alerts/plugins/possible_usernames.json

{
  "search_window_hours": 24,
  "indices_to_search": ["events-*"]
}