ReferenceStack SDKAPI reference
eql/v3
eql/v3 is a module in @cipherstash/stack. TypeScript API reference with its signature, parameters, and usage.
eql/v3
Classes
EncryptedTextSearchColumn
Defined in: eql/v3/columns.ts:540
Builder for a public.eql_v3_text_search column.
The concrete type inherently enables equality + order/range + free-text match — there are no capability-enabling or tuning methods. The match index is always emitted with the default configuration.
NOTE — querying: a text_search column emits all three indexes (unique,
ope, match), and the shared index-inference picks them by fixed priority
unique > match > ordering. So encryptQuery(value, { column, table }) with NO
explicit queryType builds an EQUALITY term (via unique), NOT a free-text
match — a substring like 'joh' then matches nothing. To run a free-text
match query you MUST pass queryType: 'freeTextSearch':
// equality (default): exact value only
client.encryptQuery('[email protected]', { column: users.email, table: users })
// free-text match: substring/token search
client.encryptQuery('joh', { column: users.email, table: users, queryType: 'freeTextSearch' })Extends
EncryptedV3Column<typeofTEXT_SEARCH_DOMAIN>
Constructors
Constructor
new EncryptedTextSearchColumn(columnName): EncryptedTextSearchColumn;Defined in: eql/v3/columns.ts:543
Parameters
columnName
string
Returns
Overrides
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_text_search";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_text_search"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: true;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: true;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: true = true;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedIntegerColumn
Defined in: eql/v3/columns.ts:559
Extends
EncryptedV3Column<typeofINTEGER>
Constructors
Constructor
new EncryptedIntegerColumn(columnName, definition): EncryptedIntegerColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_integer" = 'public.eql_v3_integer'
castAs
"number" = 'number'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_integer";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_integer"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedIntegerEqColumn
Defined in: eql/v3/columns.ts:560
Extends
EncryptedV3Column<typeofINTEGER_EQ>
Constructors
Constructor
new EncryptedIntegerEqColumn(columnName, definition): EncryptedIntegerEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_integer_eq" = 'public.eql_v3_integer_eq'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_integer_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_integer_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedIntegerOrdOreColumn
Defined in: eql/v3/columns.ts:563
Extends
EncryptedV3Column<typeofINTEGER_ORD_ORE>
Constructors
Constructor
new EncryptedIntegerOrdOreColumn(columnName, definition): EncryptedIntegerOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_integer_ord_ore" = 'public.eql_v3_integer_ord_ore'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_integer_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_integer_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedIntegerOrdColumn
Defined in: eql/v3/columns.ts:566
Extends
EncryptedV3Column<typeofINTEGER_ORD>
Constructors
Constructor
new EncryptedIntegerOrdColumn(columnName, definition): EncryptedIntegerOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_integer_ord" = 'public.eql_v3_integer_ord'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_integer_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_integer_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedSmallintColumn
Defined in: eql/v3/columns.ts:571
Extends
EncryptedV3Column<typeofSMALLINT>
Constructors
Constructor
new EncryptedSmallintColumn(columnName, definition): EncryptedSmallintColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_smallint" = 'public.eql_v3_smallint'
castAs
"number" = 'number'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_smallint";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_smallint"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedSmallintEqColumn
Defined in: eql/v3/columns.ts:574
Extends
EncryptedV3Column<typeofSMALLINT_EQ>
Constructors
Constructor
new EncryptedSmallintEqColumn(columnName, definition): EncryptedSmallintEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_smallint_eq" = 'public.eql_v3_smallint_eq'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_smallint_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_smallint_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedSmallintOrdOreColumn
Defined in: eql/v3/columns.ts:577
Extends
EncryptedV3Column<typeofSMALLINT_ORD_ORE>
Constructors
Constructor
new EncryptedSmallintOrdOreColumn(columnName, definition): EncryptedSmallintOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_smallint_ord_ore" = 'public.eql_v3_smallint_ord_ore'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_smallint_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_smallint_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedSmallintOrdColumn
Defined in: eql/v3/columns.ts:580
Extends
EncryptedV3Column<typeofSMALLINT_ORD>
Constructors
Constructor
new EncryptedSmallintOrdColumn(columnName, definition): EncryptedSmallintOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_smallint_ord" = 'public.eql_v3_smallint_ord'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_smallint_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_smallint_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedBigintColumn
