[DOCS] Document any keyword in EQL syntax

[jrodewig]

Adds documentation for the any keyword to the EQL syntax docs.

Includes:

• Definition of an event type and its relationship to the event type
  field.
• Example matching all event types using any keyword
• Example matching event types beginning with a digit
• Example using any with where true

Depends on #52526

[elasticmachine]

Pinging @elastic/es-search (:Search/EQL)

[elasticmachine]

Pinging @elastic/es-docs (>docs)

[astefan]

LGTM.
Unrelated to the changes in this PR, is the in and not in lookup operator already supported?

[rw-access]

I think it's safe to drop this section, since we've never suggested anywhere else that this should be supported behavior.
There is an issue that was created for this (#51853), but I think that's more of a feature request than a bug.

My worry here is that the emphasis on digits could cause confusion. You also currently run into the same problem if there are hyphens or special characters in the event type.

One thing we could do, is reuse or merge this section with the previous mention that documents that don't have an "event type" and can't that be queried with the form <event type> where <condition>, can use any where. I think it's good that you show cases where any where ... is convenient, and also when it's necessary.

[jrodewig]

Thanks for the feedback @rw-access. With ea38a56, I added a sentence to the previous section stating that any where can be used for documents without an event type field. Feels much less corner-case-y.

[jrodewig]

@astefan It appears that in and not in are both already supported:

in

POST my_index/_doc
{
  "@timestamp": "2020-12-07T11:06:07.000Z",
  "event": {
    "category": "process"
  },
  "process": {
    "name": "cmd.exe"
  }
}

GET my_index/_eql/search
{
  "event_type_field": "event.category",
  "rule": "process where process.name in (\"cmd.exe\")"
}

{
  "took" : 5,
  "timed_out" : false,
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "events" : [
      {
        "_index" : "my_index",
        "_id" : "1BwChnABDtlfLF_OwhVR",
        "_score" : 0.5753642,
        "_source" : {
          "process" : {
            "name" : "cmd.exe"
          },
          "event" : {
            "category" : "process"
          }
        },
        "fields" : {
          "event.category.keyword" : [
            "process"
          ],
          "@timestamp" : [
            "1607339167000"
          ],
          "process.name.keyword" : [
            "cmd.exe"
          ]
        }
      }
    ]
  }
}

not in

POST my_index/_doc
{
  "@timestamp": "2020-12-07T11:06:07.000Z",
  "event": {
    "category": "process"
  },
  "process": {
    "name": "cmd.exe"
  }
}

GET my_index/_eql/search
{
  "event_type_field": "event.category",
  "rule": "process where process.name not in (\"foo.exe\")"
}

{
  "took" : 5,
  "timed_out" : false,
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "events" : [
      {
        "_index" : "my_index",
        "_id" : "1BwChnABDtlfLF_OwhVR",
        "_score" : 0.5753642,
        "_source" : {
          "process" : {
            "name" : "cmd.exe"
          },
          "event" : {
            "category" : "process"
          }
        },
        "fields" : {
          "event.category.keyword" : [
            "process"
          ],
          "@timestamp" : [
            "1607339167000"
          ],
          "process.name.keyword" : [
            "cmd.exe"
          ]
        }
      }
    ]
  }
}

[matriv]

LGTM

[jrodewig]

Backport commits

master c6334ee
7.x e46bb54