mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-08-28 02:18:22 +02:00
Josh Patterson
c1f256e630
Widen the byte-size regex, which rejected values Logstash accepts and so blocked the save in SOC: bare-letter units (1g, 512m, 64k), decimals (1.5gb), whitespace before the unit, and a bare integer. Allow whitespace in dead_letter_queue.retain.age (5 d). Both stay lowercase-only, matching byte_value.rb and AbstractPipelineExt.parseToDuration. Fix description gaps: queue.checkpoint.retry is a Windows/SAN workaround Elastic does not otherwise recommend, batch metrics sampling is technical preview, queue.checkpoint.interval is deprecated in 9.1, compression makes a queue unreadable by Logstash before 9.2, flush_check_interval has a 1000ms floor, max_events counts unread events, and the path settings are created by Logstash but reject symlinks. Note which settings apply only to persisted queues or an enabled DLQ. Drop the undocumented 'disabled' value from queue.compression. Numeric fields stay stricter than NumericSetting, which has no validator and would accept negatives, floats and NaN in event counts and intervals.