chore: version 1.0.6 - simplify YAML configuration
- Remove service.name and service.language (unused) - Remove enabled flags on outputs (presence = enabled) - Simplify correlation config: time_window_s (integer) instead of nested object - Simplify orphan_policy to emit_orphans boolean - Rename apache socket to http.socket - Add socket_permissions option for unix sockets (default: 0660) - Update tests for new configuration format Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
This commit is contained in:
@ -76,46 +76,28 @@ config:
|
||||
stocké dans /etc/logcorrelator.
|
||||
reload_strategy: restart_service
|
||||
example: |
|
||||
# Service configuration
|
||||
service:
|
||||
name: logcorrelator
|
||||
language: go
|
||||
|
||||
# Input sources (at least 2 required)
|
||||
# Inputs - at least 2 unix sockets required
|
||||
inputs:
|
||||
unix_sockets:
|
||||
- name: apache_source
|
||||
path: /var/run/logcorrelator/apache.sock
|
||||
format: json
|
||||
- name: network_source
|
||||
path: /var/run/logcorrelator/network.sock
|
||||
format: json
|
||||
- name: http
|
||||
path: /var/run/logcorrelator/http.socket
|
||||
socket_permissions: "0660"
|
||||
- name: network
|
||||
path: /var/run/logcorrelator/network.socket
|
||||
|
||||
# File output
|
||||
# Outputs
|
||||
outputs:
|
||||
file:
|
||||
enabled: true
|
||||
path: /var/log/logcorrelator/correlated.log
|
||||
|
||||
# ClickHouse output
|
||||
outputs:
|
||||
clickhouse:
|
||||
enabled: false
|
||||
dsn: clickhouse://user:pass@localhost:9000/db
|
||||
table: correlated_logs_http_network
|
||||
batch_size: 500
|
||||
table: correlated_logs
|
||||
stdout: false
|
||||
|
||||
# Correlation configuration
|
||||
# Correlation (optional)
|
||||
correlation:
|
||||
key:
|
||||
- src_ip
|
||||
- src_port
|
||||
time_window:
|
||||
value: 1
|
||||
unit: s
|
||||
orphan_policy:
|
||||
apache_always_emit: true
|
||||
network_emit: false
|
||||
time_window_s: 1
|
||||
emit_orphans: true
|
||||
|
||||
inputs:
|
||||
description: >
|
||||
|
||||
Reference in New Issue
Block a user