Skip to content

[9.4] [Entity Store] Change defaults to conservative values (#270617)#270915

Merged
romulets merged 1 commit into
elastic:9.4from
romulets:backport/9.4/pr-270617
May 25, 2026
Merged

[9.4] [Entity Store] Change defaults to conservative values (#270617)#270915
romulets merged 1 commit into
elastic:9.4from
romulets:backport/9.4/pr-270617

Conversation

@romulets
Copy link
Copy Markdown
Member

Backport

This will backport the following commits from main to 9.4:

Questions ?

Please refer to the Backport tool documentation

## Summary

Update entity store defaults to a conservative number:
- maxLogsPerPage: 50k
- maxLogsPerWindow: 100k

Meaning, we will process at most 50k logs in each query of entity store,
and in a single window, if it observes more than 100k logs (two pages)
we don't process those logs.

This can be configured via update api to better align with customers'
setup and needs.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit b9560c5)

# Conflicts:
#	x-pack/solutions/security/plugins/entity_store/server/domain/asset_manager/asset_manager_client.test.ts
@romulets romulets requested a review from kibanamachine as a code owner May 25, 2026 07:39
@romulets romulets added the backport This PR is a backport of another PR label May 25, 2026
@romulets romulets enabled auto-merge (squash) May 25, 2026 07:39
@kibanamachine kibanamachine requested review from florent-leborgne and removed request for kibanamachine May 25, 2026 07:39
@romulets romulets requested review from uri-weisman and removed request for florent-leborgne May 25, 2026 07:45
@romulets romulets self-assigned this May 25, 2026
@kibanamachine
Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

✅ unchanged

cc @romulets

@romulets romulets merged commit ca34ded into elastic:9.4 May 25, 2026
35 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants