# Correlator config for integration tests
log:
  level: DEBUG

inputs:
  unix_sockets:
    - name: http
      source_type: A
      path: /var/run/logcorrelator/http.socket
      format: json
      socket_permissions: "0666"
    - name: network
      source_type: B
      path: /var/run/logcorrelator/network.socket
      format: json
      socket_permissions: "0666"

outputs:
  clickhouse:
    enabled: true
    dsn: clickhouse://default:@clickhouse:9000/ja4_logs
    table: http_logs_raw
    batch_size: 10
    flush_interval_ms: 500
    max_buffer_size: 5000
    drop_on_overflow: false
    async_insert: true
    timeout_ms: 5000

  file:
    enabled: true
    path: /var/log/logcorrelator/correlated.log

  stdout:
    enabled: true

correlation:
  time_window:
    value: 10
    unit: s
  orphan_policy:
    apache_always_emit: true
    apache_emit_delay_ms: 1000
    network_emit: false
  matching:
    mode: one_to_many
  buffers:
    max_http_items: 10000
    max_network_items: 20000
  ttl:
    network_ttl_s: 120
