Skip to content

Commit 4310128

Browse files
committed
Update Tenzir Node documentation
1 parent b147cc9 commit 4310128

File tree

4 files changed

+15
-29
lines changed

4 files changed

+15
-29
lines changed

src/content/docs/reference/functions.mdx

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -746,8 +746,9 @@ TODO: the following functions still need to be documented:
746746
747747
*/}
748748

749-
Functions appear in [expressions](/reference/language/expressions) and take positional
750-
and/or named arguments, producing a value as a result of their computation.
749+
Functions appear in [expressions](/explanations/language/expressions) and take
750+
positional and/or named arguments, producing a value as a result of their
751+
computation.
751752

752753
Function signatures have the following notation:
753754

@@ -760,18 +761,6 @@ f(arg1:<type>, arg2=<type>, [arg3=type]) -> <type>
760761
- `[arg=type]`: optional (named) argument
761762
- `-> <type>`: function return type
762763

763-
TQL features the [uniform function call syntax
764-
(UFCS)](https://en.wikipedia.org/wiki/Uniform_Function_Call_Syntax), which
765-
allows you to interchangeably call a function with at least one argument either
766-
as _free function_ or _method_. For example, `length(str)` and `str.length()`
767-
resolve to the identical function call. The latter syntax is particularly
768-
suitable for function chaining, e.g., `x.f().g().h()` reads left-to-right as
769-
"start with `x`, apply `f()`, then `g()` and then `h()`," compared to
770-
`h(g(f(x)))`, which reads "inside out."
771-
772-
Throughout our documentation, we use the free function style in the synopsis
773-
but often resort to the method style when it is more idiomatic.
774-
775764
## Aggregation
776765

777766
<CardGrid>

src/content/docs/reference/functions/match_regex.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,3 @@ output = input.match_regex("^[E|e]xample[!]?$")
5858
{input: "example!", output: true}
5959
{input: "example?", output: false}
6060
```
61-
62-
## See Also
63-
64-
[String Operations](/reference/language/expressions#string-operations)

src/content/docs/reference/operators/set.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@ yet.
2121
Within assignments, the `move` keyword in front of a field causes a field to be
2222
removed from the input after evaluation.
2323

24-
:::tip
24+
:::tip[Implied operator]
2525
The `set` operator is implied whenever a direct assignment is written. We
2626
recommend to use the implicit version. For example, use `test = 42` instead of
2727
`set test=42`.
2828

29-
Read our [language reference](/reference/language/statements#assignment) for a more
30-
detailed description.
29+
Read our [language documentation](/explanations/language/statements/#assignment)
30+
for a more detailed description.
3131
:::
3232

3333
## Examples

src/content/docs/reference/operators/sigma.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,15 @@ operator discards all events that do not match the provided rules.
2121
<summary> Transpilation Process </summary>
2222

2323
For each rule, the operator transpiles the YAML into an
24-
[expression](/reference/language/expressions) and instantiates a [`where`](/reference/operators/where)
25-
operator, followed by assignments to generate an output. Here's how the
26-
transpilation works. The Sigma rule YAML format requires a `detection` attribute
27-
that includes a map of named sub-expression called *search identifiers*. In
28-
addition, `detection` must include a final `condition` that combines search
29-
identifiers using boolean algebra (AND, OR, and NOT) or syntactic sugar to
30-
reference groups of search expressions, e.g., using the `1/all of *` or plain
31-
wildcard syntax. Consider the following `detection` embedded in a rule:
24+
[expression](/explanations/language/expressions) and instantiates a
25+
[`where`](/reference/operators/where) operator, followed by assignments to
26+
generate an output. Here's how the transpilation works. The Sigma rule YAML
27+
format requires a `detection` attribute that includes a map of named
28+
sub-expression called *search identifiers*. In addition, `detection` must
29+
include a final `condition` that combines search identifiers using boolean
30+
algebra (AND, OR, and NOT) or syntactic sugar to reference groups of search
31+
expressions, e.g., using the `1/all of *` or plain wildcard syntax. Consider the
32+
following `detection` embedded in a rule:
3233

3334
```yaml
3435
detection:

0 commit comments

Comments
 (0)