Defined in: eql/v3/columns.ts:586
Extends
EncryptedV3Column<typeofBIGINT>
Constructors
Constructor
new EncryptedBigintColumn(columnName, definition): EncryptedBigintColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_bigint" = 'public.eql_v3_bigint'
castAs
"bigint" = 'bigint'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_bigint";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_bigint"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedBigintEqColumn
Defined in: eql/v3/columns.ts:587
Extends
EncryptedV3Column<typeofBIGINT_EQ>
Constructors
Constructor
new EncryptedBigintEqColumn(columnName, definition): EncryptedBigintEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_bigint_eq" = 'public.eql_v3_bigint_eq'
castAs
"bigint" = 'bigint'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_bigint_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_bigint_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedBigintOrdOreColumn
Defined in: eql/v3/columns.ts:590
Extends
EncryptedV3Column<typeofBIGINT_ORD_ORE>
Constructors
Constructor
new EncryptedBigintOrdOreColumn(columnName, definition): EncryptedBigintOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_bigint_ord_ore" = 'public.eql_v3_bigint_ord_ore'
castAs
"bigint" = 'bigint'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_bigint_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_bigint_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedBigintOrdColumn
Defined in: eql/v3/columns.ts:593
Extends
EncryptedV3Column<typeofBIGINT_ORD>
Constructors
Constructor
new EncryptedBigintOrdColumn(columnName, definition): EncryptedBigintOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_bigint_ord" = 'public.eql_v3_bigint_ord'
castAs
"bigint" = 'bigint'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_bigint_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_bigint_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedDateColumn
Defined in: eql/v3/columns.ts:598
Extends
EncryptedV3Column<typeofDATE>
Constructors
Constructor
new EncryptedDateColumn(columnName, definition): EncryptedDateColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_date" = 'public.eql_v3_date'
castAs
"date" = 'date'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_date";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_date"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedDateEqColumn
Defined in: eql/v3/columns.ts:599
Extends
EncryptedV3Column<typeofDATE_EQ>
Constructors
Constructor
new EncryptedDateEqColumn(columnName, definition): EncryptedDateEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_date_eq" = 'public.eql_v3_date_eq'
castAs
"date" = 'date'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_date_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_date_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedDateOrdOreColumn
Defined in: eql/v3/columns.ts:600
Extends
EncryptedV3Column<typeofDATE_ORD_ORE>
Constructors
Constructor
new EncryptedDateOrdOreColumn(columnName, definition): EncryptedDateOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_date_ord_ore" = 'public.eql_v3_date_ord_ore'
castAs
"date" = 'date'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_date_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_date_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedDateOrdColumn
Defined in: eql/v3/columns.ts:603
Extends
EncryptedV3Column<typeofDATE_ORD>
Constructors
Constructor
new EncryptedDateOrdColumn(columnName, definition): EncryptedDateOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_date_ord" = 'public.eql_v3_date_ord'
castAs
"date" = 'date'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_date_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_date_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTimestampColumn
Defined in: eql/v3/columns.ts:608
Extends
EncryptedV3Column<typeofTIMESTAMP>
Constructors
Constructor
new EncryptedTimestampColumn(columnName, definition): EncryptedTimestampColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_timestamp" = 'public.eql_v3_timestamp'
castAs
"timestamp" = 'timestamp'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_timestamp";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_timestamp"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTimestampEqColumn
Defined in: eql/v3/columns.ts:611
Extends
EncryptedV3Column<typeofTIMESTAMP_EQ>
Constructors
Constructor
new EncryptedTimestampEqColumn(columnName, definition): EncryptedTimestampEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_timestamp_eq" = 'public.eql_v3_timestamp_eq'
castAs
"timestamp" = 'timestamp'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_timestamp_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_timestamp_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTimestampOrdOreColumn
Defined in: eql/v3/columns.ts:614
Extends
EncryptedV3Column<typeofTIMESTAMP_ORD_ORE>
Constructors
Constructor
new EncryptedTimestampOrdOreColumn(columnName, definition): EncryptedTimestampOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_timestamp_ord_ore" = 'public.eql_v3_timestamp_ord_ore'
castAs
"timestamp" = 'timestamp'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
EncryptedTimestampOrdOreColumn
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_timestamp_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_timestamp_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTimestampOrdColumn
