jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
https://evebox.org/
MIT License
414 stars 67 forks source link

Rethink time selector, in particular the "All" option #313

Open jasonish opened 1 month ago

jasonish commented 1 month ago

Using all is nice while your database is small, but on a load instance, even 24 hours can put excessive strain on a system causing very long, uncancellable query times. Perhaps there is a reason Kibana and other tools default to 15 minutes.

This can be especially bad on SQLite installs.

Some ideas:

I don't think there is one solution that is better for all scenarios, so it might be best to move the time selector out of the top nav and make it the best for the data being displayed.