Skip to content

Commit

Permalink
Remove limitation (#4602)
Browse files Browse the repository at this point in the history
  • Loading branch information
joepeeples authored Jan 17, 2024
1 parent 6793392 commit fa6027e
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion docs/management/admin/event-filters.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ image::images/event-filter.png[]
* `is not`
* `is one of`
* `is not one of`
* `matches`: This is only available for the `file.path.text` field, and allows you to use wildcards in `Value`, such as `C:\path\*\app.exe`. Available wildcards are `?` (match one character) and `*` (match zero or more characters).
* `matches` | `does not match` : Allows you to use wildcards in `Value`, such as `C:\path\*\app.exe`. Available wildcards are `?` (match one character) and `*` (match zero or more characters).
+
IMPORTANT: Using wildcards in file paths can impact performance. To create a more efficient event filter using wildcards, use multiple conditions and make them as specific as possible. For example, adding conditions using `process.name` or `file.name` can help limit the scope of wildcard matching.

Expand Down

0 comments on commit fa6027e

Please sign in to comment.