Defined in: eql/v3/columns.ts:617
Extends
EncryptedV3Column<typeofTIMESTAMP_ORD>
Constructors
Constructor
new EncryptedTimestampOrdColumn(columnName, definition): EncryptedTimestampOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_timestamp_ord" = 'public.eql_v3_timestamp_ord'
castAs
"timestamp" = 'timestamp'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_timestamp_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_timestamp_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedNumericColumn
Defined in: eql/v3/columns.ts:622
Extends
EncryptedV3Column<typeofNUMERIC>
Constructors
Constructor
new EncryptedNumericColumn(columnName, definition): EncryptedNumericColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_numeric" = 'public.eql_v3_numeric'
castAs
"number" = 'number'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_numeric";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_numeric"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedNumericEqColumn
Defined in: eql/v3/columns.ts:623
Extends
EncryptedV3Column<typeofNUMERIC_EQ>
Constructors
Constructor
new EncryptedNumericEqColumn(columnName, definition): EncryptedNumericEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_numeric_eq" = 'public.eql_v3_numeric_eq'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_numeric_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_numeric_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedNumericOrdOreColumn
Defined in: eql/v3/columns.ts:626
Extends
EncryptedV3Column<typeofNUMERIC_ORD_ORE>
Constructors
Constructor
new EncryptedNumericOrdOreColumn(columnName, definition): EncryptedNumericOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_numeric_ord_ore" = 'public.eql_v3_numeric_ord_ore'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_numeric_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_numeric_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedNumericOrdColumn
Defined in: eql/v3/columns.ts:629
Extends
EncryptedV3Column<typeofNUMERIC_ORD>
Constructors
Constructor
new EncryptedNumericOrdColumn(columnName, definition): EncryptedNumericOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_numeric_ord" = 'public.eql_v3_numeric_ord'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_numeric_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_numeric_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTextColumn
Defined in: eql/v3/columns.ts:634
Extends
EncryptedV3Column<typeofTEXT>
Constructors
Constructor
new EncryptedTextColumn(columnName, definition): EncryptedTextColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_text" = 'public.eql_v3_text'
castAs
"string" = 'string'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_text";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_text"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTextEqColumn
Defined in: eql/v3/columns.ts:635
Extends
EncryptedV3Column<typeofTEXT_EQ>
Constructors
Constructor
new EncryptedTextEqColumn(columnName, definition): EncryptedTextEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_text_eq" = 'public.eql_v3_text_eq'
castAs
"string" = 'string'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_text_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_text_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTextMatchColumn
Defined in: eql/v3/columns.ts:636
Extends
EncryptedV3Column<typeofTEXT_MATCH>
Constructors
Constructor
new EncryptedTextMatchColumn(columnName, definition): EncryptedTextMatchColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_text_match" = 'public.eql_v3_text_match'
castAs
"string" = 'string'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: true;
} = MATCH_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
true = true
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_text_match";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_text_match"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: true;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: true;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: true = true;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTextOrdOreColumn
Defined in: eql/v3/columns.ts:639
Extends
EncryptedV3Column<typeofTEXT_ORD_ORE>
Constructors
Constructor
new EncryptedTextOrdOreColumn(columnName, definition): EncryptedTextOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_text_ord_ore" = 'public.eql_v3_text_ord_ore'
castAs
"string" = 'string'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_text_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_text_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTextOrdColumn
Defined in: eql/v3/columns.ts:642
Extends
EncryptedV3Column<typeofTEXT_ORD>
Constructors
Constructor
new EncryptedTextOrdColumn(columnName, definition): EncryptedTextOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_text_ord" = 'public.eql_v3_text_ord'
castAs
"string" = 'string'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_text_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_text_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedBooleanColumn
Defined in: eql/v3/columns.ts:647
Extends
EncryptedV3Column<typeofBOOLEAN>
Constructors
Constructor
new EncryptedBooleanColumn(columnName, definition): EncryptedBooleanColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_boolean" = 'public.eql_v3_boolean'
castAs
