Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

keep discoverds fileds in separate sqlite

Browse Source
This commit is contained in:
larssand
2026-07-02 12:51:36 +02:00
parent cc6c97ec79
commit d48d34f96c
5 changed files with 134 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -153,6 +153,15 @@ categorical, numeric, and detector fields. Existing profile names, field weights
and detector threshold settings are preserved, so this is the fast path after
field-alias matching improves or after Graylog starts parsing additional fields.
Profile discovery is accumulated over monitor cycles. This matters in high-EPS
environments where each poll only fetches a raw sample for context while
aggregate queries count the full window. Fields seen in earlier samples are kept
in the local history database and continue to participate in recommended
profiles and shared-field matching even if the current raw sample does not
contain them. This lets late-arriving or less frequent fields such as custom
`lcs_*` application fields stay visible long enough to be reviewed and appended
to an existing profile.
Enabled streams are normalized through the same event model. Stream profiles
define the entity, timestamp, categorical, and numeric fields used for baselines.
The dashboard and Ollama then correlate behavior across sources, for example a