Skip to content

Commit ea38a56

Browse files
committed
Reuse "Events starting with digits" section
1 parent c8f7faa commit ea38a56

File tree

1 file changed

+3
-17
lines changed

1 file changed

+3
-17
lines changed

docs/reference/eql/syntax.asciidoc

Lines changed: 3 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -42,31 +42,17 @@ the `event_type_field` parameter of the EQL search API.
4242
[[eql-syntax-match-any-event-type]]
4343
===== Match any event type
4444

45-
To match events of any type, use the `any` keyword.
45+
To match events of any type, use the `any` keyword. You can also use the `any`
46+
keyword to search for documents without a event type field.
4647

47-
For example, the following EQL query matches any event with a
48+
For example, the following EQL query matches any documents with a
4849
`network.protocol` field value of `http`:
4950

5051
[source,eql]
5152
----
5253
any where network.protocol == "http"
5354
----
5455

55-
[discrete]
56-
[[eql-syntax-event-types-starting-with-digits]]
57-
===== Event types starting with digits
58-
59-
EQL queries cannot start with a digit. To match event types starting with a
60-
digit, use the `any` keyword with a condition for the event type field.
61-
62-
For example, the following EQL query uses `event_type` as the event type field.
63-
The query only matches `42_process` events:
64-
65-
[source,eql]
66-
----
67-
any where event_type === `42_process`
68-
----
69-
7056
[discrete]
7157
[[eql-syntax-conditions]]
7258
==== Conditions

0 commit comments

Comments
 (0)