Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[REQUEST]: EQL event queries allow for partial results #610

Open
dhurley14 opened this issue Feb 26, 2025 · 0 comments
Open

[REQUEST]: EQL event queries allow for partial results #610

dhurley14 opened this issue Feb 26, 2025 · 0 comments
Assignees

Comments

@dhurley14
Copy link

Description

What: EQL event queries will now return partial results if a given shard that otherwise would have been part of the query results is not available. Previously an error would be returned with no hits. Now we can return a list of hits from the available shards and an error message explaining how we allow for partial results. See this PR for more details elastic/kibana#207396
When: This is available in 8.18 and 9.0.
Why: It is now supported by Elasticsearch: elastic/elasticsearch#116388

Resources

This feature was implemented in elastic/kibana#207396

Which documentation set does this change impact?

Elastic On-Prem and Cloud (all)

Feature differences

This feature is identical in all deployments

What release is this request related to?

8.18

Collaboration model

The documentation team

Point of contact.

Main contact: @dhurley14 @yctercero

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants