We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
fields
1 parent cdef1ac commit 0e846d2Copy full SHA for 0e846d2
docs/reference/eql/syntax.asciidoc
@@ -786,6 +786,15 @@ For a list of supported pipes, see <<eql-pipe-ref>>.
786
787
EQL does not support the following features and syntax.
788
789
+[discrete]
790
+[[eql-uses-fields-parameter]]
791
+==== EQL uses the `fields` parameter
792
+
793
+EQL retrieves field values using the search API's <<search-fields-param,`fields`
794
+parameter>>. Any limitations on the `fields` parameter also apply to EQL
795
+queries. For example, if `_source` is disabled for any returned fields or at
796
+index level, the values cannot be retrieved.
797
798
[discrete]
799
[[eql-compare-fields]]
800
==== Comparing fields
0 commit comments