diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc index 4ecd705d31ecf..f14b9feae5c30 100644 --- a/docs/reference/eql/syntax.asciidoc +++ b/docs/reference/eql/syntax.asciidoc @@ -250,14 +250,15 @@ process where ( 4.0 / process.args_count ) == 1 [[eql-syntax-strings]] ==== Strings -Strings are enclosed with double quotes (`"`) or single quotes (`'`). +Strings are enclosed with double quotes (`"`). [source,eql] ---- "hello world" -"hello world with 'substring'" ---- +Strings enclosed in single quotes (`'`) are not supported. + [discrete] [[eql-syntax-wildcards]] ===== Wildcards @@ -315,10 +316,13 @@ double quote (`"`), must be escaped with a preceding backslash (`\`). |`\t` | A tab character |`\\` | A backslash (`\`) character |`\"` | A double quote (`"`) character -|`\'` | A single quote (`'`) character |==== ==== +IMPORTANT: The single quote (`'`) character is reserved for future use. You +cannot use an escaped single quote (`\'`) for literal strings. Use an escaped +double quote (`\"`) instead. + [discrete] [[eql-syntax-raw-strings]] ===== Raw strings @@ -328,11 +332,11 @@ literal characters. [source,eql] ---- -?"String with a literal 'blackslash' \ character included" +?"String with a literal blackslash \ character included" ---- -You can escape single quotes (`'`) and double quotes (`"`) with a backslash, but -the backslash remains in the resulting string. +You can escape double quotes (`"`) with a backslash, but the backslash remains +in the resulting string. [source,eql] ---- @@ -670,6 +674,17 @@ You cannot use EQL to search the values of a <> field or the sub-fields of a `nested` field. However, data streams and indices containing `nested` field mappings are otherwise supported. +[discrete] +[[single-quote-strings]] +==== Single quote strings + +In {es} EQL, the single quote (`'`) character is reserved for future use. +Strings enclosed in single quotes are not supported. Enclose strings in +double quotes (`"`) instead. + +You cannot use an escaped single quote (`\'`) for literal strings. Use an +escaped double quote (`\"`) instead. + [discrete] [[eql-unsupported-syntax]] ==== Unsupported syntax