File tree Expand file tree Collapse file tree 1 file changed +3
-17
lines changed Expand file tree Collapse file tree 1 file changed +3
-17
lines changed Original file line number Diff line number Diff line change @@ -42,31 +42,17 @@ the `event_type_field` parameter of the EQL search API.
4242[[eql-syntax-match-any-event-type]]
4343===== Match any event type
4444
45- To match events of any type, use the `any` keyword.
45+ To match events of any type, use the `any` keyword. You can also use the `any`
46+ keyword to search for documents without a event type field.
4647
47- For example, the following EQL query matches any event with a
48+ For example, the following EQL query matches any documents with a
4849`network.protocol` field value of `http`:
4950
5051[source,eql]
5152----
5253any where network.protocol == "http"
5354----
5455
55- [discrete]
56- [[eql-syntax-event-types-starting-with-digits]]
57- ===== Event types starting with digits
58-
59- EQL queries cannot start with a digit. To match event types starting with a
60- digit, use the `any` keyword with a condition for the event type field.
61-
62- For example, the following EQL query uses `event_type` as the event type field.
63- The query only matches `42_process` events:
64-
65- [source,eql]
66- ----
67- any where event_type === `42_process`
68- ----
69-
7056[discrete]
7157[[eql-syntax-conditions]]
7258==== Conditions
You can’t perform that action at this time.
0 commit comments