<commit_before>[role="xpack"]
[testenv="basic"]
[[eql-requirements]]
== EQL requirements
++++
<titleabbrev>Requirements</titleabbrev>
++++

experimental::[]

EQL is schemaless and works out-of-the-box with most common log formats. If you
use a standard log format and already know what fields in your index contain
event type and timestamp information, you can skip this page.

[discrete]
[[eql-required-fields]]
=== Required fields

In {es}, EQL assumes each document in an index corresponds to an event.

To search an index using EQL, each document in the index must contain the
following field archetypes:

Event type::
A field containing the event classification, such as `process`, `file`, or
`network`. This is typically mapped as a <<keyword,`keyword`>> field.

Timestamp::
A field containing the date and/or time the event occurred. This is typically
mapped as a <<date,`date`>> field.

[TIP]
====
While no schema is required to use EQL in {es}, we recommend the
{ecs-ref}[Elastic Common Schema (ECS)]. {es}'s EQL search is designed to work
with core ECS fields by default.
====<commit_msg>[DOCS] Reorganize EQL requirements page<commit_after>[role="xpack"]
[testenv="basic"]
[[eql-requirements]]
== EQL requirements
++++
<titleabbrev>Requirements</titleabbrev>
++++

experimental::[]

EQL is schema-less and works well with most common log formats.


[TIP]
====
While no schema is required to use EQL in {es}, we recommend the
{ecs-ref}[Elastic Common Schema (ECS)]. The EQL search API is designed to work
with core ECS fields by default.
====

[discrete]
[[eql-required-fields]]
=== Required fields

In {es}, EQL assumes each document in an index corresponds to an event.

To search an index using EQL, each document in the index must contain the
following field archetypes:

Event type::
A field containing the event classification, such as `process`, `file`, or
`network`. This is typically mapped as a <<keyword,`keyword`>> field.

Timestamp::
A field containing the date and/or time the event occurred. This is typically
mapped as a <<date,`date`>> field.
{'fraction_non_alphanumeric': 0.11068148864185597, 'fraction_numerical': 0.0, 'mean_word_length': 5.088235294117647, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 15, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2544315', 'n_tokens_mistral': 604, 'n_tokens_neox': 587, 'n_words': 279}