You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The above issues raised concerns with using floating point for time units.
In a similar note, we should also consider only using known time units in ES (nanos, micros, ms, s, m, h, d).
One question with this is: what do we want the deprecation path to follow for existing EQL in the Endpoint Platform? Since these changes can be made without changing the grammar, we can raise more informative semantic error messages, instead of unhelpful syntax errors. We should catch all things that are no longer valid, and explain why, and what recommended change would help:
Fractions: You entered maxspan=0.5s, but fractional units are no longer supported. Try again with 500ms
Missing units: You entered maxspan=2 and forgot a time unit. Did you mean 2s?
Now invalid units: You entered maxspan=1min. Did you mean 1m?
That's one path we can take as we make necessary changes to the language, and backport them. One other thing to note, is that existing rules are already compiled, so if they make any changes that are no longer valid, they will have to fix before saving.
The text was updated successfully, but these errors were encountered:
Relates to #54597 and #54680
The above issues raised concerns with using floating point for time units.
In a similar note, we should also consider only using known time units in ES (nanos, micros, ms, s, m, h, d).
One question with this is: what do we want the deprecation path to follow for existing EQL in the Endpoint Platform? Since these changes can be made without changing the grammar, we can raise more informative semantic error messages, instead of unhelpful syntax errors. We should catch all things that are no longer valid, and explain why, and what recommended change would help:
That's one path we can take as we make necessary changes to the language, and backport them. One other thing to note, is that existing rules are already compiled, so if they make any changes that are no longer valid, they will have to fix before saving.
The text was updated successfully, but these errors were encountered: