From c3b67b844c4713634c705c3bca533c27063f5778 Mon Sep 17 00:00:00 2001 From: James Rodewig <40268737+jrodewig@users.noreply.github.com> Date: Wed, 12 May 2021 10:22:37 -0400 Subject: [PATCH] [DOCS] EQL: Note CCS is not supported (#72975) (#72980) --- docs/reference/eql/syntax.asciidoc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc index 0e37408d4ec89..d9f72302063eb 100644 --- a/docs/reference/eql/syntax.asciidoc +++ b/docs/reference/eql/syntax.asciidoc @@ -826,6 +826,13 @@ You cannot use EQL to search the values of a <> field or the sub-fields of a `nested` field. However, data streams and indices containing `nested` field mappings are otherwise supported. +[discrete] +[[eql-ccs-support]] +==== {ccs-cap} is not supported + +EQL search APIs do not support <>. + [discrete] [[eql-unsupported-syntax]] ==== Differences from Endgame EQL syntax