Convert eql and ccr examples

lcawl · lcawl · commit 877733b53d7f · 2025-01-07T12:23:18.000-08:00
diff --git a/docs/overlays/elasticsearch-openapi-overlays.yaml b/docs/overlays/elasticsearch-openapi-overlays.yaml
@@ -106,7 +106,7 @@ actions:
           application/json: 
             examples: 
               clusterPutSettingsRequestExample1: 
-                $ref: "../../specification/cluster/put_settings/clusterPutSettingsRequestExample1.json"
+                $ref: "../../specification/cluster/put_settings/examples/request/ClusterPutSettingsRequestExample1.yaml"
   - target: "$.paths['/_cluster/reroute']['post']"
     description: "Add examples for cluster reroute operation"
     update: 
@@ -115,7 +115,7 @@ actions:
           application/json: 
             examples: 
               clusterRerouteRequestExample1: 
-                $ref: "../../specification/cluster/reroute/clusterRerouteRequestExample1.json"
+                $ref: "../../specification/cluster/reroute/examples/request/ClusterRerouteRequestExample1.yaml"
   - target: "$.components['requestBodies']['nodes.reload_secure_settings']"
     description: "Add examples for nodes reload secure settings operation"
     update: 
diff --git a/docs/overlays/elasticsearch-shared-overlays.yaml b/docs/overlays/elasticsearch-shared-overlays.yaml
@@ -1153,17 +1153,17 @@ actions:
         application/json: 
           examples: 
             eqlSearchRequestExample1: 
-              $ref: "../../specification/eql/search/EqlSearchRequestExample1.json"
+              $ref: "../../specification/eql/search/examples/request/EqlSearchRequestExample1.yaml"
             eqlSearchRequestExample2: 
-              $ref: "../../specification/eql/search/EqlSearchRequestExample2.json"
+              $ref: "../../specification/eql/search/examples/request/EqlSearchRequestExample2.yaml"
   - target: "$.components['reponses']['eql.search#200']"
     description: "Add examples for EQL search operation"
     update: 
       content:
         application/json:
           examples:
             eqlSearchResponseExample2:
-              $ref: "../../specification/eql/search/EqlSearchResponseExample2.json"
+              $ref: "../../specification/eql/search/examples/response/EqlSearchResponseExample2.yaml"
   - target: "$.paths['/_query']['post']"
     description: "Add examples for ES|QL query operation"
     update: 
diff --git a/specification/async_search/submit/examples/response/AsyncSearchSubmitResponseExample1.yaml b/specification/async_search/submit/examples/response/AsyncSearchSubmitResponseExample1.yaml
@@ -1,4 +1,4 @@
-# summary: 
+# summary:
 description: A successful response when performing search asynchronously.
 # type: "response"
 # response_code: 200
diff --git a/specification/ccr/follow/examples/response/CreateFollowIndexResponseExample1.yaml b/specification/ccr/follow/examples/response/CreateFollowIndexResponseExample1.yaml
@@ -1,7 +1,7 @@
 {
-  "summary": "A successful response for creating a follower index.",
-  "description": "",
-  "type": "response",
-  "response_code": 200,
-  "value": "{\n  \"follow_index_created\" : true,\n  \"follow_index_shards_acked\" : true,\n  \"index_following_started\" : true\n}"
+  'summary': 'A successful response for creating a follower index.',
+  'description': '',
+  'type': 'response',
+  'response_code': 200,
+  'value': "{\n  \"follow_index_created\" : true,\n  \"follow_index_shards_acked\" : true,\n  \"index_following_started\" : true\n}"
 }
diff --git a/specification/ccr/forget_follower/examples/response/ForgetFollowerIndexResponseExample1.yaml b/specification/ccr/forget_follower/examples/response/ForgetFollowerIndexResponseExample1.yaml
@@ -1,4 +1,4 @@
-summary: 
+summary:
 description: >
   A successful response for removing the follower retention leases from the leader index.
 # type: "response"
diff --git a/specification/ccr/put_auto_follow_pattern/examples/request/PutAutoFollowPatternRequestExample1.yaml b/specification/ccr/put_auto_follow_pattern/examples/request/PutAutoFollowPatternRequestExample1.yaml
@@ -3,4 +3,4 @@
 description: >
   Run `PUT /_ccr/auto_follow/my_auto_follow_pattern` to creates an auto-follow pattern.
