docs: clarify EQL v3 configuration and Bloom defaults

[freshtonic]

Summary

• separate current Proxy 3.x/EQL v3 guidance from pinned Proxy 2.2 documentation
• remove obsolete EQL v2 search-config instructions from the v3 searchable JSON reference
• document fixed Bloom filter parameters, tokenization, preprocessing, and probabilistic matching
• clarify that configuration reloads are derived from EQL v3 schema domains

Validation

• mise run check
• git diff --check

Linear: CIP-3714

Summary by CodeRabbit

• Documentation
  • Added prominent version notices for Proxy 3.x and EQL v3, with links to Proxy 2.2 documentation.
  • Documented Bloom-filter text matching, including supported domains, preprocessing, tokenization, probabilistic matching, and configuration limits.
  • Updated searchable JSON and reload interval guidance to reflect current EQL v3 behavior.
  • Removed outdated EQL v2 configuration instructions and examples.
  • Pinned the Docker Compose example to Proxy 3.0.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 40358b52-8c20-49ba-b7aa-2f565b786600

📥 Commits

Reviewing files that changed from the base of the PR and between ecc6b0e and efbc735.

📒 Files selected for processing (3)

• docs/how-to/index.md
• docs/reference/index.md
• docs/reference/searchable-json.md

---

📝 Walkthrough

Walkthrough

The documentation now targets Proxy 3.x and EQL v3. It adds compatibility notices, pins the Docker Compose image, updates encryption configuration guidance, documents Bloom-filter matching, and replaces EQL v2 searchable JSON options with fixed EQL v3 behavior.

Changes

EQL v3 documentation

Layer / File(s)	Summary
Version compatibility and configuration references docs/how-to/index.md, docs/reference/index.md, docs/reference/searchable-json.md	The pages identify Proxy 3.x and EQL v3 usage, link to Proxy 2.2 documentation, pin the Docker Compose image to 3.0, and describe encryption configuration derived from EQL v3 schema domains.
Text matching and searchable JSON behavior docs/how-to/index.md, docs/reference/searchable-json.md	The documentation adds Bloom-filter matching details and describes fixed EQL v3 selector prefixes, disabled term filters, and array selector indexing. It retains the documented empty-result behavior for array functions on non-arrays.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• cipherstash/proxy#415: Covers related EQL v3 migration and retired EQL v2 configuration guidance.
• cipherstash/proxy#432: Updates the same documentation pages for the Proxy 3.x and EQL v3 migration.

Suggested reviewers: tobyhede

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main documentation changes to EQL v3 configuration and Bloom-filter defaults.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch james/cip-3714

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/how-to/index.md`:
- Around line 5-11: Update the installation example in the guide to use an
explicitly supported Proxy 3.x image tag instead of the floating
cipherstash/proxy:latest reference, or clearly document a tag policy that
guarantees a 3.x image. Keep the surrounding Proxy 3.x and EQL v3 scope
unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ad860316-a26a-4b01-8e7d-d23e31178ae3

📥 Commits

Reviewing files that changed from the base of the PR and between e2198c7 and e50f9da.

📒 Files selected for processing (3)

• docs/how-to/index.md
• docs/reference/index.md
• docs/reference/searchable-json.md

[auxesis]

Thanks for this @freshtonic!

I have added a suggested change with a commit message you can use.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.