evebox icon indicating copy to clipboard operation
evebox copied to clipboard

Inbox result can be very large

Open jasonish opened this issue 1 year ago • 0 comments

While the inbox view might be paginated, it's returned in one http response. This can be quite large if the grouping results in a large number of distinct IP address pairs. To start, the response could just return the fields needed to build the inbox display rather than the full event.

A further step would be to only send back the first page of results, doing some server side pagination. Server side pagination was not initially used as it was not supported the Elastic aggregation queries, but it may be supported now.

jasonish avatar Mar 17 '23 00:03 jasonish