Merge branch 'master' of https://github.com/endgameinc/eql into featu…

…re/strip

docs/query-guide/functions.rst

@@ -172,6 +172,20 @@ math, string manipulation or more sophisticated expressions to be expressed.
     :param: trailing: strip whitespace from the end of ``s``. Default is ``True``.
 
     Returns a string with whitespace removed from the beginning and end of input string ``s``.
+.. function:: substring(source [, start, end])
+
+    Extracts a substring between from another string between ``start`` and ``end``.
+    Like other EQL functions, ``start`` and ``end`` are zero-indexed positions in the string.
+    Behavior is similar to Python's `string slicing`_ (``source[start:end]``), and negative offsets are supported.
+
+    .. code-block:: eql
+
+        substring("event query language", 0, 5)                     // returns "event"
+        substring("event query language", 0, length("event"))       // returns "event"
+        substring("event query language", 6, 11)                    // returns "query"
+        substring("event query language", -8)                       // returns "language"
+        substring("event query language", -length("language"))      // returns "language"
+        substring("event query language", -5, -1))                  // returns "guag"
 
 .. function:: subtract(x, y)