Skip to content

[DOCS] EQL: update the tiebreaker related docs #72804

Closed
@astefan

Description

@astefan

Following #72089 our statement about the tiebreaker usage should be adjusted a bit. Something similar to

If you don't specify a tiebreaker field or the events also share the same tiebreaker value, Elasticsearch considers the events concurrent and they may not be returned in a consistent sort order.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions