You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is a meta ticket for must-have improvements now that EQL supports sequences.
tie-breaker support
Due to the distributed nature of ingestion it is quite possible for events to occur at the same time which does require a user-defined tie-breaker to establish serialization, separate from the document-based one in Elasticsearch (_doc).
Further more this is used by the existing EQL test suite - without it some fails will surely fail.
internal pagination
In order to find X results, the sequence runtime must go through multiple internal pages before sending out the current results. Regardless of the client pagination, the algorithm needs to be able to handle its own pagination which is the norm for large datasets.
The text was updated successfully, but these errors were encountered:
This is a meta ticket for must-have improvements now that EQL supports sequences.
tie-breaker support
Due to the distributed nature of ingestion it is quite possible for events to occur at the same time which does require a user-defined tie-breaker to establish serialization, separate from the document-based one in Elasticsearch (
_doc
).Further more this is used by the existing EQL test suite - without it some fails will surely fail.
internal pagination
In order to find X results, the sequence runtime must go through multiple internal pages before sending out the current results. Regardless of the client pagination, the algorithm needs to be able to handle its own pagination which is the norm for large datasets.
The text was updated successfully, but these errors were encountered: