[query_elasticsearch_octobus_jumpserver]
QueryIntervalSecs = 300
QueryTimeoutSecs = 15
QueryIndices = c0001_log7_jumphost*
QueryJson = {
        "aggs": {
          "logs": {
             "terms": {
               "field": "host.name",
               "size": 30
            }
          }
        },
        "size": 0,
        "_source": {
          "excludes": []
        },
        "stored_fields": [
          "*"
        ],
        "script_fields": {},
        "docvalue_fields": [
          {
            "field": "@timestamp",
            "format": "date_time"
          },
          {
            "field": "time",
            "format": "date_time"
          }
        ],
        "query": {
          "bool": {
            "must": [
              {
                "match_all": {}
              },
              {
                "range": {
                  "@timestamp": {
                    "gt": "now-15m",
                    "format": "epoch_millis"
                  }
                }
              }
            ],
            "filter": [],
            "should": [],
            "must_not": []
          }
        }
    }

[query_elasticsearch_octobus_jumpserver]
QueryIntervalSecs = 300
QueryTimeoutSecs = 150
QueryIndices = c0001_log7_jumphost*
QueryJson = {
        "aggs": {
          "logs": {
             "terms": {
               "field": "host.name.keyword",
               "size": 30
            }
          }
        },
        "size": 0,
        "_source": {
          "excludes": []
        },
        "stored_fields": [
          "*"
        ],
        "script_fields": {},
        "docvalue_fields": [
          {
            "field": "@timestamp",
            "format": "date_time"
          },
          {
            "field": "time",
            "format": "date_time"
          }
        ],
        "query": {
          "bool": {
            "must": [
              {
                "match_all": {}
              },
              {
                "range": {
                  "@timestamp": {
                    "gt": "now-15m",
                    "format": "epoch_millis"
                  }
                }
              }
            ],
            "filter": [],
            "should": [],
            "must_not": []
          }
        }
    }

Use keyword field, extend timeout
[octobus-query-exporter] Use keyword field, extend timeout
