EVEBOX_DATA_DIRECTORY | Directory for the event database and other state files. Command line: --data-directory. Configuration: data-directory. |
EVEBOX_CONFIG_DIRECTORY | Directory for the configuration database and generated TLS certificate and key. Command line: --config-directory. Configuration: config-directory. |
EVEBOX_DEFAULT_TIME_RANGE | Initial browser time range. Command line: --default-time-range. Configuration: defaults.time-range. Values: 1m, 1h, 3h, 12h, 24h, 1d, 3d, 7d, or all. |
EVEBOX_HTTP_HOST | Hostname or IP address on which the HTTP server listens. Command line: --host. Configuration: http.host. |
EVEBOX_HTTP_PORT | TCP port on which the HTTP server listens. Command line: --port. Configuration: http.port. |
EVEBOX_HTTP_TLS_ENABLED | Enables or disables HTTPS. Command line: --no-tls disables HTTPS. Configuration: http.tls.enabled. |
EVEBOX_HTTP_REQUEST_LOGGING | Enables HTTP request logging. Command line: --http-request-logging. Configuration: http.request-logging. |
EVEBOX_AUTHENTICATION_REQUIRED | Requires users to authenticate. Command line: --no-auth disables authentication. Configuration: authentication.required. |
EVEBOX_ELASTICSEARCH_URL | URL of the Elasticsearch or OpenSearch server. Command line: --elasticsearch. Configuration: database.elasticsearch.url. |
ELASTICSEARCH_URL | Compatibility alias for EVEBOX_ELASTICSEARCH_URL, which takes precedence. Command line: --elasticsearch. Configuration: database.elasticsearch.url. |
EVEBOX_ELASTICSEARCH_USERNAME | Username for HTTP basic authentication. Command line: --elasticsearch-username. Configuration: database.elasticsearch.username. |
EVEBOX_ELASTICSEARCH_PASSWORD | Password for HTTP basic authentication. Command line: --elasticsearch-password. Configuration: database.elasticsearch.password. |
EVEBOX_ELASTICSEARCH_CACERT | PEM file containing a trusted CA certificate. Command line: --elasticsearch-cacert. Configuration: database.elasticsearch.cacert. |
EVEBOX_ELASTICSEARCH_INDEX | Elasticsearch index prefix. Command line: --index. Configuration: database.elasticsearch.index. |
EVEBOX_ELASTICSEARCH_ECS | Enables Elastic Common Schema support. Command line: --ecs. Configuration: database.elasticsearch.ecs. |
EVEBOX_INPUT_DELETE_SPOOL_FILES | Deletes processed spool files after the bookmark advances. No command-line equivalent. Configuration: input.delete-spool-files. |
EVEBOX_PCAP_DIRECTORY | Local packet-capture spool directory. Command line: --pcap-directory. Configuration: pcap.directory. |
EVEBOX_PCAP_PREFIX | Limits capture files to names beginning with this prefix. Command line: --pcap-prefix. Configuration: pcap.prefix. |
EVEBOX_LOG_QUERIES | Logs queries sent to the event datastore. No command-line equivalent. Enabled when the variable is present, regardless of its value. |
EVEBOX_LOG_QUERY_PLAN | Logs SQLite query plans. No command-line equivalent. Enabled when the variable is present, regardless of its value. |
EVEBOX_SQLX_STATEMENT_LOGGING | Enables SQLx statement logging at debug level; use -v to display it. No direct command-line equivalent. Enabled when the variable is present, regardless of its value. |