Skip to content

Commit ed3cacb

Browse files
[DOCS] Increase maximum Osquery timeout (elastic#213918)
Contributes to elastic/docs-content#347. Updates Osquery docs to reflect that the maximum query timeout has been increased to 86400 seconds (24 hours). Corresponding PR for 8.x Security docs: elastic/security-docs#6590 Corresponding PR for 9.x docs: elastic/docs-content#726 (cherry picked from commit 74441a1)
1 parent c5eaead commit ed3cacb

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

docs/osquery/osquery.asciidoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ and you'll get suggestions for agents by name, ID, platform, and policy.
4545
. Specify the query or pack to run:
4646
** *Query*: Select a saved query or enter a new one in the text box. After you enter the query, you can expand the **Advanced** section to set a timeout period for the query, and view or set <<osquery-map-fields,mapped ECS fields>> included in the results from the live query (optional).
4747
+
48-
NOTE: Overwriting the query's default timeout period allows you to support queries that require more time to complete. The default and minimum supported value for the **Timeout** field is `60`. The maximum supported value is `900`.
48+
NOTE: Overwriting the query's default timeout period allows you to support queries that require more time to complete. The default and minimum supported value for the **Timeout** field is `60`. The maximum supported value is `86400` (24 hours).
4949
** *Pack*: Select from available query packs. After you select a pack, all of the queries in the pack are displayed.
5050
+
5151
TIP: Refer to <<osquery-prebuilt-packs,prebuilt packs>> to learn about using and managing Elastic prebuilt packs.
@@ -110,7 +110,7 @@ Each query must include a unique query ID and the interval at which it should ru
110110
Optionally, set the minimum Osquery version and platform, specify a timeout period,
111111
or <<osquery-map-fields,map ECS fields>>. When you add a saved query to a pack, this adds a copy of the query. A connection is not maintained between saved queries and packs.
112112
+
113-
NOTE: Overwriting the query's default timeout period allows you to support queries that require more time to complete. The default and minimum supported value for the **Timeout** field is `60`. The maximum supported value is `900`.
113+
NOTE: Overwriting the query's default timeout period allows you to support queries that require more time to complete. The default and minimum supported value for the **Timeout** field is `60`. The maximum supported value is `86400` (24 hours).
114114

115115
** Upload queries from a `.conf` query pack by dragging the pack to the drop zone under the query table. To explore the community packs that Osquery publishes, click *Example packs*.
116116

@@ -152,7 +152,7 @@ Once you save a query, you can only edit it from the *Saved queries* tab:
152152

153153
* The SQL query (required). Osquery supports multi-line queries.
154154

155-
* A timeout period (optional). Increase the query's default timeout period to support queries that require more time to complete. The default and minimum supported value for the **Timeout** field is `60`. The maximum supported value is `900`.
155+
* A timeout period (optional). Increase the query's default timeout period to support queries that require more time to complete. The default and minimum supported value for the **Timeout** field is `60`. The maximum supported value is `86400` (24 hours).
156156

157157
* The <<osquery-map-fields,ECS fields>> to populate when the query is run (optional). These fields are also copied in when you add this query to a pack.
158158

0 commit comments

Comments
 (0)