github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Increase maximum Osquery timeout to 24 hours (#207276)

Browse source 
Some Osquery queries are expected to be long running. To accommodate
this, increase the maximum timeout in the query creation UI to 24 hours
(86400 seconds).

24 hours should allow most long-running queries, while still having a
limit that ensures misbehaving queries do not block others for an
extremely long time.

Relates to https://github.com/elastic/beats/issues/42352. Osquerybeat
will also increase its timeout limit to 24h, this change will allow the
higher timeout to be set by users in Kibana.
This commit is contained in:
Michael Wolf 2025-01-30 16:18:47 -08:00 • committed by GitHub
parent df4a6d7ce3
commit 81a57e005e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
x-pack/platform/plugins/shared/osquery/common/constants.ts
View file

@ -32,5 +32,5 @@ export const API_VERSIONS = {
export enum QUERY_TIMEOUT {
DEFAULT = 60, // 60 seconds
MAX = 60 * 15,
MAX = 60 * 60 * 24, // 24 hours
}

6
x-pack/platform/plugins/shared/osquery/cypress/e2e/all/live_query.cy.ts
View file

@ -37,12 +37,12 @@ describe('ALL - Live Query', { tags: ['@ess', '@serverless'] }, () => {
cy.contains('Query is a required field').should('not.exist');
checkResults();
getAdvancedButton().click();
fillInQueryTimeout('910');
fillInQueryTimeout('86410');
submitQuery();
cy.contains('The timeout value must be 900 seconds or or lower.');
cy.contains('The timeout value must be 86400 seconds or or lower.');
fillInQueryTimeout('890');
submitQuery();
cy.contains('The timeout value must be 900 seconds or or lower.').should('not.exist');
cy.contains('The timeout value must be 86400 seconds or or lower.').should('not.exist');
typeInOsqueryFieldInput('days{downArrow}{enter}');
submitQuery();
cy.contains('ECS field is required.');