awatch-rus/AWatch-rus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(portal): enable clickhouse security event aggregate

Browse Source
This commit is contained in:
igor04091968
2026-06-04 23:01:32 +03:00
parent 2cb1afad4f
commit 6a6c69e803
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adk-rust/crates/detmir-portal/src/main.rs
+1 -1
View File
@@ -2393,7 +2393,7 @@ SELECT
toUInt64(countIf((positionCaseInsensitive(search, 'agent') > 0 OR positionCaseInsensitive(search, 'collector') > 0) AND (positionCaseInsensitive(search, 'error') > 0 OR positionCaseInsensitive(search, 'fail') > 0))) AS agent_errors_24h, toUInt64(countIf((positionCaseInsensitive(search, 'agent') > 0 OR positionCaseInsensitive(search, 'collector') > 0) AND (positionCaseInsensitive(search, 'error') > 0 OR positionCaseInsensitive(search, 'fail') > 0))) AS agent_errors_24h,
nullIf(formatDateTime(max(ts), '%Y-%m-%dT%H:%i:%SZ'), '1970-01-01T00:00:00Z') AS last_event_utc nullIf(formatDateTime(max(ts), '%Y-%m-%dT%H:%i:%SZ'), '1970-01-01T00:00:00Z') AS last_event_utc
FROM ( FROM (
SELECT ts, concat(event_type, ' ', severity, ' ', source, ' ', summary) AS search SELECT ts, severity, concat(event_type, ' ', severity, ' ', source, ' ', summary) AS search
FROM {database}.entity_timeline FROM {database}.entity_timeline
WHERE ts >= since WHERE ts >= since
) )