[DOCS] EQL: Document runs keyword#78478
[DOCS] EQL: Document runs keyword#78478jrodewig merged 7 commits intoelastic:7.xfrom jrodewig:docs__eql-runs-keyword
runs keyword#78478Conversation
runs keywordruns keyword
Documents the `runs` keyword for repeating events in a sequence query. Relates to #75082.
|
Pinging @elastic/es-docs (Team:Docs) |
|
Pinging @elastic/es-ql (Team:QL) |
This statement is unclear since it suggests a matching event is going to be repeated in the response, which is not the case. one can write |
|
Thanks for the feedback @costin. I've pushed some changes to clarify the wording based on your feedback. Let me know if any further changes are needed. |
|
LGTM. The only remark is criteria is the plural for criterion so the first paragraph should read: |
|
Thanks @costin!
IMO the event category and event condition(s) are each a criterion. The "criteria" here is a set that consists of those components. It's certainly debatable tho. |
Documents the
runskeyword for running the same event criteria successively in a sequence query.Relates to #75082.
Targeting 7.x to include the release highlight. I'll remove the highlight from the 8.0/master port.
Preview
runskeyword docs: https://elasticsearch_78478.docs-preview.app.elstc.co/guide/en/elasticsearch/reference/7.x/eql-syntax.html#eql-runs-keyword