"boolean" = 'boolean'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_boolean";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_boolean"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedRealColumn
Defined in: eql/v3/columns.ts:650
Extends
EncryptedV3Column<typeofREAL>
Constructors
Constructor
new EncryptedRealColumn(columnName, definition): EncryptedRealColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_real" = 'public.eql_v3_real'
castAs
"number" = 'number'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_real";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_real"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedRealEqColumn
Defined in: eql/v3/columns.ts:651
Extends
EncryptedV3Column<typeofREAL_EQ>
Constructors
Constructor
new EncryptedRealEqColumn(columnName, definition): EncryptedRealEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_real_eq" = 'public.eql_v3_real_eq'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_real_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_real_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedRealOrdOreColumn
Defined in: eql/v3/columns.ts:652
Extends
EncryptedV3Column<typeofREAL_ORD_ORE>
Constructors
Constructor
new EncryptedRealOrdOreColumn(columnName, definition): EncryptedRealOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_real_ord_ore" = 'public.eql_v3_real_ord_ore'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_real_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_real_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedRealOrdColumn
Defined in: eql/v3/columns.ts:655
Extends
EncryptedV3Column<typeofREAL_ORD>
Constructors
Constructor
new EncryptedRealOrdColumn(columnName, definition): EncryptedRealOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_real_ord" = 'public.eql_v3_real_ord'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_real_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_real_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedDoubleColumn
Defined in: eql/v3/columns.ts:660
Extends
EncryptedV3Column<typeofDOUBLE>
Constructors
Constructor
new EncryptedDoubleColumn(columnName, definition): EncryptedDoubleColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_double" = 'public.eql_v3_double'
castAs
"number" = 'number'
capabilities
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
} = STORAGE_ONLY
capabilities.equality
false = false
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_double";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_double"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): false;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
false
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedDoubleEqColumn
Defined in: eql/v3/columns.ts:661
Extends
EncryptedV3Column<typeofDOUBLE_EQ>
Constructors
Constructor
new EncryptedDoubleEqColumn(columnName, definition): EncryptedDoubleEqColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_double_eq" = 'public.eql_v3_double_eq'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
} = EQUALITY_ONLY
capabilities.equality
true = true
capabilities.orderAndRange
false = false
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_double_eq";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_double_eq"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: false;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: false;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedDoubleOrdOreColumn
Defined in: eql/v3/columns.ts:664
Extends
EncryptedV3Column<typeofDOUBLE_ORD_ORE>
Constructors
Constructor
new EncryptedDoubleOrdOreColumn(columnName, definition): EncryptedDoubleOrdOreColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_double_ord_ore" = 'public.eql_v3_double_ord_ore'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_double_ord_ore";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_double_ord_ore"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedDoubleOrdColumn
Defined in: eql/v3/columns.ts:667
Extends
EncryptedV3Column<typeofDOUBLE_ORD>
Constructors
Constructor
new EncryptedDoubleOrdColumn(columnName, definition): EncryptedDoubleOrdColumn;Defined in: eql/v3/columns.ts:474
Parameters
columnName
string
definition
eqlType
"public.eql_v3_double_ord" = 'public.eql_v3_double_ord'
castAs
"number" = 'number'
capabilities
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
} = ORDER_AND_RANGE
capabilities.equality
true = true
capabilities.orderAndRange
true = true
capabilities.freeTextSearch
false = false
Returns
Inherited from
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_double_ord";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_double_ord"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: true;
orderAndRange: true;
freeTextSearch: false;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: true;
orderAndRange: true;
freeTextSearch: false;
}equality
readonly equality: true = true;orderAndRange
readonly orderAndRange: true = true;freeTextSearch
readonly freeTextSearch: false = false;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedJsonColumn
Defined in: eql/v3/columns.ts:690
Builder for a public.eql_v3_json_search column — an encrypted JSONB document
(a JsonDocument: object, array, or null). It round-trips through
encrypt/decrypt, and containment queries use the encrypted-JSONB index
emitted by build(). (The stored payload is protect-ffi's SteVecDocument,
and the config index kind is ste_vec — both protect-ffi names.)
