@@ -2304,6 +2304,8 @@ foo ( bar
2304
2304
;
2305
2305
2306
2306
mvStringEquals
2307
+ required_capability: mv_warn
2308
+
2307
2309
FROM mv_text
2308
2310
| WHERE message == "Connected to 10.1.0.1"
2309
2311
| KEEP @timestamp, message
@@ -2316,6 +2318,8 @@ warning:Line 2:9: java.lang.IllegalArgumentException: single-value function enco
2316
2318
;
2317
2319
2318
2320
mvStringEqualsLongString
2321
+ required_capability: mv_warn
2322
+
2319
2323
FROM mv_text
2320
2324
| WHERE message == "More than one hundred characters long so it isn't indexed by the sub keyword field with ignore_above:100"
2321
2325
| KEEP @timestamp, message
@@ -2328,6 +2332,8 @@ warning:Line 2:9: java.lang.IllegalArgumentException: single-value function enco
2328
2332
;
2329
2333
2330
2334
mvStringNotEquals
2335
+ required_capability: mv_warn
2336
+
2331
2337
FROM mv_text
2332
2338
| WHERE message != "Connected to 10.1.0.2"
2333
2339
| KEEP @timestamp, message
@@ -2342,6 +2348,8 @@ warning:Line 2:9: java.lang.IllegalArgumentException: single-value function enco
2342
2348
;
2343
2349
2344
2350
mvStringNotEqualsFound
2351
+ required_capability: mv_warn
2352
+
2345
2353
FROM mv_text
2346
2354
| WHERE message != "Connected to 10.1.0.1"
2347
2355
| KEEP @timestamp, message
@@ -2354,6 +2362,8 @@ warning:Line 2:9: java.lang.IllegalArgumentException: single-value function enco
2354
2362
;
2355
2363
2356
2364
mvStringNotEqualsLong
2365
+ required_capability: mv_warn
2366
+
2357
2367
FROM mv_text
2358
2368
| WHERE message != "More than one hundred characters long so it isn't indexed by the sub keyword field with ignore_above:100"
2359
2369
| KEEP @timestamp, message
0 commit comments