Skip to content

Commit

Permalink
[DOCS] Add admonition for EQL exact matches on text fields (#53402)
Browse files Browse the repository at this point in the history
Adds a important admonition to the EQL syntax page noting that
the equal (`==`) operator should not be used to match `text` field
values.

Relates to #52709 and #53020
  • Loading branch information
jrodewig committed Apr 23, 2020
1 parent c9a1258 commit b58e95d
Showing 1 changed file with 14 additions and 1 deletion.
15 changes: 14 additions & 1 deletion docs/reference/eql/syntax.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ experimental::[]

[IMPORTANT]
====
{es} supports a subset of EQL syntax.
{es} supports a subset of EQL syntax. See <<eql-limitations>>.
====

[discrete]
Expand Down Expand Up @@ -72,6 +72,19 @@ You can specify and combine these criteria using the following operators:
< <= == != >= >
----

[IMPORTANT]
====
Avoid using the equal operator (`==`) to perform exact matching on `text` field
values.
By default, {es} changes the values of <<text,`text`>> fields as part of
<<analysis, analysis>>. This can make finding exact matches for `text` field
values difficult.
To search `text` fields, consider using a <<eql-search-filter-query-dsl,query
DSL filter>> that contains a <<query-dsl-match-query,`match`>> query.
====

.*Definitions*
[%collapsible]
====
Expand Down

0 comments on commit b58e95d

Please sign in to comment.