 # type: "request"
-value: "{\n  \"remote_cluster\" : \"remote_cluster\",\n  \"leader_index_patterns\" :\n  [\n    \"leader_index*\"\n  ],\n  \"follow_index_pattern\" : \"{{leader_index}}-follower\",\n  \"settings\": {\n    \"index.number_of_replicas\": 0\n  },\n  \"max_read_request_operation_count\" : 1024,\n  \"max_outstanding_read_requests\" : 16,\n  \"max_read_request_size\" : \"1024k\",\n  \"max_write_request_operation_count\" : 32768,\n  \"max_write_request_size\" : \"16k\",\n  \"max_outstanding_write_requests\" : 8,\n  \"max_write_buffer_count\" : 512,\n  \"max_write_buffer_size\" : \"512k\",\n  \"max_retry_delay\" : \"10s\",\n  \"read_poll_timeout\" : \"30s\"\n}"
+value: "{\n  \"remote_cluster\" : \"remote_cluster\",\n  \"leader_index_patterns\" :\n  [\n    \"leader_index*\"\n  ],\n  \"follow_index_pattern\" : \"{{leader_index}}-follower\",\n  \"settings\": {\n    \"index.number_of_replicas\": 0\n  },\n  \"max_read_request_operation_count\" : 1024,\n  \"max_outstanding_read_requests\" : 16,\n  \"max_read_request_size\" : \"1024k\",\n  \"max_write_request_operation_count\" : 32768,\n  \"max_write_request_size\" : \"16k\",\n  \"max_outstanding_write_requests\" : 8,\n  \"max_write_buffer_count\" : 512,\n  \"max_write_buffer_size\" : \"512k\",\n  \"max_retry_delay\" : \"10s\",\n  \"read_poll_timeout\" : \"30s\"\n}"
diff --git a/specification/ccr/put_auto_follow_pattern/examples/response/PutAutoFollowPatternResponseExample1.yaml b/specification/ccr/put_auto_follow_pattern/examples/response/PutAutoFollowPatternResponseExample1.yaml
@@ -1,5 +1,6 @@
-# summary: 
+# summary: ''
 description: A successful response for creating an auto-follow pattern.
-# type: "response"
+# type: response
 # response_code: 200
-value: "{\n  \"acknowledged\" : true\n}""
+value:
+  acknowledged": true
diff --git a/specification/ccr/resume_follow/examples/request/ResumeFollowIndexRequestExample1.yaml b/specification/ccr/resume_follow/examples/request/ResumeFollowIndexRequestExample1.yaml
@@ -1,17 +1,17 @@
-# summary: 
+# summary:
 # method_request: POST /follower_index/_ccr/resume_follow
 description: Run `POST /follower_index/_ccr/resume_follow` to resume the follower index.
 # type: request
 value: |-
-    {
-      "max_read_request_operation_count" : 1024,
-      "max_outstanding_read_requests" : 16,
-      "max_read_request_size" : "1024k",
-      "max_write_request_operation_count" : 32768,
-      "max_write_request_size" : "16k",
-      "max_outstanding_write_requests" : 8,
-      "max_write_buffer_count" : 512,
-      "max_write_buffer_size" : "512k",
-      "max_retry_delay" : "10s",
-      "read_poll_timeout" : "30s"
-    }
+  {
+    "max_read_request_operation_count" : 1024,
+    "max_outstanding_read_requests" : 16,
+    "max_read_request_size" : "1024k",
+    "max_write_request_operation_count" : 32768,
+    "max_write_request_size" : "16k",
+    "max_outstanding_write_requests" : 8,
+    "max_write_buffer_count" : 512,
+    "max_write_buffer_size" : "512k",
+    "max_retry_delay" : "10s",
+    "read_poll_timeout" : "30s"
+  }
diff --git a/specification/ccr/resume_follow/examples/response/ResumeFollowIndexResponseExample1.yaml b/specification/ccr/resume_follow/examples/response/ResumeFollowIndexResponseExample1.yaml
@@ -1,8 +1,8 @@
-# summary: 
+# summary:
 description: A successful response from resuming a folower index.
 # type: response
 # response_code: 200
 value: |-
-    {
-      "acknowledged" : true
-    }
+  {
+    "acknowledged" : true
+  }
diff --git a/specification/cluster/allocation_explain/examples/request/ClusterAllocationExplainRequestExample1.yaml b/specification/cluster/allocation_explain/examples/request/ClusterAllocationExplainRequestExample1.yaml
@@ -1,11 +1,11 @@
-# summary: 
+# summary:
 # method_request: GET _cluster/allocation/explain
 description: Run `GET _cluster/allocation/explain` to get an explanation for a shard's current allocation.
