Skip to content

Commit cd95327

Browse files
authored
[DOCS] EQL: Remove support for single quote strings (#62479) (#62543)
1 parent 417ce93 commit cd95327

File tree

1 file changed

+21
-6
lines changed

1 file changed

+21
-6
lines changed

docs/reference/eql/syntax.asciidoc

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -250,14 +250,15 @@ process where ( 4.0 / process.args_count ) == 1
250250
[[eql-syntax-strings]]
251251
==== Strings
252252

253-
Strings are enclosed with double quotes (`"`) or single quotes (`'`).
253+
Strings are enclosed with double quotes (`"`).
254254

255255
[source,eql]
256256
----
257257
"hello world"
258-
"hello world with 'substring'"
259258
----
260259

260+
Strings enclosed in single quotes (`'`) are not supported.
261+
261262
[discrete]
262263
[[eql-syntax-wildcards]]
263264
===== Wildcards
@@ -315,10 +316,13 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
315316
|`\t` | A tab character
316317
|`\\` | A backslash (`\`) character
317318
|`\"` | A double quote (`"`) character
318-
|`\'` | A single quote (`'`) character
319319
|====
320320
====
321321

322+
IMPORTANT: The single quote (`'`) character is reserved for future use. You
323+
cannot use an escaped single quote (`\'`) for literal strings. Use an escaped
324+
double quote (`\"`) instead.
325+
322326
[discrete]
323327
[[eql-syntax-raw-strings]]
324328
===== Raw strings
@@ -328,11 +332,11 @@ literal characters.
328332

329333
[source,eql]
330334
----
331-
?"String with a literal 'blackslash' \ character included"
335+
?"String with a literal blackslash \ character included"
332336
----
333337

334-
You can escape single quotes (`'`) and double quotes (`"`) with a backslash, but
335-
the backslash remains in the resulting string.
338+
You can escape double quotes (`"`) with a backslash, but the backslash remains
339+
in the resulting string.
336340

337341
[source,eql]
338342
----
@@ -670,6 +674,17 @@ You cannot use EQL to search the values of a <<nested,`nested`>> field or the
670674
sub-fields of a `nested` field. However, data streams and indices containing
671675
`nested` field mappings are otherwise supported.
672676

677+
[discrete]
678+
[[single-quote-strings]]
679+
==== Single quote strings
680+
681+
In {es} EQL, the single quote (`'`) character is reserved for future use.
682+
Strings enclosed in single quotes are not supported. Enclose strings in
683+
double quotes (`"`) instead.
684+
685+
You cannot use an escaped single quote (`\'`) for literal strings. Use an
686+
escaped double quote (`\"`) instead.
687+
673688
[discrete]
674689
[[eql-unsupported-syntax]]
675690
==== Unsupported syntax

0 commit comments

Comments
 (0)