@@ -38,7 +38,7 @@ field using the `event_category_field` parameter of the EQL search API.
38
38
39
39
[discrete]
40
40
[[eql-syntax-match-any-event-category]]
41
- ==== Match any event category
41
+ === Match any event category
42
42
43
43
To match events of any category, use the `any` keyword. You can also use the
44
44
`any` keyword to search for documents without a event category field.
@@ -53,7 +53,7 @@ any where network.protocol == "http"
53
53
54
54
[discrete]
55
55
[[eql-syntax-escape-an-event-category]]
56
- ==== Escape an event category
56
+ === Escape an event category
57
57
58
58
Use enclosing double quotes (`"`) or three enclosing double quotes (`"""`) to
59
59
escape event categories that:
@@ -77,7 +77,7 @@ escape event categories that:
77
77
78
78
[discrete]
79
79
[[eql-syntax-escape-a-field-name]]
80
- ==== Escape a field name
80
+ === Escape a field name
81
81
82
82
Use enclosing enclosing backticks (+++`+++) to escape field names that:
83
83
@@ -110,7 +110,7 @@ EQL operators are case-sensitive by default.
110
110
111
111
[discrete]
112
112
[[eql-syntax-comparison-operators]]
113
- ==== Comparison operators
113
+ === Comparison operators
114
114
115
115
[source,eql]
116
116
----
@@ -194,7 +194,7 @@ process where process.parent.name == "foo" and process.name == "foo"
194
194
195
195
[discrete]
196
196
[[eql-syntax-logical-operators]]
197
- ==== Logical operators
197
+ === Logical operators
198
198
199
199
[source,eql]
200
200
----
@@ -214,7 +214,7 @@ Returns `true` if the condition to the right is `false`.
214
214
215
215
[discrete]
216
216
[[eql-syntax-lookup-operators]]
217
- ==== Lookup operators
217
+ === Lookup operators
218
218
219
219
[source,eql]
220
220
----
@@ -232,7 +232,7 @@ matching is case-sensitive.
232
232
233
233
[discrete]
234
234
[[eql-syntax-math-operators]]
235
- ==== Math operators
235
+ === Math operators
236
236
237
237
[source,eql]
238
238
----
@@ -326,7 +326,7 @@ Strings enclosed in single quotes (`'`) are not supported.
326
326
327
327
[discrete]
328
328
[[eql-syntax-escape-characters]]
329
- ==== Escape characters in a string
329
+ === Escape characters in a string
330
330
331
331
When used within a string, special characters, such as a carriage return or
332
332
double quote (`"`), must be escaped with a preceding backslash (`\`).
@@ -352,7 +352,7 @@ double quote (`\"`) instead.
352
352
353
353
[discrete]
354
354
[[eql-syntax-raw-strings]]
355
- ==== Raw strings
355
+ === Raw strings
356
356
357
357
Raw strings treat special characters, such as backslashes (`\`), as literal
358
358
characters. Raw strings are enclosed in three double quotes (`"""`).
0 commit comments