# logcorrelator configuration file
# Format: YAML

service:
  name: logcorrelator
  language: go

inputs:
  unix_sockets:
    - name: apache_source
      path: /var/run/logcorrelator/apache.sock
      format: json
      source_type: A  # Explicit source type: "A" for Apache/HTTP, "B" for Network
    - name: network_source
      path: /var/run/logcorrelator/network.sock
      format: json
      source_type: B  # If not specified, auto-detection based on header_* fields

outputs:
  file:
    enabled: true
    path: /var/log/logcorrelator/correlated.log

  clickhouse:
    enabled: false
    dsn: clickhouse://user:pass@localhost:9000/db
    table: correlated_logs_http_network
    batch_size: 500
    flush_interval_ms: 200
    max_buffer_size: 5000
    drop_on_overflow: true
    async_insert: true
    timeout_ms: 1000

  stdout:
    enabled: false

correlation:
  key:
    - src_ip
    - src_port
  time_window:
    value: 1
    unit: s
  orphan_policy:
    apache_always_emit: true
    network_emit: false