You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
While doing performance testing, we discovered some cases where the mapping caused case sensitive/insensitive queries to fail. Due to the large volume of work it is unclear what failed - maybe it was a mapping issue, maybe a bug in how the queries get generated.
In the future, it would be useful to see whether we can validate such cases so instead of the query failing silently, we can verify that we can properly execute it.
Currently Equals & NotEquals doesn't seem to take into account the case insensitivity (unless I'm missing something), so while python will match events with case INsensitivity when using something like myField = 'vaLUe' (provided that caseInsensitive flag is correctly set), ES EQL will always be case sensitive.
If we want to match in a case insensitive manner we have to lowercase the field -> painless -> slower queries.
While doing performance testing, we discovered some cases where the mapping caused case sensitive/insensitive queries to fail. Due to the large volume of work it is unclear what failed - maybe it was a mapping issue, maybe a bug in how the queries get generated.
In the future, it would be useful to see whether we can validate such cases so instead of the query failing silently, we can verify that we can properly execute it.
/cc @matriv
The text was updated successfully, but these errors were encountered: