Significant EQL changes in 7.10 #62652
Labels
:Analytics/EQL
EQL querying
>enhancement
Meta
Team:QL (Deprecated)
Meta label for query languages team
This ticket serves as a central place for significant changes in EQL to better broadcast them to a larger group.
To keep things simple, please keep the discussions on each individual ticket.
Proposed grammar changes
Case sensitivity - High impact on semantics / rules
Concluded
==
including that of wildcardsfoo == "*.exe"
. May end up influencing the grammar.Issue: EQL: Remove pattern
== "wild*card"
#62651`
with'
(available - see above) for quoting identifiersIssues: EQL: Replace ` (back-tick) with ' (single quote) #62663 PR: EQL: Replace [`] with ['] for identifiers #62638
?"
and?'
for raw string literal"""
Issue: EQL: Replace ?" and ?' with """ #62645 PR: EQL: Replace ?"..." with """...""" for unescaped strings #62539
== "wild*card"
#62651Issue: EQL: Revisit case insensitivity #61883 and EQL: Remove case_sensitive option #62255
'
for string literal declaration and keep only"
Issue: EQL: changes to strings and regular expressions #61659 PR: EQL: Forbid usage of ['] for string literals #62458
Issue: EQL: ambiguous syntax for chained predicates #61654, PR:EQL: Disallow chained comparisons #62567
=
for equality checks in favor of==
.Issue: EQL: Remove (was Deprecate)
=
in favor of==
for equality checks #62650 PR: EQL: Remove support for=
for comparisons #62756(Edit: @rw-access changed the wording to "Proposed grammar changes" to be more clear)
The text was updated successfully, but these errors were encountered: