heya! my understanding is that with pubsub events, the

events_expiry

flag is used during

SELECT

to expire "old" events out of rocksdb. if i have a query like

SELECT * FROM file_events where target_path not like '/etc/blkid%'

will events for stuff under

/etc/blkid

be expired from rocksdb?

all events that your query returns are expired

thanks @b0l. so how do i ensure the events i’m not selecting expire?

@b0l that is incorrect. All events from that table (

file_events

) that are older than the configured

events_expiry

will be expired. Separately, if

events_optimize

is turned on (on by default), that specific query will skip results it has already seen on the next run.

@zwass if events_expiry is sent to 1 sec, are them available also after one sec and expired after the query?

Events are only expired after a query is made to that table. That means that setting

events_expiry

to 1 second will cause the events to expire after every query. If only one query is hitting the table that can be a good strategy for keeping the caches cleared. If multiple queries hit that table you are likely to have problems.

yes, events_expiry=1 could be used to forward all events via tls running the queries, I guess