arkime.env.example

ARKIME_VIEWER_PORT=8005
# Whether or not Arkime is allowed to delete uploaded/captured PCAP
#   https://arkime.com/faq#pcap-deletion
MANAGE_PCAP_FILES=false
ARKIME_FREESPACEG=10%
# How often to create a new index in OpenSearch/Elasticsearch
#   https://arkime.com/settings#rotateIndex
ARKIME_ROTATE_INDEX=daily
# Specify the max number of indices for querying SPI data, or set to -1 to disable any max.
#   The Arkime documentation warns "OpenSearch/Elasticsearch MAY blow up if we ... search too many indices."
#   https://arkime.com/settings#spiDataMaxIndices
ARKIME_SPI_DATA_MAX_INDICES=7
# Always query all indices instead of trying to calculate which ones
#   https://arkime.com/settings#queryAllIndices
ARKIME_QUERY_ALL_INDICES=false
# debug flag for config.ini (https://arkime.com/settings#debug)
ARKIME_DEBUG_LEVEL=0

# These variables manage setting for Arkime's ILM/ISM features (https://arkime.com/faq#ilm)
# Whether or not Arkime should perform index management
INDEX_MANAGEMENT_ENABLED=false
# Time in hours/days before moving to warm and force merge (number followed by h or d)
INDEX_MANAGEMENT_OPTIMIZATION_PERIOD=30d
# Time in hours/days before deleting index (number followed by h or d)
INDEX_MANAGEMENT_RETENTION_TIME=90d
# Number of replicas for older sessions indices
INDEX_MANAGEMENT_OLDER_SESSION_REPLICAS=0
# Number of weeks of history to retain
INDEX_MANAGEMENT_HISTORY_RETENTION_WEEKS=13
# Number of segments to optimize sessions for
INDEX_MANAGEMENT_SEGMENTS=1
# Whether or not Arkime should use a hot/warm design (storing non-session data in a warm index)
INDEX_MANAGEMENT_HOT_WARM_ENABLED=false

OPENSEARCH_MAX_SHARDS_PER_NODE=2500