securityonion/salt/influxdb/soc_influxdb.yaml

influxdb:
  config:
    bolt-path: /var/lib/influxdb2/influxd.bolt
      description: Path to the bolt DB file located inside the so-influxdb container.
      global: True
      advanced: True
      helpLink: influxdb.html
    engine-path: /var/lib/influxdb2/engine
      description: Path to the engine directory located inside the so-influxdb container. This directory stores the time series data.
      global: True
      advanced: True
      helpLink: influxdb.html
    feature-flags:
      description: List of key=value flags to enable.
      global: True
      advanced: True
      helpLink: influxdb.html
    flux-log-enabled: false
      description: Controls whether detailed flux query logging is enabled.
      global: True
      advanced: True
      helpLink: influxdb.html
    hardening-enabled: true
      description: If true, enforces outbound connections from the InfluxDB process must never attempt to reach an internal, private network address.
      global: True
      advanced: True
      helpLink: influxdb.html
    http-bind-address: :8086
      description: The URL and port on which InfluxDB will listen for new connections.
      global: True
      advanced: True
      helpLink: influxdb.html
    http-idle-timeout: 0
      description: Keep-alive timeout while a connection waits for new requests. A value of 0 is the same as no timeout enforced.
      global: True
      advanced: True
      helpLink: influxdb.html
    http-read-header-timeout: 10s
      description: The duration to wait for a request header before closing the connection. A value of 0 is the same as no timeout enforced.
      global: True
      advanced: True
      helpLink: influxdb.html
    http-read-timeout: 0
      description: The duration to wait for the request to be fully read before closing the connection. A value of 0 is the same as no timeout enforced.
      global: True
      advanced: True
      helpLink: influxdb.html
    http-write-timeout: 0
      description: The duration to wait for the response to be fully written before closing the connection. A value of 0 is the same as no timeout enforced.
      global: True
      advanced: True
      helpLink: influxdb.html
    influxql-max-select-buckets: 0
      description: Maximum number of group-by clauses in a SELECT statement. A value of 0 is the same as unlimited.
      global: True
      advanced: True
      helpLink: influxdb.html
    influxql-max-select-point: 0
      description: Maximum number of points that can be queried in a SELECT statement. A value of 0 is the same as unlimited.
      global: True
      advanced: True
      helpLink: influxdb.html
    influxql-max-select-series: 0
      description: Maximum number of series that can be returned in a SELECT statement. A value of 0 is the same as unlimited.
      global: True
      advanced: True
      helpLink: influxdb.html
    instance-id:
      description: Unique instance ID for this server, to avoid collisions in a replicated cluster.
      global: True
      advanced: True
      helpLink: influxdb.html
    log-level: info
      description: The log level to use for outputting log statements. Allowed values are debug, info, or error.
      global: True
      advanced: false
      regex: ^(info|debug|error)$
      helpLink: influxdb.html
    metrics-disabled: true
      description: If true, the HTTP endpoint that exposes internal InfluxDB metrics will be inaccessible.
      global: True
      advanced: True
      helpLink: influxdb.html
    no-tasks: false
      description: If true, the task system will not process any queued tasks. Useful for troubleshooting startup problems.
      global: True
      advanced: True
      helpLink: influxdb.html
    pprof-disabled: true
      description: If true, the profiling data HTTP endpoint will be inaccessible.
      global: True
      advanced: True
      helpLink: influxdb.html
    query-concurrency: 100
      description: Maximum number of queries to execute concurrently. A value of 0 is the same as unlimited.
      global: True
      advanced: True
      helpLink: influxdb.html
    query-initial-memory-bytes: 1073741824
      description: The initial number of bytes of memory to allocate for a new query.
      global: True
      advanced: True
      helpLink: influxdb.html
    query-max-memory-bytes: 107374182400
      description: The number of bytes of memory to allocate to all running queries. Should typically be the query bytes times the max concurrent queries.
      global: True
      advanced: True
      helpLink: influxdb.html
    query-memory-bytes: 1073741824
      description: Maximum number of bytes of memory to allocate to a query.
      global: True
      advanced: True
      helpLink: influxdb.html
    query-queue-size: 500
      description: Maximum number of queries that can be queued at one time. If this value is reached, new queries will not be queued. A value of 0 is the same as unlimited.
      global: True
      advanced: True
      helpLink: influxdb.html
    reporting-disabled: true
      description: If true, prevents InfluxDB from sending telemetry updates to InfluxData's servers.
      global: True
      advanced: True
      helpLink: influxdb.html
    secret-store: bolt
      description: Determines the type of storage used for secrets. Allowed values are bolt or vault.
      global: True
      advanced: True
      regex: ^(bolt|vault)$
      helpLink: influxdb.html
    session-length: 60
      description: Number of minutes that a user login session can remain authenticated. 
      global: True
      advanced: True
      helpLink: influxdb.html
    session-renew-disabled: false
      description: If true, user login sessions will renew after each request.
      global: True
      advanced: True
      helpLink: influxdb.html
    sqlite-path: /var/lib/influxdb2/influxd.sqlite
      description: Path to the Sqlite3 database inside the container. This database stored user data and other information about the database.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-cache-max-memory-size: 1073741824
      description: Maximum number of bytes to allocate to cache data per shard. If exceeded, new data writes will be rejected.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-cache-snapshot-memory-size: 26214400
      description: Number of bytes to allocate to cache snapshot data. When the cache reaches this size, it will be written to disk to increase available memory.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-cache-snapshot-write-cold-duration: 10m0s
      description: Duration between snapshot writes to disk when the shard data hasn't been modified.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-compact-full-write-cold-duration: 4h0m0s
      description: Duration between shard compactions when the shard data hasn't been modified.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-compact-throughput-burst: 50331648
      description: Maximum throughput (number of bytes per second) that compactions be written to disk.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-max-concurrent-compactions: 0
      description: Maximum number of concurrent compactions. A value of 0 is the same as half the available CPU processors (procs).
