config.ini

[default]
elasticsearch=http://127.0.0.1:9200
rotateIndex=daily
passwordSecret=password
httpRealm=Arkime
webBasePath=/
interface=lo
bpf=not port 9200
yara=/dev/null
pcapDir=/opt/arkime/raw
maxFileSizeG=12
maxFileTimeM=0
tcpTimeout=600
tcpSaveTimeout=720
udpTimeout=30
icmpTimeout=10
maxStreams=1000000
maxPackets=10000
freeSpaceG=5%
viewPort=8005
viewHost=localhost
viewUrl=https://HOSTNAME:8005
geoLite2Country=/opt/arkime/etc/GeoLite2-Country.mmdb
geoLite2ASN=/opt/arkime/etc/GeoLite2-ASN.mmdb
rirFile=/opt/arkime/etc/ipv4-address-space.csv
ouiFile=/opt/arkime/etc/oui.txt
dropUser=nobody
dropGroup=daemon
localPcapIndex=false
userNameHeader=arkime_user
parseSMTP=true
parseSMB=true
parseQSValue=false
supportSha256=false
maxReqBody=64
config.reqBodyOnlyUtf8=true
smtpIpHeaders=X-Originating-IP:;X-Barracuda-Apparent-Source-IP:
parsersDir=/opt/arkime/parsers
pluginsDir=/opt/arkime/plugins
netflowSNMPInput=1
netflowSNMPOutput=2
netflowVersion=1
spiDataMaxIndices=4
uploadCommand=/opt/arkime/bin/capture --copy -n {NODE} -r {TMPFILE} -c {CONFIG} {TAGS}
titleTemplate=_cluster_ - _page_ _-view_ _-expression_
packetThreads=2
pcapReadMethod=libpcap
pcapWriteMethod=simple
pcapWriteSize=262143
dbBulkSize=300000
compressES=false
maxESConns=30
maxESRequests=500
packetsPerPoll=50000
antiSynDrop=true
logEveryXPackets=100000
logUnknownProtocols=false
logESRequests=true
logFileCreation=true