[octobus-query-exporter] switch to 20-15m range for audit_source

sapcc · May 27, 2024 · b5a0159 · b5a0159
1 parent a1e0054
commit b5a0159
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/...bus-query-exporter/vendor/octobus-query-exporter/files/queries/audit/audit_not_source.cfg b/...bus-query-exporter/vendor/octobus-query-exporter/files/queries/audit/audit_not_source.cfg
@@ -32,8 +32,8 @@ QueryJson = {
               {
                 "range": {
                   "@timestamp": {
-                    "gt": "now-5m",
-                    "format": "epoch_millis"
+                    "gte": "now-20m",
+                    "lte": "now-15m"
                   }
                 }
               }

diff --git a/...octobus-query-exporter/vendor/octobus-query-exporter/files/queries/audit/audit_source.cfg b/...octobus-query-exporter/vendor/octobus-query-exporter/files/queries/audit/audit_source.cfg
@@ -39,8 +39,8 @@ QueryJson = {
               {
                 "range": {
                   "@timestamp": {
-                    "gt": "now-5m",
-                    "format": "epoch_millis"
+                    "gte": "now-20m",
+                    "lte": "now-15m"
                   }
                 }
               }