From 548c0b04f9d3f68a675ba0a4a9c213e1e1ff06f0 Mon Sep 17 00:00:00 2001
From: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Date: Mon, 22 Mar 2021 16:51:59 -0400
Subject: [PATCH 1/6] [DOCS] EQL: Document Unicode escape sequences

---
 docs/reference/eql/syntax.asciidoc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc
index 0eef53edea6e3..0b36ae46eb45c 100644
--- a/docs/reference/eql/syntax.asciidoc
+++ b/docs/reference/eql/syntax.asciidoc
@@ -410,6 +410,13 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
 |`\"`             | Double quote (`"`)
 |====
 
+You can escape Unicode characters using a 4-character `\uXXXX` or
+variable-length `\u{XXXXXXXX}` escape sequence. You can use these escape
+sequences to include non-printable or right-to-left (RTL) characters in your
+strings. For example, you can escape a
+{wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as `\u200F` or
+`\u{200F}`.
+
 IMPORTANT: The single quote (`'`) character is reserved for future use. You
 cannot use an escaped single quote (`\'`) for literal strings. Use an escaped
 double quote (`\"`) instead.

From dfc635e67687f89444b9c87dce989117edba281f Mon Sep 17 00:00:00 2001
From: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Date: Mon, 22 Mar 2021 20:50:50 -0400
Subject: [PATCH 2/6] Apply suggestions from code review

Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
---
 docs/reference/eql/syntax.asciidoc | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc
index 0b36ae46eb45c..7d68663698b34 100644
--- a/docs/reference/eql/syntax.asciidoc
+++ b/docs/reference/eql/syntax.asciidoc
@@ -410,12 +410,10 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
 |`\"`             | Double quote (`"`)
 |====
 
-You can escape Unicode characters using a 4-character `\uXXXX` or
-variable-length `\u{XXXXXXXX}` escape sequence. You can use these escape
+You can escape Unicode characters using a `\u{XXXXXXXX}` escape sequence. You can use these escape
 sequences to include non-printable or right-to-left (RTL) characters in your
 strings. For example, you can escape a
-{wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as `\u200F` or
-`\u{200F}`.
+{wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as `\u{200F}`.
 
 IMPORTANT: The single quote (`'`) character is reserved for future use. You
 cannot use an escaped single quote (`\'`) for literal strings. Use an escaped

From 13d6802ae36ab320943953c250f4459d34534d5e Mon Sep 17 00:00:00 2001
From: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Date: Mon, 22 Mar 2021 20:58:30 -0400
Subject: [PATCH 3/6] Rework

---
 docs/reference/eql/syntax.asciidoc | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc
index 7d68663698b34..edb5ad18b0335 100644
--- a/docs/reference/eql/syntax.asciidoc
+++ b/docs/reference/eql/syntax.asciidoc
@@ -410,10 +410,11 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
 |`\"`             | Double quote (`"`)
 |====
 
-You can escape Unicode characters using a `\u{XXXXXXXX}` escape sequence. You can use these escape
-sequences to include non-printable or right-to-left (RTL) characters in your
-strings. For example, you can escape a
-{wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as `\u{200F}`.
+You can escape Unicode characters using a `\u{XXXXXXXX}` case-insensitive
+hexadecimal escape sequence. You can use these escape sequences to include
+non-printable or right-to-left (RTL) characters in your strings. For example,
+you can escape a {wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as
+`\u{200f}`, `\u{200F}`, or `\u{0000200f}`.
 
 IMPORTANT: The single quote (`'`) character is reserved for future use. You
 cannot use an escaped single quote (`\'`) for literal strings. Use an escaped

From 7d9bffceb01e2475cfcc17d88e3e6c5308de0559 Mon Sep 17 00:00:00 2001
From: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Date: Mon, 22 Mar 2021 21:20:32 -0400
Subject: [PATCH 4/6] Rework

---
 docs/reference/eql/syntax.asciidoc | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc
index edb5ad18b0335..e6a99e9756ad5 100644
--- a/docs/reference/eql/syntax.asciidoc
+++ b/docs/reference/eql/syntax.asciidoc
@@ -410,11 +410,12 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
 |`\"`             | Double quote (`"`)
 |====
 
