Eql with time range

Elastic Stack Elasticsearch
1

Hi guys,
I'm looking for EQL to match logs with a timestamp within the last 5 minutes.
I have read a with maxspan statement, but it has some limitation:

  • It must be used with sequence
  • it starts at the first event’s timestamp (not now() ).

How can I do this?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.