@@ -250,14 +250,15 @@ process where ( 4.0 / process.args_count ) == 1
250250[[eql-syntax-strings]]
251251==== Strings
252252
253- Strings are enclosed with double quotes (`"`) or single quotes (`'`) .
253+ Strings are enclosed with double quotes (`"`).
254254
255255[source,eql]
256256----
257257"hello world"
258- "hello world with 'substring'"
259258----
260259
260+ Strings enclosed in single quotes (`'`) are not supported.
261+
261262[discrete]
262263[[eql-syntax-wildcards]]
263264===== Wildcards
@@ -315,10 +316,13 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
315316|`\t` | A tab character
316317|`\\` | A backslash (`\`) character
317318|`\"` | A double quote (`"`) character
318- |`\'` | A single quote (`'`) character
319319|====
320320====
321321
322+ IMPORTANT: The single quote (`'`) character is reserved for future use. You
323+ cannot use an escaped single quote (`\'`) for literal strings. Use an escaped
324+ double quote (`\"`) instead.
325+
322326[discrete]
323327[[eql-syntax-raw-strings]]
324328===== Raw strings
@@ -328,11 +332,11 @@ literal characters.
328332
329333[source,eql]
330334----
331- ?"String with a literal ' blackslash' \ character included"
335+ ?"String with a literal blackslash \ character included"
332336----
333337
334- You can escape single quotes (`'`) and double quotes (`"`) with a backslash, but
335- the backslash remains in the resulting string.
338+ You can escape double quotes (`"`) with a backslash, but the backslash remains
339+ in the resulting string.
336340
337341[source,eql]
338342----
@@ -670,6 +674,17 @@ You cannot use EQL to search the values of a <<nested,`nested`>> field or the
670674sub-fields of a `nested` field. However, data streams and indices containing
671675`nested` field mappings are otherwise supported.
672676
677+ [discrete]
678+ [[single-quote-strings]]
679+ ==== Single quote strings
680+
681+ In {es} EQL, the single quote (`'`) character is reserved for future use.
682+ Strings enclosed in single quotes are not supported. Enclose strings in
683+ double quotes (`"`) instead.
684+
685+ You cannot use an escaped single quote (`\'`) for literal strings. Use an
686+ escaped double quote (`\"`) instead.
687+
673688[discrete]
674689[[eql-unsupported-syntax]]
675690==== Unsupported syntax
0 commit comments