# See https://rspamd.com/doc/faq.html#what-are-the-locald-and-overrided-directories
# for details
#
-# Module documentation can be found at https://rspamd.com/doc/modules/elastic.html
+# Module documentation can be found at https://rspamd.com/doc/modules/elastic.html
elastic {
enabled = false;
version = {
autodetect_enabled = true;
autodetect_max_fail = 30;
- # override works only if autodetect is disabled
+ # Override works only if autodetect is disabled
override = {
name = "opensearch";
version = "2.17";
}
};
limits = {
- max_rows = 500; # max logs in one bulk req to elastic and first reason to flush buffer to elastic
- max_interval = 60; # seconds, if first log in buffer older then interval - flush buffer
+ max_rows = 500; # Max logs in one bulk request to Elastic and the first reason to flush buffer to Elastic
+ max_interval = 60; # Seconds; if the first log in the buffer is older than this interval, flush the buffer
max_fail = 10;
};
index_template = {
pattern = "%Y.%m.%d";
shards_count = 3;
replicas_count = 1;
- refresh_interval = 5; # seconds
+ refresh_interval = 5; # Seconds
dynamic_keyword_ignore_above = 256;
- headers_count_ignore_above = 5; # record only N first same named headers, add "ignored above..." if reached, set 0 to disable limit
- headers_text_ignore_above = 2048; # strip specific header value and add "..." to the end; set 0 to disable limit
+ headers_count_ignore_above = 5; # Record only the first N same-named headers, add "ignored above..." if the limit is reached; set 0 to disable the limit
+ headers_text_ignore_above = 2048; # Strip specific header value and add "..." to the end; set 0 to disable the limit
symbols_nested = false;
- empty_value = "unknown"; # empty numbers, ips and ipnets are not customizable they will be always 0, :: and ::/128 respectively
+ empty_value = "unknown"; # Empty numbers, IPs and IP nets are not customizable; they will always be 0, :: and ::/128 respectively
};
index_policy = {
enabled = true;
managed = true;
- name = "rspamd"; # if you want use custom lifecycle policy, change name and set managed = false
+ name = "rspamd"; # To use a custom lifecycle policy, change the name and set managed = false
hot = {
index_priority = 100;
};
enabled = true;
after = "2d";
index_priority = 50;
- migrate = true; # only supported with elastic distro, will not have impact elsewhere
+ migrate = true; # Supported only with Elastic distro; has no impact elsewhere
read_only = true;
change_replicas = false;
replicas_count = 1;
shrink = false;
shards_count = 1;
- max_gb_per_shard = 0; # zero - disabled by default, if enabled - shards_count is ignored
+ max_gb_per_shard = 0; # Zero - disabled by default, if enabled - shards_count is ignored
force_merge = false;
segments_count = 1;
};
enabled = true;
after = "14d";
index_priority = 0;
- migrate = true; # only supported with elastic distro, will not have impact elsewhere
+ migrate = true; # Supported only with Elastic distro; has no impact elsewhere
read_only = true;
change_replicas = false;
replicas_count = 1;
"Date";
"User-Agent";
];
- # extra headers to collect, f.e.:
+ # Extra headers to collect, e.g.:
# "Precedence";
# "List-Id";
extra_collect_headers = [];