Skip to content

Commit adc520b

Browse files
committed
[DOCS] Note that EQL timestamp field can also be date_nanos
1 parent f420018 commit adc520b

File tree

2 files changed

+6
-6
lines changed

2 files changed

+6
-6
lines changed

docs/reference/eql/requirements.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ A field containing the event classification, such as `process`, `file`, or
3333

3434
Timestamp::
3535
A field containing the date and/or time the event occurred. This is typically
36-
mapped as a <<date,`date`>> field.
36+
mapped as a <<date,`date`>> or <<date_nanos,`date_nanos`>> field.
3737

3838
[NOTE]
3939
====

docs/reference/eql/search.asciidoc

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -403,8 +403,8 @@ GET /sec_logs/_eql/search
403403
[[eql-search-specify-event-category-field]]
404404
=== Specify an event category field
405405

406-
The EQL search API uses `event.category` as the required
407-
<<eql-required-fields,event category field>> by default. You can use the
406+
By default, the EQL search API uses `event.category` as the
407+
<<eql-required-fields,event category field>>. You can use the
408408
`event_category_field` parameter to specify another event category field.
409409

410410
.*Example*
@@ -429,9 +429,9 @@ GET /sec_logs/_eql/search
429429
[[eql-search-specify-timestamp-field]]
430430
=== Specify a timestamp field
431431

432-
The EQL search API uses `@timestamp` as the required <<eql-required-fields,event
433-
timestamp field>> by default. You can use the `timestamp_field` parameter to
434-
specify another timestamp field.
432+
By default, EQL searches use `@timestamp` as the <<eql-required-fields,event
433+
timestamp field>>. You can use the EQL search API's `timestamp_field` parameter
434+
to specify another timestamp field.
435435

436436
.*Example*
437437
[%collapsible]

0 commit comments

Comments
 (0)