winlogbeat/docs: adjust XPath query term limit warning #34715
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
efd6
added
bug
docs
Team:Security-External Integrations
backport-v7.17.0
botelastic
bot
added
needs_team
The page linked to in the docs is now a 404 suggeesting that the issue has been fixed. The only currently noted limitations on XPath are described at https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations This page is captured by the wayback machine. Windows Event Log supports a subset of XPath 1.0. The primary restriction is that only XML elements that represent events can be selected by an event selector. An XPath query that does not select an event is not valid. All valid selector paths start with * or "Event". All location paths operate on the event nodes and are composed of a series of steps. Each step is a structure of three parts: the axis, node test, and predicate. For more information about these parts and about XPath 1.0, see XML Path Language (XPath). Windows Event Log places the following restrictions on the expression: * Axis: Only the Child (default) and Attribute (and its shorthand "@") axis are supported. * Node Tests: Only node names and NCName tests are supported. The "*" character, which selects any character, is supported. * Predicates: Any valid XPath expression is acceptable if the location paths conform to the following restrictions: * Standard operators OR, AND, =, !=, <=, <, >=, >, and parentheses are supported. * Generating a string value for a node name is not supported. * Evaluation in reverse order is not supported. * Node sets are not supported. * Namespace scoping is not supported. * Namespace, processing, and comment nodes are not supported. * Context size is not supported. * Variable bindings are not supported. * The position function, and its shorthand array reference, is supported (on leaf nodes only). * The Band function is supported. The function performs a bitwise AND for two integer number arguments. If the result of the bitwise AND is nonzero, the function evaluates to true; otherwise, the function evaluates to false. * The timediff function is supported. The function computes the difference between the second argument and the first argument. One of the arguments must be a literal number. The arguments must use FILETIME representation. The result is the number of milliseconds between the two times. The result is positive if the second argument represents a later time; otherwise, it is negative. When the second argument is not provided, the current system time is used.
💚 Build Succeeded
Expand to view the summary
Build stats
❕ Flaky test reportNo test was executed to be analysed. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
|
@elasticmachine run elasticsearch-ci/docs |
andrewkroh
approved these changes
Mar 6, 2023
mergify bot
pushed a commit
that referenced
this pull request
Mar 6, 2023
The page linked to in the docs is now a 404 suggesting that the issue has been fixed. The only currently noted limitations on XPath are described at https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations This page is captured by the wayback machine. Windows Event Log supports a subset of XPath 1.0. The primary restriction is that only XML elements that represent events can be selected by an event selector. An XPath query that does not select an event is not valid. All valid selector paths start with * or "Event". All location paths operate on the event nodes and are composed of a series of steps. Each step is a structure of three parts: the axis, node test, and predicate. For more information about these parts and about XPath 1.0, see XML Path Language (XPath). Windows Event Log places the following restrictions on the expression: * Axis: Only the Child (default) and Attribute (and its shorthand "@") axis are supported. * Node Tests: Only node names and NCName tests are supported. The "*" character, which selects any character, is supported. * Predicates: Any valid XPath expression is acceptable if the location paths conform to the following restrictions: * Standard operators OR, AND, =, !=, <=, <, >=, >, and parentheses are supported. * Generating a string value for a node name is not supported. * Evaluation in reverse order is not supported. * Node sets are not supported. * Namespace scoping is not supported. * Namespace, processing, and comment nodes are not supported. * Context size is not supported. * Variable bindings are not supported. * The position function, and its shorthand array reference, is supported (on leaf nodes only). * The Band function is supported. The function performs a bitwise AND for two integer number arguments. If the result of the bitwise AND is nonzero, the function evaluates to true; otherwise, the function evaluates to false. * The timediff function is supported. The function computes the difference between the second argument and the first argument. One of the arguments must be a literal number. The arguments must use FILETIME representation. The result is the number of milliseconds between the two times. The result is positive if the second argument represents a later time; otherwise, it is negative. When the second argument is not provided, the current system time is used. (cherry picked from commit 5047714)
