180c57c35b
- fix: add missing ClickHouse driver dependency - fix: resolve race condition in orchestrator (single goroutine per source) - feat: add explicit source_type config for Unix socket sources - test: improve coverage from 50.6% to 62.0% - docs: add CHANGELOG.md with release notes - build: update version to 1.0.2 in build scripts and Dockerfiles Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
48 lines
1014 B
YAML
48 lines
1014 B
YAML
# logcorrelator configuration file
|
|
# Format: YAML
|
|
|
|
service:
|
|
name: logcorrelator
|
|
language: go
|
|
|
|
inputs:
|
|
unix_sockets:
|
|
- name: apache_source
|
|
path: /var/run/logcorrelator/apache.sock
|
|
format: json
|
|
source_type: A # Explicit source type: "A" for Apache/HTTP, "B" for Network
|
|
- name: network_source
|
|
path: /var/run/logcorrelator/network.sock
|
|
format: json
|
|
source_type: B # If not specified, auto-detection based on header_* fields
|
|
|
|
outputs:
|
|
file:
|
|
enabled: true
|
|
path: /var/log/logcorrelator/correlated.log
|
|
|
|
clickhouse:
|
|
enabled: false
|
|
dsn: clickhouse://user:pass@localhost:9000/db
|
|
table: correlated_logs_http_network
|
|
batch_size: 500
|
|
flush_interval_ms: 200
|
|
max_buffer_size: 5000
|
|
drop_on_overflow: true
|
|
async_insert: true
|
|
timeout_ms: 1000
|
|
|
|
stdout:
|
|
enabled: false
|
|
|
|
correlation:
|
|
key:
|
|
- src_ip
|
|
- src_port
|
|
time_window:
|
|
value: 1
|
|
unit: s
|
|
orphan_policy:
|
|
apache_always_emit: true
|
|
network_emit: false
|