You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
EQL has the concept of pipes which run logic on the results of an eql query and can be combined. Regardless of the fact that in some cases the execution of these pipes can be pushed down to the Search API and run as aggregations (this will be addressed in a later issue) we need to implement the logic in the EQL plugin since there are many cases, including any EQL queries using sequence or join where we will not be able to push the evaluation down to the search API.
The pipe operations that need to be implemented are:
count
unique
unique_count
filter
sort
head
tail
The text was updated successfully, but these errors were encountered:
Currently there are no plans to introduce other pipes for 7.11 GA hence why I'm closing the issue.
A new issue should be opened if this topic needs to be revisited.
EQL has the concept of pipes which run logic on the results of an eql query and can be combined. Regardless of the fact that in some cases the execution of these pipes can be pushed down to the Search API and run as aggregations (this will be addressed in a later issue) we need to implement the logic in the EQL plugin since there are many cases, including any EQL queries using sequence or join where we will not be able to push the evaluation down to the search API.
The pipe operations that need to be implemented are:
The text was updated successfully, but these errors were encountered: