EVEBOX_DATA_DIRECTORY | Directory for agent state, including EVE input bookmarks. Command line: --data-directory. Configuration: data-directory. |
EVEBOX_SERVER_KEY | Agent key presented to the EveBox Server by the packet-capture control channel. No command-line equivalent. Configuration: server.key. |
EVEBOX_INPUT_DELETE_SPOOL_FILES | Deletes processed spool files after the bookmark advances. No command-line equivalent. Configuration: input.delete-spool-files. |
EVEBOX_ELASTICSEARCH_ENABLED | Enables direct Elasticsearch output. Command line: --elasticsearch. Configuration: elasticsearch.enabled. |
EVEBOX_ELASTICSEARCH_URL | URL of the Elasticsearch or OpenSearch server. Command line: --elasticsearch-url. Configuration: elasticsearch.url. |
EVEBOX_ELASTICSEARCH_INDEX | Elasticsearch index prefix. Command line: --elasticsearch-index. Configuration: elasticsearch.index. |
EVEBOX_ELASTICSEARCH_NODATE | Prevents the agent from adding a date suffix to the index name. Command line: --elasticsearch-nodate. Configuration: elasticsearch.nodate. |
EVEBOX_ELASTICSEARCH_USERNAME | Username for HTTP basic authentication. No command-line equivalent. Configuration: elasticsearch.username, which overrides the environment. |
EVEBOX_ELASTICSEARCH_PASSWORD | Password for HTTP basic authentication. No command-line equivalent. Configuration: elasticsearch.password, which overrides the environment. |
EVEBOX_ELASTICSEARCH_CACERT | PEM file containing a trusted CA certificate for direct Elasticsearch output. No command-line or configuration-file equivalent. |