Extends
EncryptedV3Column<typeofJSON_DOMAIN>
Constructors
Constructor
new EncryptedJsonColumn(columnName): EncryptedJsonColumn;Defined in: eql/v3/columns.ts:691
Parameters
columnName
string
Returns
Overrides
Methods
getName()
getName(): string;Defined in: eql/v3/columns.ts:479
Returns
string
Inherited from
getEqlType()
getEqlType(): "public.eql_v3_json_search";Defined in: eql/v3/columns.ts:484
The concrete EQL v3 domain name. Metadata only; not emitted by build().
Returns
"public.eql_v3_json_search"
Inherited from
getQueryCapabilities()
getQueryCapabilities(): {
equality: false;
orderAndRange: false;
freeTextSearch: false;
searchableJson: true;
};Defined in: eql/v3/columns.ts:489
The semantic query capabilities this domain exposes. Metadata only.
Returns
{
equality: false;
orderAndRange: false;
freeTextSearch: false;
searchableJson: true;
}equality
readonly equality: false = false;orderAndRange
readonly orderAndRange: false = false;freeTextSearch
readonly freeTextSearch: false = false;searchableJson
readonly searchableJson: true = true;Inherited from
EncryptedV3Column.getQueryCapabilities
isQueryable()
isQueryable(): true;Defined in: eql/v3/columns.ts:494
true when this domain can produce at least one kind of query term.
Returns
true
Inherited from
build()
build(): {
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
};Defined in: eql/v3/columns.ts:501
Emit the encrypt-config column: cast_as plus capability-derived indexes.
Returns
{
cast_as: | "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json";
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
};
}cast_as
cast_as:
| "string"
| "number"
| "bigint"
| "boolean"
| "date"
| "text"
| "timestamp"
| "json" = castAsEnum;indexes
indexes: {
ore?: {
};
ope?: {
};
unique?: {
token_filters?: {
kind: "downcase";
}[];
};
match?: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};
ste_vec?: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};
} = indexesSchema;indexes.ore?
optional ore: {
};indexes.ope?
optional ope: {
};indexes.unique?
optional unique: {
token_filters?: {
kind: "downcase";
}[];
};indexes.unique.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match?
optional match: {
tokenizer?: | {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
};
token_filters?: {
kind: "downcase";
}[];
k?: number;
m?: number;
include_original?: boolean;
};indexes.match.tokenizer?
optional tokenizer:
| {
kind: "standard";
}
| {
kind: "ngram";
token_length: number;
} = tokenizerSchema;indexes.match.token_filters?
optional token_filters: {
kind: "downcase";
}[];indexes.match.k?
optional k: number;indexes.match.m?
optional m: number;indexes.match.include_original?
optional include_original: boolean;indexes.ste_vec?
optional ste_vec: {
prefix: string;
array_index_mode?: | "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};
mode?: "standard" | "compat";
};indexes.ste_vec.prefix
prefix: string;indexes.ste_vec.array_index_mode?
optional array_index_mode:
| "all"
| "none"
| {
item?: boolean;
wildcard?: boolean;
position?: boolean;
};indexes.ste_vec.mode?
optional mode: "standard" | "compat";Inherited from
EncryptedTable
Defined in: eql/v3/table.ts:18
A v3 encrypted table. Mirrors the v2 EncryptedTable but only accepts v3
column builders. Emits the same { tableName, columns } definition shape.
