Pipe reference
{es} supports the following EQL pipes.
Returns up to a specified number of events or sequences, starting with the earliest matches. Works similarly to the {wikipedia}/Head_(Unix)[Unix head command].
Example
The following EQL query returns up to three of the earliest powershell commands.
process where process.name == "powershell.exe"
| head 3Syntax
head <max>Parameters
<max>-
(Required, integer) Maximum number of matching events or sequences to return.
Returns up to a specified number of events or sequences, starting with the most recent matches. Works similarly to the {wikipedia}/Tail_(Unix)[Unix tail command].
Example
The following EQL query returns up to five of the most recent svchost.exe
processes.
process where process.name == "svchost.exe"
| tail 5Syntax
tail <max>Parameters
<max>-
(Required, integer) Maximum number of matching events or sequences to return.