Skip to content

Commit a63fee0

Browse files
authored
[DOCS] EQL: Clarify support for text fields (#69229) (#69245)
1 parent 5b5dd9e commit a63fee0

File tree

1 file changed

+8
-13
lines changed

1 file changed

+8
-13
lines changed

docs/reference/eql/syntax.asciidoc

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -133,19 +133,6 @@ Otherwise returns `false`. Can only be used to compare strings. Supports
133133
<<eql-syntax-wildcards,wildcards>> and <<eql-syntax-lookup-operators,list
134134
lookups>>.
135135

136-
[IMPORTANT]
137-
====
138-
Avoid using the `==` or `:` operators to perform exact matching on
139-
<<text,`text`>> field values.
140-
141-
By default, {es} changes the values of `text` fields as part of <<analysis,
142-
analysis>>. This can make finding exact matches for `text` field values
143-
difficult.
144-
145-
To search `text` fields, consider using a <<eql-search-filter-query-dsl,query
146-
DSL filter>> that contains a <<query-dsl-match-query,`match`>> query.
147-
====
148-
149136
`!=` (not equal, case-sensitive)::
150137
Returns `true` if the values to the left and right of the operator are not
151138
equal. Otherwise returns `false`. Wildcards are not supported.
@@ -718,6 +705,14 @@ You cannot use EQL comparison operators to compare a field to
718705
another field. This applies even if the fields are changed using a
719706
<<eql-functions,function>>.
720707

708+
[discrete]
709+
[[eql-text-fields]]
710+
==== Text fields are not supported
711+
712+
EQL searches do not support <<text,`text`>> fields. To a search a `text` field,
713+
use the EQL search API's <<eql-search-filter-query-dsl,Query DSL `filter`>>
714+
parameter.
715+
721716
[discrete]
722717
[[eql-array-fields]]
723718
==== Array field values are not supported

0 commit comments

Comments
 (0)