humio-audit Query Structure
The query structure defines information about the query used at the time of the audit event. A scheduled search or alert uses a query executed by a specific user with specific criteria. The basic format of the structure has the following fields:
query.allowEventSkipping — whether event skipping was enabled
query.end — the end time of the selected interval
query.includeDeletedEvents — did the query included deleted events
query.ingestEnd — timestamp end of when the returned events were ingested.
query.ingestStart — timestamp start of when the returned events were ingested.
query.isAlertQuery — was the query triggered as part of an alert
query.isInteractive — was the query interactive (true if through the UI or via the API; false when through an automation such as an alert or scheduled search). The value is used by LogScale to determine whether the user can continue to interact with the query results and enables LogScale to be more responsive in those situations.
query.isLive — was the query executed in live mode
query.isRepeatingSubquery — was it a repeating subquery of another query
query.languageVersion — what language version was used to parse the query string
query.noResultUntilDone — was the result delayed until the full data set was ready (uused in some alerts)
query.queryString — the query string
query.showQueryEventDistribution — whether query event distibution was enabled
query.start — the start time of the selected interval
query.timeZoneOffsetMinutes — timezone offset
query.useIngestTime — the timestamp when the data was ingested