Skip to content

Commit 3a5795b

Browse files
committed
Fix eql-syntax.md images
1 parent 4f7f405 commit 3a5795b

File tree

6 files changed

+3
-147
lines changed

6 files changed

+3
-147
lines changed

docs/images/token-graph-dns-invalid-ex.svg

Lines changed: 0 additions & 72 deletions
This file was deleted.

docs/images/token-graph-dns-synonym-ex.svg

Lines changed: 0 additions & 72 deletions
This file was deleted.
-157 KB
Binary file not shown.

docs/reference/query-languages/eql/eql-syntax.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -788,7 +788,7 @@ You cannot use EQL to search the values of a [`nested`](/reference/elasticsearch
788788
* If two pending sequences are in the same state at the same time, the most recent sequence overwrites the older one.
789789
* If the query includes [`by` fields](#eql-by-keyword), the query uses a separate state machine for each unique `by` field value.
790790

791-
:::::{dropdown} **Example**
791+
:::::{dropdown} Example
792792
A data set contains the following `process` events in ascending chronological order:
793793

794794
```js
@@ -831,13 +831,13 @@ The query’s event items correspond to the following states:
831831
* State B: `[process where process.name == "bash"]`
832832
* Complete: `[process where process.name == "cat"]`
833833

834-
:::{image} /images/sequence-state-machine.svg
834+
:::{image} ../images/sequence-state-machine.svg
835835
:alt: sequence state machine
836836
:::
837837

838838
To find matching sequences, the query uses separate state machines for each unique `user.name` value. Based on the data set, you can expect two state machines: one for the `root` user and one for `elkbee`.
839839

840-
:::{image} /images/separate-state-machines.svg
840+
:::{image} ../images/separate-state-machines.svg
841841
:alt: separate state machines
842842
:::
843843

0 commit comments

Comments
 (0)