Skip to content

Implement EQL Pipes in EQL Plugin #49627

@colings86

Description

@colings86

EQL has the concept of pipes which run logic on the results of an eql query and can be combined. Regardless of the fact that in some cases the execution of these pipes can be pushed down to the Search API and run as aggregations (this will be addressed in a later issue) we need to implement the logic in the EQL plugin since there are many cases, including any EQL queries using sequence or join where we will not be able to push the evaluation down to the search API.

The pipe operations that need to be implemented are:

  • count
  • unique
  • unique_count
  • filter
  • sort
  • head
  • tail

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions