[DOCS] EQL: Document match function#56134
[DOCS] EQL: Document match function#56134jrodewig merged 1 commit intoelastic:masterfrom jrodewig:docs__eql-fn-match
match function#56134Conversation
|
Pinging @elastic/es-docs (>docs) |
|
Pinging @elastic/es-ql (:Query Languages/EQL) |
astefan
left a comment
There was a problem hiding this comment.
LGTM. Left one question, up to you if it needs clarification in docs or not. Thanks.
| [[eql-fn-match]] | ||
| === `match` | ||
|
|
||
| Returns `true` if a source string matches one or more provided regular |
There was a problem hiding this comment.
Do we know which regular expression is checked first? I mean, does it matter if it's matching the second or the fourth regular expression?
There was a problem hiding this comment.
I'm not sure it matters from a usage point of view.
The expressions are checked using OR logic so if any of the regular expressions match, the function returns true.
The function also doesn't give any indicator of which expression matched. Only that at least one did.
match("explorer.exe", "[a-z]*?.exe", "[1-9]")
is equivalent to
match("explorer.exe", "[1-9]", "[a-z]*?.exe",)
Relates to #55182 and #55178