hi all, i have recently started experimenting with...
# macos
n
hi all, i have recently started experimenting with collecting process events with osquery and shipping those results to ELK. unfortunately what i'm seeing is that the events never expire, and so i'm sending the same old events every time osquery queries my process table, along with the new events, leading to tons of duplicates in the logs. i'm not sure why my old events never seem to expire. can anyone help?