|
Max connections per route
|
The maximum number of connections to be opened per node.
|
|
Max scroll slices
|
The number of shards configured for the relevant index in Elasticsearch.This number tells Elastic how many parallel queries to execute in each polling request.
|
|
Proxy host
|
Host name of the HTTP proxy through which requests are sent.
|
|
Proxy port
|
Port of the HTTP proxy through which requests are sent.
|
|
Use MID certificate policy check
|
Option to enable the MID certificate policy check.Select this option if you want to ship your logs encrypted using SSL TLS. Then navigate to **All** > **MID Server** > **MID Security Policy** and add the MID certificate policy check to the table. For more information, see [MID Server certificate check policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/mid-security-checks.md).
|
|
Use cross-cluster search
|
Option to search for data across Elasticsearch clusters.When this check box is selected, the **Clusters to search** field displays.
**Note:** Your settings in the **Use minimal privileges** check box and the **Delay in reading current timestamp \(seconds\)** field on the **Advanced configuration** form affect how data is collected across multiple clusters.
|
|
Clusters to search
|
The Elasticsearch clusters to search.This field displays only when the **Use cross-cluster search** check box is selected. Do one of the following:
- Leave this field empty or enter “\*” to search all the remote clusters defined in Elasticsearch.
- Specify the clusters to search in a comma-separated list.
**Note:** To also search the local cluster, add a comma at the beginning or end, or add two commas in succession to the list. For example: “east,,west” or “,east,west” or “\*,”
|
|
Use minimal privileges
|
Option to read log data directly from the Elasticsearch indices with the configured prefix.- When selected, the integration reads the log data directly from the Elasticsearch indices with the configured prefix. To perform this task, it needs only read privileges.
**Note:** When this check box is selected and you're using cross-cluster search, data is collected from all the clusters simultaneously.
- When clear, the integration fetches all indices with the prefix, filters them, and reads the log data from the filtered indices. Performing this task requires additional privileges.
**Note:** Leaving this check box clear when using cross-cluster search affects how data is collected from the clusters. For more information, see the [Enabling and Using Cross-Cluster Search for Elasticsearch Data Inputs in Health Log Analytics \[KB1556079\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1556079) article in the Now Support Knowledge Base.
For additional information about streaming logs using the Elasticsearch integration, see the [Stream logs using Elasticsearch data input - Advanced guide \[KB1080162\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1080162) article in the Now Support Knowledge Base.
|
|
Max documents per query
|
Maximum number of documents fetched in a single query.
|
|
Sliced-scrolling tie breaker
|
Value used to slice the data. Each slice is scrolled in parallel. Default: \_id
|
|
Search-after tie breaker
|
Unique value per document to use as tiebreaker when sorting log entries by timestamp.
|
|
Use search-after API
|
Option to toggle between using sliced-scrolling and search-after APIs.**Note:** Sliced-scrolling APIs are preferable when reading historical data, while search-after APIs are better for reading real-time data.
|
|
Index time-suffix format
|
Format of the time suffix when using time-based index names, such as \[logstash-\]YYYY.MM.DD.When using aliases, leave this field empty.
For example: uuuu.MM.dd
|
|
Data reading timeout \(milliseconds\)
|
The duration of time, in milliseconds, before a request to the Elasticsearch cluster times out.
|
|
Index discovery interval \(seconds\)
|
The number of seconds between intermittent MID Server requests to the Elasticsearch cluster for new indices from which to read data.
|
|
Scroll context time \(milliseconds\)
|
The lifetime of the created scroll when using the scroll API to read data from Elasticsearch. For more information, see the Elasticsearch [scroll API documentation](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/scroll-api.html#scroll-api-query-params).
|
|
Event processor workers
|
The maximum number of CPU cores used in parallel to process events fetched from Elasticsearch. A higher setting increases the data input throughput at the cost of higher CPU usage.
|
|
Worker queue size
|
The maximum number of batches to queue for processing. A higher setting increases throughput, at the cost of higher RAM usage.
|
|
Default timezone
|
The time zone of events that the system will use if a log does not specify the time zone.By default, the system uses GMT in such cases, but you can specify a different time zone.
|
|
Sub sample drop ratio
|
The number of events to batch together, out of which one will be discarded. This setting is used to reduce the number of fetched events.
|
|
Sub sample receive ratio
|
The number of events to batch together, out of which all but one will be discarded. This setting is used to decrease the number of received events.
|
|
Character encoding
|
The character encoding for this data input.
|
|
Sleep interval \(seconds\)
|
The interval, in seconds, to wait before querying again after a query has returned no data.
|
|
Max length in bytes
|
The maximum length, in bytes, of log messages.
|
|
Delay in reading current timestamp \(seconds\)
|
The number of seconds before current time to query to include delayed data.The configured number of seconds is subtracted from the current time for reading the last timestamp.**Note:** If this value is 0 and data is collected from multiple clusters simultaneously, the query may not include data that was sent with a delay on one of the clusters,
|
|
Polling interval
|
How frequently the system polls for new log data.
|