Type Parameters
T
T extends EncryptedV3TableColumn
Constructors
Constructor
new EncryptedTable<T>(tableName, columnBuilders): EncryptedTable<T>;Defined in: eql/v3/table.ts:22
Parameters
tableName
string
columnBuilders
T
Returns
Properties
tableName
readonly tableName: string;Defined in: eql/v3/table.ts:23
columnBuilders
readonly columnBuilders: T;Defined in: eql/v3/table.ts:24
Methods
build()
build(): TableDefinition;Defined in: eql/v3/table.ts:27
Returns
TableDefinition
buildColumnKeyMap()
buildColumnKeyMap(): Record<string, string>;Defined in: eql/v3/table.ts:77
Map each column's JS property name to its DB column name (getName()).
The model path matches user models by property name but must address the
encrypt config and FFI by DB name — build() keys columns by DB name, so
the two only agree when property == name. This recovers the mapping that
build() discards.
NULL PROTOTYPE — load-bearing. Callers index this map by a column name that
ultimately comes from the database (addJsonbCastsV3, filterColumnName,
the mutation transform). On a plain object literal, a column named
constructor / toString / valueOf / __proto__ resolves to an
inherited Object.prototype member, which is truthy — so a plaintext
column with such a name would be mistaken for a mapped encrypted column and
its Object.prototype value interpolated into the emitted select string.
encryptedTable() rejects such names as JS properties, but nothing
constrains the DB column names a table may contain.
Returns
Record<string, string>
Type Aliases
QueryCapabilities
type QueryCapabilities = Readonly<{
equality: boolean;
orderAndRange: boolean;
freeTextSearch: boolean;
searchableJson?: boolean;
}>;Defined in: eql/v3/columns.ts:17
The query capabilities a v3 concrete domain exposes. These are SDK-facing
semantic flags describing what kinds of query terms a column can produce —
NOT the raw EQL index keys. They are metadata only and never emitted by
build().
equality: exact-match lookups (EQLhm, or comparison viaob).orderAndRange: comparison / range lookups (EQLop, orobon_ord_oredomains).freeTextSearch: tokenised substring match (EQLbf).searchableJson: encrypted-JSONB containment / selector lookups (EQLste_vec). Optional and mutually exclusive with the scalar flags — apublic.eql_v3_json_searchdocument is queried by structure, not by scalar term.
AnyEncryptedV3Column
type AnyEncryptedV3Column =
| EncryptedIntegerColumn
| EncryptedIntegerEqColumn
| EncryptedIntegerOrdOreColumn
| EncryptedIntegerOrdColumn
| EncryptedSmallintColumn
| EncryptedSmallintEqColumn
| EncryptedSmallintOrdOreColumn
| EncryptedSmallintOrdColumn
| EncryptedBigintColumn
| EncryptedBigintEqColumn
| EncryptedBigintOrdOreColumn
| EncryptedBigintOrdColumn
| EncryptedDateColumn
| EncryptedDateEqColumn
| EncryptedDateOrdOreColumn
| EncryptedDateOrdColumn
| EncryptedTimestampColumn
| EncryptedTimestampEqColumn
| EncryptedTimestampOrdOreColumn
| EncryptedTimestampOrdColumn
| EncryptedNumericColumn
| EncryptedNumericEqColumn
| EncryptedNumericOrdOreColumn
| EncryptedNumericOrdColumn
| EncryptedTextColumn
| EncryptedTextEqColumn
| EncryptedTextMatchColumn
| EncryptedTextOrdOreColumn
| EncryptedTextOrdColumn
| EncryptedTextSearchColumn
| EncryptedBooleanColumn
| EncryptedRealColumn
| EncryptedRealEqColumn
| EncryptedRealOrdOreColumn
| EncryptedRealOrdColumn
| EncryptedDoubleColumn
| EncryptedDoubleEqColumn
| EncryptedDoubleOrdOreColumn
| EncryptedDoubleOrdColumn
| EncryptedJsonColumn;Defined in: eql/v3/columns.ts:700
Union of every v3 concrete column type. Used as the value type for v3 table columns so a table may mix any generated domains.
