config-sample.ini

[capture]
; Device used to capture
devname =

; Pcap filename to run
pcapfile =

; dnstap socket path. Example: unix:///tmp/dnstap.sock, tcp://127.0.0.1:8080
dnstapsocket =

; Port selected to filter packets
port = 53

; Capture Sampling by a:b. eg sampleRatio of 1:100 will process 1 percent of the incoming packets
sampleratio = 1:1

; Cleans up packet hash table used for deduplication
dedupcleanupinterval = 1m0s

; Set the dnstap socket permission, only applicable when unix:// is used
dnstappermission = 755

; Number of routines used to handle received packets
packethandlercount = 2

; Size of the tcp assembler
tcpassemblychannelsize = 10000

; Size of the tcp result channel
tcpresultchannelsize = 10000

; Number of routines used to handle tcp packets
tcphandlercount = 1

; Size of the channel to send packets to be defragged
defraggerchannelsize = 10000

; Size of the channel where the defragged packets are returned
defraggerchannelreturnsize = 10000

; Size of the packet handler channel
packetchannelsize = 1000

; Afpacket Buffersize in MB
afpacketbuffersizemb = 64

; BPF filter applied to the packet stream. If port is selected, the packets will not be defragged.
filter = ((ip and (ip[9] == 6 or ip[9] == 17)) or (ip6 and (ip6[6] == 17 or ip6[6] == 6 or ip6[6] == 44)))

; Use AFPacket for live captures. Supported on Linux 3.0+ only
useafpacket = false

; The PCAP capture does not contain ethernet frames
noetherframe = false

; Deduplicate incoming packets, Only supported with --devName and --pcapFile. Experimental 
dedup = false

; Do not put the interface in promiscuous mode
nopromiscuous = false

[clickhouse_output]
; Address of the clickhouse database to save the results. multiple values can be provided.
clickhouseaddress = localhost:9000

; Username to connect to the clickhouse database
clickhouseusername =

; Password to connect to the clickhouse database
clickhousepassword =

; Database to connect to the clickhouse database
clickhousedatabase = default

; Interval between sending results to ClickHouse. If non-0, Batch size is ignored and batch delay is used
clickhousedelay = 0s

; Clickhouse connection LZ4 compression level, 0 means no compression
clickhousecompress = 0

; Debug Clickhouse connection
clickhousedebug = false

; Use TLS for Clickhouse connection
clickhousesecure = false

; Save full packet query and response in JSON format.
clickhousesavefullquery = false

; What should be written to clickhouse. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
clickhouseoutputtype = 0

; Minimum capacity of the cache array used to send data to clickhouse. Set close to the queries per second received to prevent allocations
clickhousebatchsize = 100000

; Number of Clickhouse output Workers
clickhouseworkers = 1

; Channel Size for each Clickhouse Worker
clickhouseworkerchannelsize = 100000

[elastic_output]
; What should be written to elastic. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
elasticoutputtype = 0

; elastic endpoint address, example: http://127.0.0.1:9200. Used if elasticOutputType is not none
elasticoutputendpoint =

; elastic index
elasticoutputindex = default

; Send data to Elastic in batch sizes
elasticbatchsize = 1000

; Interval between sending results to Elastic if Batch size is not filled
elasticbatchdelay = 1s

[file_output]
; What should be written to file. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
fileoutputtype = 0

; Path to output folder. Used if fileoutputType is not none
fileoutputpath =

; Interval to rotate the file in cron format
fileoutputrotatecron = 0 0 * * *

; Number of files to keep. 0 to disable rotation
fileoutputrotatecount = 4

; Output format for file. options:json, csv, csv_no_header, gotemplate. note that the csv splits the datetime format into multiple fields
fileoutputformat = json

; Go Template to format the output as needed
fileoutputgotemplate = {{.}}

[influx_output]
; What should be written to influx. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
influxoutputtype = 0

