From 3d76fb064795d83fb0a1a6e35e8a1e1e09f99466 Mon Sep 17 00:00:00 2001
From: James Rodewig <james.rodewig@elastic.co>
Date: Fri, 10 Apr 2020 16:00:12 -0400
Subject: [PATCH 1/2] [DOCS] EQL: Document `string` function

---
 docs/reference/eql/functions.asciidoc | 38 +++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/docs/reference/eql/functions.asciidoc b/docs/reference/eql/functions.asciidoc
index a586dd3ccf02f..080b9eb348478 100644
--- a/docs/reference/eql/functions.asciidoc
+++ b/docs/reference/eql/functions.asciidoc
@@ -12,6 +12,7 @@ experimental::[]
 * <<eql-fn-endswith>>
 * <<eql-fn-length>>
 * <<eql-fn-startswith>>
+* <<eql-fn-string>>
 * <<eql-fn-substring>>
 * <<eql-fn-wildcard>>
 
@@ -337,6 +338,43 @@ field datatypes:
 *Returns:* boolean or `null`
 ====
 
+[discrete]
+[[eql-fn-string]]
+=== `string`
+
+Converts a value to a string.
+
+[%collapsible]
+====
+*Example*
+[source,eql]
+----
+string(42)               // returns "42"
+string(42.5)             // returns "42.5"
+string("regsvr32.exe")   // returns "regsvr32.exe"
+string(true)             // returns "true"
+
+// null handling
+string(null)             // returns null
+----
+
+*Syntax*
+[source,txt]
+----
+string(<value>)
+----
+
+*Parameters*
+`<value>`::
+(Required)
+Value to convert to a string. If `null`, the function returns `null`.
++
+If using a field as the argument, this parameter does not support the
+<<text,`text`>> field datatype.
+
+*Returns:* string or `null`
+====
+
 [discrete]
 [[eql-fn-substring]]
 === `substring`

From 98f84cd2433a2df3af519180fce70cbeee0aa642 Mon Sep 17 00:00:00 2001
From: James Rodewig <james.rodewig@elastic.co>
Date: Fri, 10 Apr 2020 16:04:32 -0400
Subject: [PATCH 2/2] fix spacing

---
 docs/reference/eql/functions.asciidoc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/reference/eql/functions.asciidoc b/docs/reference/eql/functions.asciidoc
index 080b9eb348478..6664f2281453d 100644
--- a/docs/reference/eql/functions.asciidoc
+++ b/docs/reference/eql/functions.asciidoc
@@ -365,6 +365,7 @@ string(<value>)
 ----
 
 *Parameters*
+
 `<value>`::
 (Required)
 Value to convert to a string. If `null`, the function returns `null`.