mergify bot
pushed a commit
that referenced
this pull request
Mar 6, 2023
The page linked to in the docs is now a 404 suggesting that the issue has been fixed. The only currently noted limitations on XPath are described at https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations This page is captured by the wayback machine. Windows Event Log supports a subset of XPath 1.0. The primary restriction is that only XML elements that represent events can be selected by an event selector. An XPath query that does not select an event is not valid. All valid selector paths start with * or "Event". All location paths operate on the event nodes and are composed of a series of steps. Each step is a structure of three parts: the axis, node test, and predicate. For more information about these parts and about XPath 1.0, see XML Path Language (XPath). Windows Event Log places the following restrictions on the expression: * Axis: Only the Child (default) and Attribute (and its shorthand "@") axis are supported. * Node Tests: Only node names and NCName tests are supported. The "*" character, which selects any character, is supported. * Predicates: Any valid XPath expression is acceptable if the location paths conform to the following restrictions: * Standard operators OR, AND, =, !=, <=, <, >=, >, and parentheses are supported. * Generating a string value for a node name is not supported. * Evaluation in reverse order is not supported. * Node sets are not supported. * Namespace scoping is not supported. * Namespace, processing, and comment nodes are not supported. * Context size is not supported. * Variable bindings are not supported. * The position function, and its shorthand array reference, is supported (on leaf nodes only). * The Band function is supported. The function performs a bitwise AND for two integer number arguments. If the result of the bitwise AND is nonzero, the function evaluates to true; otherwise, the function evaluates to false. * The timediff function is supported. The function computes the difference between the second argument and the first argument. One of the arguments must be a literal number. The arguments must use FILETIME representation. The result is the number of milliseconds between the two times. The result is positive if the second argument represents a later time; otherwise, it is negative. When the second argument is not provided, the current system time is used. (cherry picked from commit 5047714)
This was referenced Mar 6, 2023
efd6
added a commit
that referenced
this pull request
Mar 6, 2023
The page linked to in the docs is now a 404 suggesting that the issue has been fixed. The only currently noted limitations on XPath are described at https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations This page is captured by the wayback machine. Windows Event Log supports a subset of XPath 1.0. The primary restriction is that only XML elements that represent events can be selected by an event selector. An XPath query that does not select an event is not valid. All valid selector paths start with * or "Event". All location paths operate on the event nodes and are composed of a series of steps. Each step is a structure of three parts: the axis, node test, and predicate. For more information about these parts and about XPath 1.0, see XML Path Language (XPath). Windows Event Log places the following restrictions on the expression: * Axis: Only the Child (default) and Attribute (and its shorthand "@") axis are supported. * Node Tests: Only node names and NCName tests are supported. The "*" character, which selects any character, is supported. * Predicates: Any valid XPath expression is acceptable if the location paths conform to the following restrictions: * Standard operators OR, AND, =, !=, <=, <, >=, >, and parentheses are supported. * Generating a string value for a node name is not supported. * Evaluation in reverse order is not supported. * Node sets are not supported. * Namespace scoping is not supported. * Namespace, processing, and comment nodes are not supported. * Context size is not supported. * Variable bindings are not supported. * The position function, and its shorthand array reference, is supported (on leaf nodes only). * The Band function is supported. The function performs a bitwise AND for two integer number arguments. If the result of the bitwise AND is nonzero, the function evaluates to true; otherwise, the function evaluates to false. * The timediff function is supported. The function computes the difference between the second argument and the first argument. One of the arguments must be a literal number. The arguments must use FILETIME representation. The result is the number of milliseconds between the two times. The result is positive if the second argument represents a later time; otherwise, it is negative. When the second argument is not provided, the current system time is used. (cherry picked from commit 5047714) Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
efd6
added a commit
that referenced
this pull request
Mar 6, 2023
