1dcec9d210
This PR adds a new syntax to KQL for querying nested fields. Nested fields can be queried in two different ways: Parts of the query may only match a single nested doc (bool inside nested). This is what most people want when querying on a nested field. Parts of the query may match different nested docs (nested inside bool). This is how a regular object field works but nested fields can be queried in the same way. Although generally less useful, there are occasions where one might want to query a nested field in this way. The new KQL syntax supports both. |
||
|---|---|---|
| .. | ||
| common | ||
| security_and_spaces | ||
| security_only | ||
| spaces_only | ||