; influx Server address, example: http://localhost:8086. Used if influxOutputType is not none
influxoutputserver =

; Influx Server Auth Token
influxoutputtoken = dnsmonster

; Influx Server Bucket
influxoutputbucket = dnsmonster

; Influx Server Org
influxoutputorg = dnsmonster

; Minimum capacity of the cache array used to send data to Influx
influxoutputworkers = 8

; Minimum capacity of the cache array used to send data to Influx
influxbatchsize = 1000

[kafka_output]
; What should be written to kafka. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
kafkaoutputtype = 0

; kafka broker address(es), example: 127.0.0.1:9092. Used if kafkaOutputType is not none
kafkaoutputbroker =

; Kafka topic for logging
kafkaoutputtopic = dnsmonster

; Minimum capacity of the cache array used to send data to Kafka
kafkabatchsize = 1000

; Output format. options:json, gob. 
kafkaoutputformat = json

; Kafka connection timeout in seconds
kafkatimeout = 3

; Interval between sending results to Kafka if Batch size is not filled
kafkabatchdelay = 1s

; Compress Kafka connection
kafkacompress = false

; Compression Type Kafka connection [snappy gzip lz4 zstd]; default(snappy).
kafkacompressiontype = snappy

; Use TLS for kafka connection
kafkasecure = false

; Path of CA certificate that signs Kafka broker certificate
kafkacacertificatepath =

; Path of TLS certificate to present to broker
kafkatlscertificatepath =

; Path of TLS certificate key
kafkatlskeypath =

[parquet_output]
; What should be written to parquet file. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
parquetoutputtype = 0

; Path to output folder. Used if parquetoutputtype is not none
parquetoutputpath =

; Number of records to write to parquet file before flushing
parquetflushbatchsize = 10000

; Number of workers to write to parquet file
parquetworkercount = 4

; Size of the write buffer in bytes
parquetwritebuffersize = 256000

[psql_output]
; What should be written to Microsoft Psql. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
psqloutputtype = 0

; Psql endpoint used. must be in uri format. example: postgres://username:password@hostname:port/database?sslmode=disable
psqlendpoint =

; Number of PSQL workers
psqlworkers = 1

; Psql Batch Size
psqlbatchsize = 1

; Interval between sending results to Psql if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
psqlbatchdelay = 0s

; Timeout for any INSERT operation before we consider them failed
psqlbatchtimeout = 5s

; Save full packet query and response in JSON format.
psqlsavefullquery = false

[sentinel_output]
; What should be written to Microsoft Sentinel. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
sentineloutputtype = 0

; Sentinel Shared Key, either the primary or secondary, can be found in Agents Management page under Log Analytics workspace
sentineloutputsharedkey =

; Sentinel Customer Id. can be found in Agents Management page under Log Analytics workspace
sentineloutputcustomerid =

; Sentinel Output LogType
sentineloutputlogtype = dnsmonster

; Sentinel Output Proxy in URI format
sentineloutputproxy =

; Sentinel Batch Size
sentinelbatchsize = 100

; Interval between sending results to Sentinel if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
sentinelbatchdelay = 0s

[splunk_output]
; What should be written to HEC. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
splunkoutputtype = 0

; splunk endpoint address, example: http://127.0.0.1:8088. Used if splunkOutputType is not none, can be specified multiple times for load balanace and HA
splunkoutputendpoint =

; Splunk HEC Token
splunkoutputtoken = 00000000-0000-0000-0000-000000000000

; Splunk Output Index
splunkoutputindex = temp

; Splunk Output Proxy in URI format
splunkoutputproxy =

; Splunk Output Source
splunkoutputsource = dnsmonster

; Splunk Output Sourcetype
splunkoutputsourcetype = json

; Send data to HEC in batch sizes
splunkbatchsize = 1000

; Interval between sending results to HEC if Batch size is not filled
splunkbatchdelay = 1s

