Skip to content

Commit 0e846d2

Browse files
authored
[DOCS] EQL: Note EQL uses fields parameter (#74194) (#74204)
1 parent cdef1ac commit 0e846d2

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

docs/reference/eql/syntax.asciidoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -786,6 +786,15 @@ For a list of supported pipes, see <<eql-pipe-ref>>.
786786

787787
EQL does not support the following features and syntax.
788788

789+
[discrete]
790+
[[eql-uses-fields-parameter]]
791+
==== EQL uses the `fields` parameter
792+
793+
EQL retrieves field values using the search API's <<search-fields-param,`fields`
794+
parameter>>. Any limitations on the `fields` parameter also apply to EQL
795+
queries. For example, if `_source` is disabled for any returned fields or at
796+
index level, the values cannot be retrieved.
797+
789798
[discrete]
790799
[[eql-compare-fields]]
791800
==== Comparing fields

0 commit comments

Comments
 (0)