Skip to content

Commit e74fdac

Browse files
authored
[DOCS] Add admonition for EQL exact matches on text fields (#53402) (#55670)
Adds a important admonition to the EQL syntax page noting that the equal (`==`) operator should not be used to match `text` field values. Relates to #52709 and #53020
1 parent dc89978 commit e74fdac

File tree

1 file changed

+14
-1
lines changed

1 file changed

+14
-1
lines changed

docs/reference/eql/syntax.asciidoc

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ experimental::[]
1010

1111
[IMPORTANT]
1212
====
13-
{es} supports a subset of EQL syntax.
13+
{es} supports a subset of EQL syntax. See <<eql-limitations>>.
1414
====
1515

1616
[discrete]
@@ -72,6 +72,19 @@ You can specify and combine these criteria using the following operators:
7272
< <= == != >= >
7373
----
7474

75+
[IMPORTANT]
76+
====
77+
Avoid using the equal operator (`==`) to perform exact matching on `text` field
78+
values.
79+
80+
By default, {es} changes the values of <<text,`text`>> fields as part of
81+
<<analysis, analysis>>. This can make finding exact matches for `text` field
82+
values difficult.
83+
84+
To search `text` fields, consider using a <<eql-search-filter-query-dsl,query
85+
DSL filter>> that contains a <<query-dsl-match-query,`match`>> query.
86+
====
87+
7588
.*Definitions*
7689
[%collapsible]
7790
====

0 commit comments

Comments
 (0)