mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-24 18:03:10 +01:00
fix query
This commit is contained in:
@@ -112,7 +112,7 @@
|
||||
"measurement": "logstash_events",
|
||||
"orderByTime": "ASC",
|
||||
"policy": "default",
|
||||
"query": "SELECT non_negative_derivative(mean(\"in\"), 1s) FROM \"logstash_events\" WHERE (\"cluster_name\" = \"$cluster_name\") AND $timeFilter GROUP BY time($__interval), \"host\" fill(null)",
|
||||
"query": "SELECT non_negative_derivative(mean(\"in\"), 1s) FROM \"logstash_events\" WHERE (\"role\" =~ \"manager\") AND $timeFilter GROUP BY time($__interval), \"host\" fill(null)",
|
||||
"rawQuery": false,
|
||||
"refId": "A",
|
||||
"resultFormat": "time_series",
|
||||
@@ -138,9 +138,21 @@
|
||||
],
|
||||
"tags": [
|
||||
{
|
||||
"key": "cluster_name",
|
||||
"key": "role",
|
||||
"operator": "=~",
|
||||
"value": "/^manager/"
|
||||
},
|
||||
{
|
||||
"key": "role",
|
||||
"value": "standalone",
|
||||
"operator": "=",
|
||||
"value": "$cluster_name"
|
||||
"condition": "OR"
|
||||
},
|
||||
{
|
||||
"key": "role",
|
||||
"value": "eval",
|
||||
"operator": "=",
|
||||
"condition": "OR"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user