Initialize an Entity Engine
Path parameters
-
The entity type of the engine (either 'user' or 'host').
Values are
user
,host
,service
, oruniversal
.
Body Required
Schema for the engine initialization
-
delay string
The delay before the transform will run.
Format should match the following pattern:
[smdh]$
. Default value is1m
. -
docsPerSecond integer
The number of documents per second to process.
-
Interval in which enrich policy runs. For example,
"1h"
means the rule runs every hour.Format should match the following pattern:
^[1-9]\d*[smh]$
. -
fieldHistoryLength integer
The number of historical values to keep for each field.
Default value is
10
. -
filter string
-
frequency string
The frequency at which the transform will run.
Format should match the following pattern:
[smdh]$
. Default value is1m
. -
indexPattern string
-
lookbackPeriod string
The amount of time the transform looks back to calculate the aggregations.
Format should match the following pattern:
[smdh]$
. Default value is24h
. -
timeout string
The timeout for initializing the aggregating transform.
Format should match the following pattern:
[smdh]$
. Default value is180s
. -
timestampField string
The field to use as the timestamp for the entity type.
Default value is
@timestamp
.
curl \
--request POST https://localhost:5601/api/entity_store/engines/{entityType}/init \
--header "Content-Type: application/json" \
--data '{"delay":"1m","docsPerSecond":42,"enrichPolicyExecutionInterval":"1h","fieldHistoryLength":10,"filter":"string","frequency":"1m","indexPattern":"string","lookbackPeriod":"24h","timeout":"180s","timestampField":"@timestamp"}'
{
"delay": "1m",
"docsPerSecond": 42,
"enrichPolicyExecutionInterval": "1h",
"fieldHistoryLength": 10,
"filter": "string",
"frequency": "1m",
"indexPattern": "string",
"lookbackPeriod": "24h",
"timeout": "180s",
"timestampField": "@timestamp"
}
{
"delay": "1m",
"docsPerSecond": 42,
"error": {},
"fieldHistoryLength": 42,
"filter": "string",
"frequency": "1m",
"indexPattern": "string",
"lookbackPeriod": "24h",
"status": "installing",
"timeout": "180s",
"timestampField": "string",
"type": "user"
}