[DOCS] EQL: Document length function

docs/reference/eql/functions.asciidoc

@@ -8,8 +8,50 @@ experimental::[]
 
 {es} supports the following EQL functions:
 
+* <<eql-fn-length>>
 * <<eql-fn-substring>>
 
+[discrete]
+[[eql-fn-length]]
+=== `length`
+
+Returns the character length of a provided string, including whitespace and
+punctuation.
+
+[%collapsible]
+====
+*Example*
+[source,eql]
+----
+length("explorer.exe")         // returns 12
+length("start explorer.exe")   // returns 18
+length("")                     // returns 0
+length(null)                   // returns null
+
+// process.name = "regsvr32.exe"
+length(process.name)           // returns 12
+----
+
+*Syntax*
+[source,txt]
+----
+length(<string>)
+----
+
+*Parameters*
+
+`<string>`::
+(Required, string or `null`)
+String for which to return the character length. If `null`, the function returns
+`null`. Empty strings return `0`.
++
+If using a field as the argument, this parameter only supports the
+<<keyword,`keyword`>> and <<constant-keyword,`constant_keyword`>> field
+datatypes. <<array,Array values>> are not supported.
+
+*Returns:* integer or `null`
+====
+
 [discrete]
 [[eql-fn-substring]]
 === `substring`