EQL pipe reference
Elasticsearch supports the following EQL pipes.
head
Returns up to a specified number of events or sequences, starting with the earliest matches. Works similarly to the Unix head command.
Example
The following EQL query returns up to three of the earliest powershell commands.
process where process.name == "powershell.exe" | head 3
Syntax
head <max>
Parameters
-
<max> - (Required, integer) Maximum number of matching events or sequences to return.
tail
Returns up to a specified number of events or sequences, starting with the most recent matches. Works similarly to the Unix tail command.
Example
The following EQL query returns up to five of the most recent svchost.exe processes.
process where process.name == "svchost.exe" | tail 5
Syntax
tail <max>
Parameters
-
<max> - (Required, integer) Maximum number of matching events or sequences to return.
© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/8.17/eql-pipe-ref.html