 # type: request
 value: |-
-    {
-      "index": "my-index-000001",
-      "shard": 0,
-      "primary": false,
-      "current_node": "my-node"
-    }
+  {
+    "index": "my-index-000001",
+    "shard": 0,
+    "primary": false,
+    "current_node": "my-node"
+  }
diff --git a/specification/cluster/put_settings/clusterPutSettingsRequestExample1.json b/specification/cluster/put_settings/clusterPutSettingsRequestExample1.json
diff --git a/specification/cluster/put_settings/examples/request/ClusterPutSettingsRequestExample1.yaml b/specification/cluster/put_settings/examples/request/ClusterPutSettingsRequestExample1.yaml
@@ -0,0 +1,10 @@
+# summary:
+# method_request: PUT /_cluster/settings
+description: An example of a persistent update.
+# type: request
+value: |-
+  {
+    "persistent" : {
+      "indices.recovery.max_bytes_per_sec" : "50mb"
+    }
+  }
diff --git a/specification/cluster/reroute/clusterRerouteRequestExample1.json b/specification/cluster/reroute/clusterRerouteRequestExample1.json
diff --git a/specification/cluster/reroute/examples/request/ClusterRerouteRequestExample1.yaml b/specification/cluster/reroute/examples/request/ClusterRerouteRequestExample1.yaml
@@ -0,0 +1,21 @@
+# summary:
+# method_request: POST /_cluster/reroute?metric=none
+description: Run `POST /_cluster/reroute?metric=none` to changes the allocation of shards in a cluster.
+# type: request
+value: |-
+  {
+    "commands": [
+      {
+        "move": {
+          "index": "test", "shard": 0,
+          "from_node": "node1", "to_node": "node2"
+        }
+      },
+      {
+        "allocate_replica": {
+          "index": "test", "shard": 1,
+          "node": "node3"
+        }
+      }
+    ]
+  }
diff --git a/specification/eql/search/EqlSearchRequestExample1.json b/specification/eql/search/EqlSearchRequestExample1.json
diff --git a/specification/eql/search/EqlSearchRequestExample2.json b/specification/eql/search/EqlSearchRequestExample2.json
diff --git a/specification/eql/search/examples/request/EqlSearchRequestExample1.yaml b/specification/eql/search/examples/request/EqlSearchRequestExample1.yaml
@@ -0,0 +1,11 @@
+summary: Basic query
+# method_request: GET /my-data-stream/_eql/search
+description: >
+  Run `GET /my-data-stream/_eql/search` to search for events that have a `process.name` of `cmd.exe` and a  `process.pid` other than `2013`.
+# type: request
+value: |-
+  {
+    "query": """
+      process where (process.name == "cmd.exe" and process.pid != 2013)
+    """
+  }
diff --git a/specification/eql/search/examples/request/EqlSearchRequestExample2.yaml b/specification/eql/search/examples/request/EqlSearchRequestExample2.yaml
@@ -0,0 +1,16 @@
+summary: Sequence query
+# method_request: GET /my-data-stream/_eql/search
+description: >
+  Run `GET /my-data-stream/_eql/search` to search for a sequence of events.
+  The sequence starts with an event with an `event.category` of `file`, a `file.name` of `cmd.exe`, and a `process.pid` other than `2013`.
+  It is followed by an event with an `event.category` of `process` and a `process.executable` that contains the substring `regsvr32`.
+  These events must also share the same `process.pid` value.
