Agent Environment Variables

Environment variable	Description
EVEBOX_DATA_DIRECTORY	Directory for agent state, including EVE input bookmarks. Command line: --data-directory. Configuration: data-directory.
EVEBOX_SERVER_KEY	Agent key presented to the EveBox Server by the control channel used for packet captures and extracted files. No command-line equivalent. Configuration: server.key.
EVEBOX_INPUT_DELETE_SPOOL_FILES	Deletes processed spool files after the bookmark advances. No command-line equivalent. Configuration: input.delete-spool-files.
EVEBOX_ELASTICSEARCH_ENABLED	Enables direct Elasticsearch output. Command line: --elasticsearch. Configuration: elasticsearch.enabled.
EVEBOX_ELASTICSEARCH_URL	URL of the Elasticsearch or OpenSearch server. Command line: --elasticsearch-url. Configuration: elasticsearch.url.
EVEBOX_ELASTICSEARCH_INDEX	Elasticsearch index prefix. Command line: --elasticsearch-index. Configuration: elasticsearch.index.
EVEBOX_ELASTICSEARCH_NODATE	Prevents the agent from adding a date suffix to the index name. Command line: --elasticsearch-nodate. Configuration: elasticsearch.nodate.
EVEBOX_ELASTICSEARCH_USERNAME	Username for HTTP basic authentication. No command-line equivalent. Configuration: elasticsearch.username, which overrides the environment.
EVEBOX_ELASTICSEARCH_PASSWORD	Password for HTTP basic authentication. No command-line equivalent. Configuration: elasticsearch.password, which overrides the environment.
EVEBOX_ELASTICSEARCH_CACERT	PEM file containing a trusted CA certificate for direct Elasticsearch output. No command-line or configuration-file equivalent.

The agent's packet-capture and extracted-file directories have no environment-variable equivalents. Use pcap.directory and filestore.directory in the configuration file, or --pcap-directory and --filestore-directory on the command line. The EVEBOX_FILESTORE_DIRECTORY variable configures the server only.