Skip to content

Commit

Permalink
Increase maximum Osquery timeout to 24 hours (elastic#207276)
Browse files Browse the repository at this point in the history
Some Osquery queries are expected to be long running. To accommodate
this, increase the maximum timeout in the query creation UI to 24 hours
(86400 seconds).

24 hours should allow most long-running queries, while still having a
limit that ensures misbehaving queries do not block others for an
extremely long time.

Relates to elastic/beats#42352. Osquerybeat
will also increase its timeout limit to 24h, this change will allow the
higher timeout to be set by users in Kibana.

(cherry picked from commit 81a57e0)
  • Loading branch information
mjwolf committed Jan 31, 2025
1 parent 170d533 commit c887867
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
2 changes: 1 addition & 1 deletion x-pack/platform/plugins/shared/osquery/common/constants.ts
Original file line number Diff line number Diff line change
Expand Up @@ -32,5 +32,5 @@ export const API_VERSIONS = {

export enum QUERY_TIMEOUT {
DEFAULT = 60, // 60 seconds
MAX = 60 * 15,
MAX = 60 * 60 * 24, // 24 hours
}
Original file line number Diff line number Diff line change
Expand Up @@ -37,12 +37,12 @@ describe('ALL - Live Query', { tags: ['@ess', '@serverless'] }, () => {
cy.contains('Query is a required field').should('not.exist');
checkResults();
getAdvancedButton().click();
fillInQueryTimeout('910');
fillInQueryTimeout('86410');
submitQuery();
cy.contains('The timeout value must be 900 seconds or or lower.');
cy.contains('The timeout value must be 86400 seconds or or lower.');
fillInQueryTimeout('890');
submitQuery();
cy.contains('The timeout value must be 900 seconds or or lower.').should('not.exist');
cy.contains('The timeout value must be 86400 seconds or or lower.').should('not.exist');
typeInOsqueryFieldInput('days{downArrow}{enter}');
submitQuery();
cy.contains('ECS field is required.');
Expand Down

0 comments on commit c887867

Please sign in to comment.