+# type: request
+value: |-
+  {
+    "query": """
+      sequence by process.pid
+        [ file where file.name == "cmd.exe" and process.pid != 2013 ]
+        [ process where stringContains(process.executable, "regsvr32") ]
+    """
+  }
diff --git a/specification/eql/search/examples/response/EqlSearchResponseExample2.yaml b/specification/eql/search/examples/response/EqlSearchResponseExample2.yaml
@@ -1,7 +1,7 @@
 {
-  "summary": "A successful response for performing search with an EQL query.",
-  "description": "",
-  "type": "response",
-  "response_code": 200,
-  "value": "{\n  \"is_partial\": false,\n  \"is_running\": false,\n  \"took\": 6,\n  \"timed_out\": false,\n  \"hits\": {\n    \"total\": {\n      \"value\": 1,\n      \"relation\": \"eq\"\n    },\n    \"sequences\": [\n      {\n        \"join_keys\": [\n          2012\n        ],\n        \"events\": [\n          {\n            \"_index\": \".ds-my-data-stream-2099.12.07-000001\",\n            \"_id\": \"AtOJ4UjUBAAx3XR5kcCM\",\n            \"_source\": {\n              \"@timestamp\": \"2099-12-06T11:04:07.000Z\",\n              \"event\": {\n                \"category\": \"file\",\n                \"id\": \"dGCHwoeS\",\n                \"sequence\": 2\n              },\n              \"file\": {\n                \"accessed\": \"2099-12-07T11:07:08.000Z\",\n                \"name\": \"cmd.exe\",\n                \"path\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n                \"type\": \"file\",\n                \"size\": 16384\n              },\n              \"process\": {\n                \"pid\": 2012,\n                \"name\": \"cmd.exe\",\n                \"executable\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\"\n              }\n            }\n          },\n          {\n            \"_index\": \".ds-my-data-stream-2099.12.07-000001\",\n            \"_id\": \"OQmfCaduce8zoHT93o4H\",\n            \"_source\": {\n              \"@timestamp\": \"2099-12-07T11:07:09.000Z\",\n              \"event\": {\n                \"category\": \"process\",\n                \"id\": \"aR3NWVOs\",\n                \"sequence\": 4\n              },\n              \"process\": {\n                \"pid\": 2012,\n                \"name\": \"regsvr32.exe\",\n                \"command_line\": \"regsvr32.exe  /s /u /i:https://...RegSvr32.sct scrobj.dll\",\n                \"executable\": \"C:\\\\Windows\\\\System32\\\\regsvr32.exe\"\n              }\n            }\n          }\n        ]\n      }\n    ]\n  }\n}"
+  'summary': 'A successful response for performing search with an EQL query.',
+  'description': '',
+  'type': 'response',
+  'response_code': 200,
+  'value': "{\n  \"is_partial\": false,\n  \"is_running\": false,\n  \"took\": 6,\n  \"timed_out\": false,\n  \"hits\": {\n    \"total\": {\n      \"value\": 1,\n      \"relation\": \"eq\"\n    },\n    \"sequences\": [\n      {\n        \"join_keys\": [\n          2012\n        ],\n        \"events\": [\n          {\n            \"_index\": \".ds-my-data-stream-2099.12.07-000001\",\n            \"_id\": \"AtOJ4UjUBAAx3XR5kcCM\",\n            \"_source\": {\n              \"@timestamp\": \"2099-12-06T11:04:07.000Z\",\n              \"event\": {\n                \"category\": \"file\",\n                \"id\": \"dGCHwoeS\",\n                \"sequence\": 2\n              },\n              \"file\": {\n                \"accessed\": \"2099-12-07T11:07:08.000Z\",\n                \"name\": \"cmd.exe\",\n                \"path\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n                \"type\": \"file\",\n                \"size\": 16384\n              },\n              \"process\": {\n                \"pid\": 2012,\n                \"name\": \"cmd.exe\",\n                \"executable\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\"\n              }\n            }\n          },\n          {\n            \"_index\": \".ds-my-data-stream-2099.12.07-000001\",\n            \"_id\": \"OQmfCaduce8zoHT93o4H\",\n            \"_source\": {\n              \"@timestamp\": \"2099-12-07T11:07:09.000Z\",\n              \"event\": {\n                \"category\": \"process\",\n                \"id\": \"aR3NWVOs\",\n                \"sequence\": 4\n              },\n              \"process\": {\n                \"pid\": 2012,\n                \"name\": \"regsvr32.exe\",\n                \"command_line\": \"regsvr32.exe  /s /u /i:https://...RegSvr32.sct scrobj.dll\",\n                \"executable\": \"C:\\\\Windows\\\\System32\\\\regsvr32.exe\"\n              }\n            }\n          }\n        ]\n      }\n    ]\n  }\n}"
 }

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-# summary:`
	`1`	`+# summary:`
`2`	`2`	`description: A successful response when performing search asynchronously.`
`3`	`3`	`# type: "response"`
`4`	`4`	`# response_code: 200`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`		`- "summary": "A successful response for creating a follower index.",`
`3`		`- "description": "",`
`4`		`- "type": "response",`
`5`		`- "response_code": 200,`
`6`		`- "value": "{\n \"follow_index_created\" : true,\n \"follow_index_shards_acked\" : true,\n \"index_following_started\" : true\n}"`
	`2`	`+ 'summary': 'A successful response for creating a follower index.',`
	`3`	`+ 'description': '',`
	`4`	`+ 'type': 'response',`
	`5`	`+ 'response_code': 200,`
	`6`	`+ 'value': "{\n \"follow_index_created\" : true,\n \"follow_index_shards_acked\" : true,\n \"index_following_started\" : true\n}"`
`7`	`7`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-summary:`
	`1`	`+summary:`
`2`	`2`	`description: >`
`3`	`3`	`A successful response for removing the follower retention leases from the leader index.`
`4`	`4`	`# type: "response"`