[stdout_output]
; What should be written to stdout. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
stdoutoutputtype = 0

; Output format for stdout. options:json,csv, csv_no_header, gotemplate. note that the csv splits the datetime format into multiple fields
stdoutoutputformat = json

; Go Template to format the output as needed
stdoutoutputgotemplate = {{.}}

; Number of workers
stdoutoutputworkercount = 8

[syslog_output]
; What should be written to Syslog server. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
syslogoutputtype = 0

; Syslog endpoint address, example: udp://127.0.0.1:514, tcp://127.0.0.1:514. Used if syslogOutputType is not none
syslogoutputendpoint = udp://127.0.0.1:514

[victoria_output]
; Victoria Output Endpoint. example: http://localhost:9428/insert/jsonline?_msg_field=rcode_id&_time_field=time
victoriaoutputendpoint =

; What should be written to Microsoft Victoria. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
victoriaoutputtype = 0

; Victoria Output Proxy in URI format
victoriaoutputproxy =

; Number of workers
victoriaoutputworkers = 8

; Victoria Batch Size
victoriabatchsize = 100

; Interval between sending results to Victoria if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
victoriabatchdelay = 0s

[zinc_output]
; What should be written to zinc. options:
;	0: Disable Output
;	1: Enable Output without any filters
;	2: Enable Output and apply skipdomains logic
;	3: Enable Output and apply allowdomains logic
;	4: Enable Output and apply both skip and allow domains logic
zincoutputtype = 0

; index used to save data in Zinc
zincoutputindex = dnsmonster

; zinc endpoint address, example: http://127.0.0.1:9200/api/default/_bulk. Used if zincOutputType is not none
zincoutputendpoint =

; zinc username, example: admin@admin.com. Used if zincOutputType is not none
zincoutputusername =

; zinc password, example: password. Used if zincOutputType is not none
zincoutputpassword =

; Send data to Zinc in batch sizes
zincbatchsize = 1000

; Interval between sending results to Zinc if Batch size is not filled
zincbatchdelay = 1s

; Zing request timeout
zinctimeout = 10s

[general]
; Garbage Collection interval for tcp assembly and ip defragmentation
gctime = 10s

; Duration to calculate interface stats
capturestatsdelay = 1s

; Mask IPv4s by bits. 32 means all the bits of IP is saved in DB
masksize4 = 32

; Mask IPv6s by bits. 32 means all the bits of IP is saved in DB
masksize6 = 128

; Name of the server used to index the metrics.
servername = default

; Set debug Log format
logformat = text

; Set debug Log level, 0:PANIC, 1:ERROR, 2:WARN, 3:INFO, 4:DEBUG
loglevel = 3

; Size of the result processor channel size
resultchannelsize = 100000

; write cpu profile to file
cpuprofile =

; write memory profile to file
memprofile =

; GOMAXPROCS variable
gomaxprocs = -1

; Limit of packets logged to clickhouse every iteration. Default 0 (disabled)
packetlimit = 0

; Skip outputing domains matching items in the CSV file path. Can accept a URL (http:// or https://) or path
skipdomainsfile =

; Hot-Reload skipdomainsfile interval
skipdomainsrefreshinterval = 1m0s

; Allow Domains logic input file. Can accept a URL (http:// or https://) or path
allowdomainsfile =

; Hot-Reload allowdomainsfile file interval
allowdomainsrefreshinterval = 1m0s

; Skip TLS verification when making HTTPS connections
skiptlsverification = false

[metric]
; Metric Endpoint Service
metricendpointtype = stderr

; Statsd endpoint. Example: 127.0.0.1:8125 
metricstatsdagent =

; Prometheus Registry endpoint. Example: http://0.0.0.0:2112/metric
metricprometheusendpoint =

; Format for stderr output.
metricstderrformat = json

; Interval between sending results to Metric Endpoint
metricflushinterval = 10s