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-max-index-log-file-size: 1048576
      description: Maximum number of bytes of a write-ahead log (WAL) file before it will be compacted into an index on disk.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-no-validate-field-size: false
      description: If true, incoming requests will skip the field size validation.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-retention-check-interval: 30m0s
      description: Interval between reviewing each bucket's retention policy and the age of the associated data.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-series-file-max-concurrent-snapshot-compactions: 0
      description: Maximum number of concurrent snapshot compactions across all database partitions.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-series-id-set-cache-size: 100
      description: Maximum size of the series cache results. Higher values may increase performance for repeated data lookups.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-shard-precreator-advance-period: 30m0s
      description: The duration before a successor shard group is created after the end-time has been reached. 
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-shard-precreator-check-interval: 10m0s
      description: Interval between checking if new shards should be created.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-tsm-use-madv-willneed: false
      description: If true, InfluxDB will manage TSM memory paging.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-validate-keys: false
      description: If true, validates incoming requests for supported characters.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-wal-fsync-delay: 0s
      description: Duration to wait before calling fsync. Useful for handling conflicts on slower disks.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-wal-max-concurrent-writes: 0
      description: Maximum number of concurrent write-ahead log (WAL) writes to disk. The value of 0 is the same as CPU processors (procs) x 2.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-wal-max-write-delay: 10m
      description: Maximum duration to wait before writing the write-ahead log (WAL) to disk, when the concurrency limit has been exceeded. A value of 0 is the same as no timeout.
      global: True
      advanced: True
      helpLink: influxdb.html
    storage-write-timeout: 10s
      description: Maximum time to wait for a write-ahead log (WAL) to write to disk before aborting.
      global: True
      advanced: True
      helpLink: influxdb.html
    store: disk
      description: The type of data store to use for HTTP resources. Allowed values are disk or memory. Memory should not be used for production Security Onion installations.
      global: True
      advanced: True
      regex: ^(disk|memory)$
      helpLink: influxdb.html
    tls-cert: /conf/influxdb.crt
      description: The container path to the certificate to use for TLS encryption of the HTTP requests and responses.
      global: True
      advanced: True
      helpLink: influxdb.html
    tls-key: /conf/influxdb.key
      description: The container path to the certificate key to use for TLS encryption of the HTTP requests and responses.
      global: True
      advanced: True
      helpLink: influxdb.html
    tls-min-version: 1.2
      description: The minimum supported version of TLS to be enforced on all incoming HTTP requests.
      global: True
      advanced: True
      helpLink: influxdb.html
    tls-strict-ciphers: true
      description: If true, the allowed ciphers used with TLS connections are ECDHE_RSA_WITH_AES_256_GCM_SHA384, ECDHE_RSA_WITH_AES_256_CBC_SHA, RSA_WITH_AES_256_GCM_SHA384, or RSA_WITH_AES_256_CBC_SHA.
      global: True
      advanced: True
      helpLink: influxdb.html
    tracing-type: log
      description: The tracing format for debugging purposes. Allowed values are log or jaeger, or leave blank to disable tracing.
      global: True
      advanced: True
      helpLink: influxdb.html
    ui-disabled: false
      description: If true, the InfluxDB HTTP user interface will be disabled. This will prevent use of the included InfluxDB dashboard visualizations.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-addr: 
      description: Vault server address.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-cacert: 
      description: Path to the Vault's single certificate authority certificate file within the container.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-capath: 
      description: Path to the Vault's certificate authority directory within the container.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-client-cert: 
      description: Vault client certificate path within the container.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-client-key: 
      description: Vault client certificate key path within the container.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-client-timeout: 60s
      description: Duration to wait for a response from the Vault server before aborting.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-max-retries: 2
      description: Maximum number of retries when attempting to contact the Vault server. A value of 0 is the same as disabling retries.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-skip-verify: false
      description: Skip certification validation of the Vault server.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-tls-server-name: 
      description: SNI host to specify when using TLS to connect to the Vault server.
      global: True
      advanced: True
      helpLink: influxdb.html
    vault-token:   
      description: Vault token used for authentication.
      global: True
      advanced: True
      helpLink: influxdb.html
  retention_policies:
    so_short_term:
      duration:
        description: Amount of time to keep short term data.
        global: True
        helpLink: influxdb.html
      shard_duration:
        description: Time range 
        global: True
        helpLink: influxdb.html
    so_long_term:
      duration:
        description: Amount of time to keep long term downsampled data.
        global: True
        helpLink: influxdb.html
      shard_duration:
        description: Amount of the time range covered by the shard group.
        global: True
        helpLink: influxdb.html
  downsample:
    so_long_term:
      resolution:
        description: Amount of time to turn into a single data point.
        global: True
        helpLink: influxdb.html