# Please don't modify this file as your changes might be overwritten with
# the next update.
#
# You can modify 'local.d/elastic.conf' to add and merge
# parameters defined inside this section
#
# You can modify 'override.d/elastic.conf' to strictly override all
# parameters defined inside this section
#
# See https://rspamd.com/doc/faq.html#what-are-the-locald-and-overrided-directories
# for details
#
# Module documentation can be found at  https://rspamd.com/doc/modules/elastic.html

elastic {
  enabled = false;
  # server = "localhost:9200";
  # user = "";
  # password = "";
  use_https = false;
  periodic_interval = 5.0;
  timeout = 5.0;
  no_ssl_verify = false;
  use_gzip = true;
  use_keepalive = true;
  version = {
    autodetect_enabled = true;
    autodetect_max_fail = 12;
    # override works only if autodetect is disabled
    override = {
      name = "opensearch";
      version = "2.17";
    }
  };
  limits = {
    max_rows = 500; # max logs in one bulk req to elastic and first reason to flush buffer to elastic
    max_interval = 60; # seconds, if first log in buffer older then interval - flush buffer
    max_size = 5000000; # max symbols count in buffer, if reached - flush buffer, f.e: 5000000 ~= 10MB/normal-worker
    max_fail = 3;
  };
  index_template = {
    managed = true;
    name = "rspamd";
    priority = 0;
    pattern = "%Y.%m.%d";
    shards_count = 3;
    replicas_count = 1;
    refresh_interval = 5; # seconds
    dynamic_keyword_ignore_above = 256;
    headers_text_ignore_above = 2048; # strip headers value and add "..." to the end; set 0 to disable limit
    symbols_nested = false;
    empty_value = "unknown"; # empty numbers, ips and ipnets are not customizable they will be always 0, :: and ::/128 respectively
  };
  index_policy = {
    enabled = true;
    managed = true;
    name = "rspamd"; # if you want use custom lifecycle policy, change name and set managed = false
    hot = {
      index_priority = 100;
    };
    warm = {
      enabled = true;
      after = "2d";
      index_priority = 50;
      migrate = true; # only supported with elastic distro, will not have impact elsewhere
      read_only = true;
      change_replicas = false;
      replicas_count = 1;
      shrink = false;
      shards_count = 1;
      max_gb_per_shard = 0; # zero - disabled by default, if enabled - shards_count is ignored
      force_merge = false;
      segments_count = 1;
    };
    cold = {
      enabled = true;
      after = "14d";
      index_priority = 0;
      migrate = true; # only supported with elastic distro, will not have impact elsewhere
      read_only = true;
      change_replicas = false;
      replicas_count = 1;
    };
    delete = {
      enabled = true;
      after = "30d";
    };
  };
  collect_headers = [
    "From";
    "To";
    "Subject";
    "Date";
    "User-Agent";
  ];
  # extra headers to collect, f.e.:
  # "Precedence";
  # "List-Id";
  extra_collect_headers = [];
  geoip = {
    enabled = true;
    managed = true;
    pipeline_name = "rspamd-geoip";
  };

  .include(try=true,priority=5) "${DBDIR}/dynamic/elastic.conf"
  .include(try=true,priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/elastic.conf"
  .include(try=true,priority=10) "$LOCAL_CONFDIR/override.d/elastic.conf"
}