Skip to content

Commit

Permalink
[DOCS] Reorganize EQL requirements page
Browse files Browse the repository at this point in the history
  • Loading branch information
jrodewig committed Mar 3, 2020
1 parent a76df69 commit 427c9a0
Showing 1 changed file with 9 additions and 10 deletions.
19 changes: 9 additions & 10 deletions docs/reference/eql/requirements.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,15 @@

experimental::[]

EQL is schemaless and works out-of-the-box with most common log formats. If you
use a standard log format and already know what fields in your index contain
event type and timestamp information, you can skip this page.
EQL is schema-less and works well with most common log formats.


[TIP]
====
While no schema is required to use EQL in {es}, we recommend the
{ecs-ref}[Elastic Common Schema (ECS)]. The EQL search API is designed to work
with core ECS fields by default.
====

[discrete]
[[eql-required-fields]]
Expand All @@ -28,10 +34,3 @@ A field containing the event classification, such as `process`, `file`, or
Timestamp::
A field containing the date and/or time the event occurred. This is typically
mapped as a <<date,`date`>> field.

[TIP]
====
While no schema is required to use EQL in {es}, we recommend the
{ecs-ref}[Elastic Common Schema (ECS)]. {es}'s EQL search is designed to work
with core ECS fields by default.
====

0 comments on commit 427c9a0

Please sign in to comment.