@@ -162,13 +162,17 @@ the operator uses a case-sensitive lexicographic order.
162
162
163
163
NOTE: `=` is not supported as an equal operator. Use `==` or `:` instead.
164
164
165
- You cannot chain comparison operators. Instead, use a
165
+ [discrete]
166
+ [[limitations-for-comparisons]]
167
+ === Limitations for comparisons
168
+
169
+ You cannot chain comparisons. Instead, use a
166
170
<<eql-syntax-logical-operators,logical operator>> between comparisons. For
167
171
example, `foo < bar <= baz` is not supported. However, you can rewrite the
168
172
expression as `foo < bar and bar <= baz`, which is supported.
169
173
170
- You also cannot use comparison operators to compare a field to another field.
171
- This applies even if the fields are changed using a <<eql-functions,function>>.
174
+ You also cannot compare a field to another field, even if the fields are changed
175
+ using a <<eql-functions,function>>.
172
176
173
177
*Example* +
174
178
The following EQL query compares the `process.parent_name` field
@@ -217,9 +221,9 @@ Returns `true` if the condition to the right is `false`.
217
221
218
222
[source,eql]
219
223
----
220
- user.name in ("Administrator ", "SYSTEM ", "NETWORK SERVICE")
221
- user.name not in ("Administrator ", "SYSTEM ", "NETWORK SERVICE")
222
- user.name : ("administrator ", "system ", "network service")
224
+ my_field in ("Foo ", "BAR ", "BAZ") // case-sensitive
225
+ my_field not in ("Foo ", "BAR ", "BAZ") // case-sensitive
226
+ my_field : ("foo ", "bar ", "baz") // case-insensitive
223
227
----
224
228
225
229
`in` (case-sensitive)::
@@ -792,7 +796,7 @@ recent sequence overwrites the older one.
792
796
* If the query includes <<eql-by-keyword,`by` fields>>, the query uses a
793
797
separate state machine for each unique `by` field value.
794
798
795
- .*Example*
799
+ .*Example*
796
800
[%collapsible]
797
801
====
798
802
A data set contains the following `process` events in ascending chronological
@@ -1002,5 +1006,4 @@ Pending sequence matches move through each machine's states as follows:
1002
1006
// | +-----------+ +-----------+ +------------+ |
1003
1007
// +------------------------------------------------------+
1004
1008
----
1005
-
1006
1009
====
0 commit comments