Skip to content

Commit

Permalink
[8.14] [ESS][8.14] ES|QL rule is GA'ing (backport #5032) (#5172)
Browse files Browse the repository at this point in the history
* [Detection Engine] removes tech preview from ES|QL rule type

* Removing additional preview labels

* Removes note about FF

* Re-adding Timeline content

Keeping this PR to rule-related changes only

* Moving para to correct place

---------

Co-authored-by: nastasha.solomon <[email protected]>
Co-authored-by: Nastasha Solomon <[email protected]>
(cherry picked from commit 2a33b91)

Co-authored-by: Vitalii Dmyterko <[email protected]>
  • Loading branch information
mergify[bot] and vitaliidm authored May 6, 2024
1 parent 75725d3 commit aee090a
Show file tree
Hide file tree
Showing 3 changed files with 0 additions and 6 deletions.
2 changes: 0 additions & 2 deletions docs/detections/about-rules.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,6 @@ TIP: You can also use value lists as the indicator match index. See <<indicator-
* <<create-new-terms-rule, *New terms*>>: Generates an alert for each new term detected in source documents within a specified time range. You can also detect a combination of up to three new terms (for example, a `host.ip` and `host.id` that have never been observed together before).

* <<create-esql-rule, *ES|QL*>>: Searches the defined indices and creates an alert when results match an {ref}/esql.html[Elasticsearch Query Language (ES|QL)] query.
+
preview::["Do not use {esql} on production environments. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."]

[role="screenshot"]
image::images/all-rules.png[Shows the Rules page]
Expand Down
2 changes: 0 additions & 2 deletions docs/detections/api/rules/rules-api-create.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,6 @@ an event's `destination.ip` equals a value in the index. The index's field
mappings should be {ecs-ref}[ECS-compliant].
* *New terms*: Generates an alert for each new term detected in source documents within a specified time range.
* *{esql}*: Uses {ref}/esql.html[Elasticsearch Query Language ({esql})] to find events and aggregate search results.
+
preview::["Do not use {esql} on production environments. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."]
* *{ml-cap} rules*: Creates an alert when a {ml} job discovers an anomaly above
the defined threshold (see <<machine-learning>>).

Expand Down
2 changes: 0 additions & 2 deletions docs/detections/rules-ui-create.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -266,8 +266,6 @@ For example, if a rule has an interval of 5 minutes, no additional look-back tim
[[create-esql-rule]]
=== Create an {esql} rule

preview::["Do not use {esql} on production environments. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."]

Use {ref}/esql.html[{esql}] to query your source events and aggregate event data. Query results are returned in a table with rows and columns. Each row becomes an alert.

To create an {esql} rule:
Expand Down

0 comments on commit aee090a

Please sign in to comment.