Initialize the Entity Store

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Configuration for the entity store initialization.

delay string · pattern: [smdh]$ · default: 1m

The delay before the transform will run.

docsPerSecond integer

The number of documents per second to process.

enrichPolicyExecutionInterval string · pattern: ^[1-9]\d*[smh]$

Interval in which enrich policy runs. For example, "1h" means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,

entityTypes enum[]

Values: user host service

fieldHistoryLength integer · default: 10

The number of historical values to keep for each field.

filter string

frequency string · pattern: [smdh]$ · default: 1m

The frequency at which the transform will run.

indexPattern string

An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.

lookbackPeriod string · pattern: [smdh]$ · default: 24h

The amount of time the transform looks back to calculate the aggregations.

timeout string · pattern: [smdh]$ · default: 180s

The timeout for initializing the aggregating transform.

timestampField string · default: @timestamp

The field to use as the timestamp.