[DOCS] EQL: Document cidrMatch function

[jrodewig]

Adds documentation for the EQL cidrMatch function.

Depends on #54186

[elasticmachine]

Pinging @elastic/es-docs (>docs)

[elasticmachine]

Pinging @elastic/es-search (:Search/EQL)

[matriv]

@elastic/es-ql

[jrodewig]

@aleksmaus When I tested this using the EQL search API, it didn't return results as expected. I included duplication steps below in case I made an error somewhere.

Create an index mapping to ensure source.address is an IP field.

PUT /my_index
{
  "mappings": {
    "properties": {
      "source": {
        "properties": {
          "address": {
            "type": "ip"
          }
        }
      }
    }
  }
}

Index "192.168.152.12" as a source.address value.

PUT /my_index/_doc/1
{
  "@timestamp": "2020-12-06T11:04:05.000Z",
  "event": {
    "category": "process"
  },
  "source": {
    "address": "192.168.152.12"
  }
}

Use cidrMatch to search for "192.168.152.12" in the "192.168.0.0/16" CIDR block. This should be true and return _doc 1 as a result.

{
GET /my_index/_eql/search
  "query": "process where cidrMatch(source.address, \"192.168.0.0/16\") == true "
}

Instead, I get no results.

{
  "took" : 2,
  "timed_out" : false,
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "events" : [ ]
  }
}

If I change true to false, the _doc is returned.

{
GET /my_index/_eql/search
  "query": "process where cidrMatch(source.address, \"192.168.0.0/16\") == false "
}

Results:

{
  "took" : 2,
  "timed_out" : false,
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "events" : [
      {
        "_index" : "my_index",
        "_id" : "1",
        "_score" : null,
        "_source" : {
          "@timestamp" : "2020-12-06T11:04:05.000Z",
          "event" : {
            "category" : "process"
          },
          "source" : {
            "address" : "192.168.152.12"
          }
        },
        "sort" : [
          1607252645000
        ]
      }
    ]
  }
}

[astefan]

I created #55709 to track this bug.

[astefan]

For what is worth, this LGTM.
I've created #55709, though, to track the issue brought up in one of your comments.

[jrodewig]

Thanks for tracking that bug @astefan.