default.conf

{
    "connectTimeout": 10,
    "enabled": false,
    "workerProcesses": 1,
    "handler": {
        "output@comment": "If you disable all outputters it behaves as a sink", 
        "outputters": [], 
        "records": {
            "core": true, 
            "excl@comment": [
                "These records will be excluded regardless of above (overrides 'include')", 
                "e.g. to exclude flow and IPS events use [ 71, 400 ]"
            ], 
            "exclude": [], 
            "connections": true, 
            "inc@comment": "These records will be included regardless of above", 
            "include": [], 
            "intrusion": true, 
            "metadata": true, 
            "packets": true, 
            "rna": true, 
            "rua": true
        }
    }, 
    "logging": {
        "filepath": "estreamer.log", 
        "format": "%(asctime)s %(name)-12s %(levelname)-8s %(message)s", 
        "lev@comment": "Levels include FATAL, ERROR, WARNING, INFO, DEBUG, VERBOSE and TRACE", 
        "level": "INFO", 
        "stdOut": true
    }, 
    "monitor": {
        "bookmark": false, 
        "handled": true, 
        "period": 120, 
        "subscribed": true, 
        "velocity": false
    }, 
    "responseTimeout": 2, 
    "star@comment": "0 for genesis, 1 for now, 2 for bookmark", 
    "start": 2, 
    "subscription": {
        "records": {
            "@comment": [
                "Just because we subscribe doesn't mean the server is sending. Nor does it mean", 
                "we are writing the records either. See handler.records[]"
            ], 
            "archiveTimestamps": true, 
            "eventExtraData": true, 
            "extended": true, 
            "impactEventAlerts": true, 
            "intrusion": true, 
            "metadata": true, 
            "packetData": true,
            "packOrig@comment": "Preserve the original packet with header information",
            "includeOriginalPacket": true,
            "pack@comment": "Packet payload encoding type (defaults to hex): hex | ascii | utf-8",
            "packetEncoding": "hex"
        }, 
        "servers": [
            {
                "host": "1.2.3.4", 
                "pkcs12Filepath": "client.pkcs12", 
                "port": 8302, 
                "tls@comment": "Valid values are 1.0 and 1.2", 
                "tlsVersion": 1.2
            }
        ]
    }
}