diff --git a/doc/logging-elasticsearch.rst b/doc/logging-elasticsearch.rst index 7a16acb0f1..4229748854 100644 --- a/doc/logging-elasticsearch.rst +++ b/doc/logging-elasticsearch.rst @@ -73,18 +73,12 @@ Configuring ElasticSearch Bro's ElasticSearch writer comes with a few configuraiton options:: -- cluster_name:: Currently unused. -- server_host:: Where to send the data. Default localhost. -- server_port:: What port to send the data to. Default 9200. -- index_name:: ElasticSearch indexes are like databases in a standard DB model. - This is the name of the index to which to send the data. Default bro-logs. -- type_prefix:: ElasticSearch types are like tables in a standard DB model. - This is a prefix that gets prepended to Bro log names. - Example: type_prefix = "bro_" would create types "bro_dns", "bro_http", etc. - Default: none. -- batch_size:: How many messages to buffer before sending to ElasticSearch. - This is mainly a memory optimization - changing this doesn't seem to affect - indexing performance that much. Default: 10,000. +- cluster_name: Currently unused. +- server_host: Where to send the data. Default localhost. +- server_port: What port to send the data to. Default 9200. +- index_name: ElasticSearch indexes are like databases in a standard DB model. This is the name of the index to which to send the data. Default bro-logs. +- type_prefix: ElasticSearch types are like tables in a standard DB model. This is a prefix that gets prepended to Bro log names. Example: type_prefix = "bro_" would create types "bro_dns", "bro_http", etc. Default: none. +- batch_size: How many messages to buffer before sending to ElasticSearch. This is mainly a memory optimization - changing this doesn't seem to affect indexing performance that much. Default: 10,000. TODO ----