string. The `*` wildcard matches -zero or more characters. The `?` wildcard matches exactly one character. - -If `null`, the function returns `null`. Fields are not supported as arguments. --- - -*Returns:* boolean diff --git a/docs/reference/migration/migrate_8_0.asciidoc b/docs/reference/migration/migrate_8_0.asciidoc index 6b83f3fa3473..6a368ae903b4 100644 --- a/docs/reference/migration/migrate_8_0.asciidoc +++ b/docs/reference/migration/migrate_8_0.asciidoc @@ -17,6 +17,7 @@ coming[8.0.0] * <> * <> * <> +* <> * <> * <> * <> @@ -91,6 +92,7 @@ include::migrate_8_0/analysis.asciidoc[] include::migrate_8_0/breaker.asciidoc[] include::migrate_8_0/cluster.asciidoc[] include::migrate_8_0/discovery.asciidoc[] +include::migrate_8_0/eql.asciidoc[] include::migrate_8_0/http.asciidoc[] include::migrate_8_0/ilm.asciidoc[] include::migrate_8_0/indices.asciidoc[] diff --git a/docs/reference/migration/migrate_8_0/eql.asciidoc b/docs/reference/migration/migrate_8_0/eql.asciidoc new file mode 100644 index 000000000000..5b38a9610804 --- /dev/null +++ b/docs/reference/migration/migrate_8_0/eql.asciidoc @@ -0,0 +1,16 @@ +[discrete] +[[breaking_80_eql_changes]] +==== EQL changes + +//tag::notable-breaking-changes[] +.The `wildcard` function has been removed. +[%collapsible] +==== +*Details* + +The `wildcard` function was deprecated in {es} 7.13.0 and has been removed. + +*Impact* + +Use the <> or +<> keyword instead. +==== +// end::notable-breaking-changes[] \ No newline at end of file