EncryptedV3TableColumn
type EncryptedV3TableColumn = {
[key: string]: AnyEncryptedV3Column;
};Defined in: eql/v3/columns.ts:755
Shape of v3 table columns: every value is a v3 concrete column builder. (Nested fields are deferred to later increments.)
Index Signature
[key: string]: AnyEncryptedV3ColumnJsonValue
type JsonValue =
| string
| number
| boolean
| null
| JsonValue[]
| {
[key: string]: JsonValue;
};Defined in: eql/v3/columns.ts:760
A JSON value at any depth. Used for the values NESTED inside a document.
JsonDocument
type JsonDocument =
| null
| JsonValue[]
| {
[key: string]: JsonValue;
};Defined in: eql/v3/columns.ts:776
The plaintext a public.eql_v3_json_search column encrypts and reconstructs: a JSON
DOCUMENT — an object, an array, or null. NOT a bare top-level scalar:
protect-ffi's json cast rejects a top-level string/number/boolean
("Cannot convert … to Json"), because a scalar belongs in a scalar domain
(types.TextEq, types.IntegerEq, …). Nested scalars are ordinary
JsonValues and are fully supported.
PlaintextForColumn
type PlaintextForColumn<C> = C extends EncryptedV3Column<infer D> ? PlaintextFromKind<D["castAs"]> : never;Defined in: eql/v3/columns.ts:800
The plaintext type for a single v3 column, read from the literal domain definition carried on the base class's private field. This is stable across empty subclasses that share the same base generic — a subclass-name conditional would collapse because those subclasses are structurally assignable to one another.
Type Parameters
C
C
QueryTypesForColumn
type QueryTypesForColumn<C> = C extends EncryptedV3Column<infer D> ?
| D["capabilities"]["equality"] extends true ? "equality" : never
| D["capabilities"]["orderAndRange"] extends true ? "orderAndRange" : never
| D["capabilities"]["freeTextSearch"] extends true ? "freeTextSearch" : never
| D["capabilities"]["searchableJson"] extends true ? "searchableJson" : never : never;Defined in: eql/v3/columns.ts:809
The user-facing queryType names a v3 column supports, derived 1:1 from its
capability flags. Resolves to never for a storage-only column (all flags
false) and for any non-v3 value. The names mirror the QueryCapabilities
keys, each of which is also a import('@/types').QueryTypeName member.
Type Parameters
C
C
EqlTypeForColumn
type EqlTypeForColumn<C> = C extends EncryptedV3Column<infer D> ? D["eqlType"] : never;Defined in: eql/v3/columns.ts:836
The concrete EQL v3 type string for a single column, read from the literal
domain definition carried on the base class's private field (mirrors
PlaintextForColumn). Distributes over a union of columns, so
EqlTypeForColumn<AnyEncryptedV3Column> yields the union of every domain's
eqlType — the canonical, source-of-truth key set for a type-driven test
matrix keyed by domain.
Type Parameters
C
C
InferPlaintext
type InferPlaintext<T> = T extends EncryptedTable<infer C> ? { [K in keyof C]: PlaintextForColumn<C[K]> } : never;Defined in: eql/v3/table.ts:171
Infer the plaintext (decrypted) shape from a v3 table schema. Each column maps
to the TypeScript type of its domain's castAs kind.
Type Parameters
T
T extends EncryptedTable<EncryptedV3TableColumn>
InferEncrypted
type InferEncrypted<T> = T extends EncryptedTable<infer C> ? { [K in keyof C]: Encrypted } : never;Defined in: eql/v3/table.ts:180
Infer the encrypted shape from a v3 table schema. See InferPlaintext for why no key-remap filter is needed in the flat single-type model.
Type Parameters
T
T extends EncryptedTable<EncryptedV3TableColumn>
AnyV3Table
type AnyV3Table = EncryptedTable<EncryptedV3TableColumn>;Defined in: eql/v3/table.ts:188
Any v3 table, regardless of its column map.
ColumnsOf
type ColumnsOf<T&