The page linked to in the docs is now a 404 suggesting that the issue has been fixed. The only currently noted limitations on XPath are described at https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations This page is captured by the wayback machine. Windows Event Log supports a subset of XPath 1.0. The primary restriction is that only XML elements that represent events can be selected by an event selector. An XPath query that does not select an event is not valid. All valid selector paths start with * or "Event". All location paths operate on the event nodes and are composed of a series of steps. Each step is a structure of three parts: the axis, node test, and predicate. For more information about these parts and about XPath 1.0, see XML Path Language (XPath). Windows Event Log places the following restrictions on the expression: * Axis: Only the Child (default) and Attribute (and its shorthand "@") axis are supported. * Node Tests: Only node names and NCName tests are supported. The "*" character, which selects any character, is supported. * Predicates: Any valid XPath expression is acceptable if the location paths conform to the following restrictions: * Standard operators OR, AND, =, !=, <=, <, >=, >, and parentheses are supported. * Generating a string value for a node name is not supported. * Evaluation in reverse order is not supported. * Node sets are not supported. * Namespace scoping is not supported. * Namespace, processing, and comment nodes are not supported. * Context size is not supported. * Variable bindings are not supported. * The position function, and its shorthand array reference, is supported (on leaf nodes only). * The Band function is supported. The function performs a bitwise AND for two integer number arguments. If the result of the bitwise AND is nonzero, the function evaluates to true; otherwise, the function evaluates to false. * The timediff function is supported. The function computes the difference between the second argument and the first argument. One of the arguments must be a literal number. The arguments must use FILETIME representation. The result is the number of milliseconds between the two times. The result is positive if the second argument represents a later time; otherwise, it is negative. When the second argument is not provided, the current system time is used. (cherry picked from commit 5047714) Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
chrisberkhout
pushed a commit
that referenced
this pull request
Jun 1, 2023
The page linked to in the docs is now a 404 suggesting that the issue has been fixed. The only currently noted limitations on XPath are described at https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations This page is captured by the wayback machine. Windows Event Log supports a subset of XPath 1.0. The primary restriction is that only XML elements that represent events can be selected by an event selector. An XPath query that does not select an event is not valid. All valid selector paths start with * or "Event". All location paths operate on the event nodes and are composed of a series of steps. Each step is a structure of three parts: the axis, node test, and predicate. For more information about these parts and about XPath 1.0, see XML Path Language (XPath). Windows Event Log places the following restrictions on the expression: * Axis: Only the Child (default) and Attribute (and its shorthand "@") axis are supported. * Node Tests: Only node names and NCName tests are supported. The "*" character, which selects any character, is supported. * Predicates: Any valid XPath expression is acceptable if the location paths conform to the following restrictions: * Standard operators OR, AND, =, !=, <=, <, >=, >, and parentheses are supported. * Generating a string value for a node name is not supported. * Evaluation in reverse order is not supported. * Node sets are not supported. * Namespace scoping is not supported. * Namespace, processing, and comment nodes are not supported. * Context size is not supported. * Variable bindings are not supported. * The position function, and its shorthand array reference, is supported (on leaf nodes only). * The Band function is supported. The function performs a bitwise AND for two integer number arguments. If the result of the bitwise AND is nonzero, the function evaluates to true; otherwise, the function evaluates to false. * The timediff function is supported. The function computes the difference between the second argument and the first argument. One of the arguments must be a literal number. The arguments must use FILETIME representation. The result is the number of milliseconds between the two times. The result is positive if the second argument represents a later time; otherwise, it is negative. When the second argument is not provided, the current system time is used.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adjusts unclear documentation and removes a link to a now-404ing page.
The page linked to in the docs is now a 404 suggeesting that the issue has been fixed. The only currently noted limitations on XPath are described at https://learn.microsoft.com/en-us/windows/win32/wes/consuming-events#xpath-10-limitations
Why is it important?
The existing documentation is confusing.
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Author's Checklist
How to test this PR locally
Related issues
Use cases
Screenshots
Logs