-You can escape Unicode characters using a `\u{XXXXXXXX}` case-insensitive
-hexadecimal escape sequence. You can use these escape sequences to include
-non-printable or right-to-left (RTL) characters in your strings. For example,
-you can escape a {wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as
-`\u{200f}`, `\u{200F}`, or `\u{0000200f}`.
+You can escape Unicode characters using a case-insensitive hexadecimal
+`\u{XXXXXXXX}` escape sequence. You can use these escape sequences to include
+non-printable or right-to-left (RTL) characters in your strings. Hexadecimal
+values shorter than 8 characters are zero-padded. For example, you can escape a
+{wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as `\u{200f}`,
+`\u{200F}`, or `\u{0000200f}`.
 
 IMPORTANT: The single quote (`'`) character is reserved for future use. You
 cannot use an escaped single quote (`\'`) for literal strings. Use an escaped

From 7e4dc6aae3c5531064773f994b7715988f15b66f Mon Sep 17 00:00:00 2001
From: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Date: Mon, 22 Mar 2021 21:21:34 -0400
Subject: [PATCH 5/6] Reorder

---
 docs/reference/eql/syntax.asciidoc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc
index e6a99e9756ad5..366b0f4663dbd 100644
--- a/docs/reference/eql/syntax.asciidoc
+++ b/docs/reference/eql/syntax.asciidoc
@@ -411,9 +411,9 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
 |====
 
 You can escape Unicode characters using a case-insensitive hexadecimal
-`\u{XXXXXXXX}` escape sequence. You can use these escape sequences to include
-non-printable or right-to-left (RTL) characters in your strings. Hexadecimal
-values shorter than 8 characters are zero-padded. For example, you can escape a
+`\u{XXXXXXXX}` escape sequence. Hexadecimal values shorter than 8 characters are
+zero-padded. You can use these escape sequences to include non-printable or
+right-to-left (RTL) characters in your strings. For example, you can escape a
 {wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as `\u{200f}`,
 `\u{200F}`, or `\u{0000200f}`.
 

From 9b36d89713e9d225a0987f016b2f27fde6b77500 Mon Sep 17 00:00:00 2001
From: James Rodewig <40268737+jrodewig@users.noreply.github.com>
Date: Tue, 23 Mar 2021 07:48:24 -0400
Subject: [PATCH 6/6] Note hexadecimal value is 2-8 chars

---
 docs/reference/eql/syntax.asciidoc | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/docs/reference/eql/syntax.asciidoc b/docs/reference/eql/syntax.asciidoc
index 366b0f4663dbd..5492637aea0cf 100644
--- a/docs/reference/eql/syntax.asciidoc
+++ b/docs/reference/eql/syntax.asciidoc
@@ -410,10 +410,11 @@ double quote (`"`), must be escaped with a preceding backslash (`\`).
 |`\"`             | Double quote (`"`)
 |====
 
-You can escape Unicode characters using a case-insensitive hexadecimal
-`\u{XXXXXXXX}` escape sequence. Hexadecimal values shorter than 8 characters are
-zero-padded. You can use these escape sequences to include non-printable or
-right-to-left (RTL) characters in your strings. For example, you can escape a
+You can escape Unicode characters using a hexadecimal `\u{XXXXXXXX}` escape
+sequence. The hexadecimal value can be 2-8 characters and is case-insensitive.
+Values shorter than 8 characters are zero-padded. You can use these escape
+sequences to include non-printable or right-to-left (RTL) characters in your
+strings. For example, you can escape a
 {wikipedia}/Right-to-left_mark[right-to-left mark (RLM)] as `\u{200f}`,
 `\u{200F}`, or `\u{0000200f}`.
 
@@ -834,7 +835,7 @@ sub-fields of a `nested` field. However, data streams and indices containing
 follows:
 
 * In {es} EQL, most operators are case-sensitive. For example,
-`process_name == "cmd.exe"` is not equivalent to 
+`process_name == "cmd.exe"` is not equivalent to
 `process_name == "Cmd.exe"`.
 
 * In {es} EQL, functions are case-sensitive. To make a function