Initialize an Entity Engine

entityType enum required

The entity type of the engine (either 'user' or 'host').

Values: user host service

Schema for the engine initialization

delay string · pattern: [smdh]$ · default: 1m

The delay before the transform will run.

docsPerSecond integer

The number of documents per second to process.

enrichPolicyExecutionInterval string · pattern: ^[1-9]\d*[smh]$

Interval in which enrich policy runs. For example, "1h" means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,

fieldHistoryLength integer · default: 10

The number of historical values to keep for each field.

filter string

frequency string · pattern: [smdh]$ · default: 1m

The frequency at which the transform will run.

indexPattern string

An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.

lookbackPeriod string · pattern: [smdh]$ · default: 24h

The amount of time the transform looks back to calculate the aggregations.

timeout string · pattern: [smdh]$ · default: 180s

The timeout for initializing the aggregating transform.

timestampField string · default: @timestamp

The field to use as the timestamp for the entity type.