Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[7.11] [DOCS] EQL: Add security privileges to EQL search docs (#68017) #68081

Merged
merged 1 commit into from
Jan 27, 2021
Merged

[7.11] [DOCS] EQL: Add security privileges to EQL search docs (#68017) #68081

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion docs/reference/eql/delete-async-eql-search-api.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,10 @@ DELETE /_eql/search/FkpMRkJGS1gzVDRlM3g4ZzMyRGlLbkEaTXlJZHdNT09TU2VTZVBoNDM3cFZM
[[delete-async-eql-search-api-prereqs]]
==== {api-prereq-title}

See <<eql-required-fields>>.
* If the {es} {security-features} are enabled, only the user who first submitted
the EQL search can delete the search using this API.

* See <<eql-required-fields>>.

[[delete-async-eql-search-api-limitations]]
===== Limitations
Expand Down
6 changes: 5 additions & 1 deletion docs/reference/eql/eql-search-api.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,11 @@ GET /my-index-000001/_eql/search
[[eql-search-api-prereqs]]
==== {api-prereq-title}

See <<eql-required-fields>>.
* If the {es} {security-features} are enabled, you must have the `read`
<<privileges-list-indices,index privilege>> for the target data stream, index,
or index alias.

* See <<eql-required-fields>>.

[[eql-search-api-limitations]]
===== Limitations
Expand Down
14 changes: 10 additions & 4 deletions docs/reference/eql/eql.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,10 @@ default.
[[run-an-eql-search]]
== Run an EQL search

Use the <<eql-search-api,EQL search API>> to run a <<eql-basic-syntax,basic
EQL query>>:
Use the <<eql-search-api,EQL search API>> to run a <<eql-basic-syntax,basic EQL
query>>. If the {es} {security-features} are enabled, you must have the `read`
<<privileges-list-indices,index privilege>> for the target data stream, index,
or index alias.

[source,console]
----
Expand Down Expand Up @@ -493,7 +495,9 @@ requests.

To check the progress of an async search, use the <<get-async-eql-search-api,get
async EQL search API>> with the search ID. Specify how long you'd like for
complete results in the `wait_for_completion_timeout` parameter.
complete results in the `wait_for_completion_timeout` parameter. If the {es}
{security-features} are enabled, only the user who first submitted the EQL
search can retrieve the search using this API.

[source,console]
----
Expand Down Expand Up @@ -553,7 +557,9 @@ GET /_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTo

Use the <<delete-async-eql-search-api,delete async EQL search API>> to
manually delete an async EQL search before the `keep_alive` period ends. If the
search is still ongoing, {es} cancels the search request.
search is still ongoing, {es} cancels the search request. If the {es}
{security-features} are enabled, only the user who first submitted the EQL
search can delete the search using this API.

[source,console]
----
Expand Down
5 changes: 4 additions & 1 deletion docs/reference/eql/get-async-eql-search-api.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,10 @@ GET /_eql/search/FkpMRkJGS1gzVDRlM3g4ZzMyRGlLbkEaTXlJZHdNT09TU2VTZVBoNDM3cFZMUTo
[[get-async-eql-search-api-prereqs]]
==== {api-prereq-title}

See <<eql-required-fields>>.
* If the {es} {security-features} are enabled, only the user who first submitted
the EQL search can retrieve the search using this API.

* See <<eql-required-fields>>.

[[get-async-eql-search-api-limitations]]
===== Limitations
Expand Down