We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
fields
1 parent 74ea216 commit c7d59f0Copy full SHA for c7d59f0
docs/reference/eql/syntax.asciidoc
@@ -794,6 +794,15 @@ For a list of supported pipes, see <<eql-pipe-ref>>.
794
795
EQL does not support the following features and syntax.
796
797
+[discrete]
798
+[[eql-uses-fields-parameter]]
799
+==== EQL uses the `fields` parameter
800
+
801
+EQL retrieves field values using the search API's <<search-fields-param,`fields`
802
+parameter>>. Any limitations on the `fields` parameter also apply to EQL
803
+queries. For example, if `_source` is disabled for any returned fields or at
804
+index level, the values cannot be retrieved.
805
806
[discrete]
807
[[eql-compare-fields]]
808
==== Comparing fields
0 commit comments