Dynamic Configuration Parameters
Dynamic Configuration parameters allow for setting configuration values for the cluster while it is running.
To get the current configuration value for a dynamic variable, see Getting Dynamic Configuration List
To set the current configuration value for a dynamic variable, see Setting a Dynamic Configuration Value
Table: Dynamic Configuration Parameters Table
Variable | Default Value | Availability | Description |
---|---|---|---|
AggregatorOutputRowLimit | 100 million rows | Number of rows allowed in queries with aggregate functions. | |
AstDepthLimit | 1,900 rows | removed in 1.164.0 | Limits the depth of a query |
BucketStorageKeySchemeVersion | 2 MB | Sets a new format for the keys (file names) placed in the bucket. | |
BucketStorageUploadInfrequentThresholdDays | Minimum data retention days remained to switch from default "S3 Standard" to "S3 Intelligent-Tiering". | ||
BucketStorageWriteVersion | 3 | Allows files larger than 2GB in bucket storage for less memory pressure. | |
CancelQueriesExceedingAggregateOutputRowLimit | disabled |
Cancels aggregate functions in queries that exceed the limit set
by the AggregatorOutputRowLimit configuration.
| |
defaultDigestReplicationFactor | 2 | Configures the replication factor used for the digest partitions table. | |
defaultSegmentReplicationFactor | 2 | Specifies the number of replicas each segment file will have. | |
DelayIngestResponseDueToIngestLagScale | 300,000 milliseconds |
Sets the number of milliseconds of lag that adds
1 to the factor applied.
| |
DelayIngestResponseDueToIngestLagMaxFactor | 2 | Sets the delay of the ingest response when the digest node experiences digest lag. | |
DelayIngestResponseDueToIngestLagThreshold | 20,000 milliseconds | Sets the number of milliseconds of digest lag where the feature starts to kick in. | |
DisableNewRegexEngine | disabled | introduced in 1.161.0 | Disables the LogScale Regular Expression Engine V2 globally on the cluster, preventing the submission of new queries. |
FdrEnable | false | Turns FDR polling on/off on the entire cluster with a single update. | |
FdrExcludedNodes | empty | Excludes specific nodes from polling from FDR. | |
FdrMaxNodes | 5 nodes | Maximum number of nodes that simultaneously poll data from the same FDR feed. | |
FlushSegmentsAndGlobalOnShutdown | false | Allows the shutdown of all in-progress segments and forces a write (and upload) of global snapshot. | |
GraphQLSelectionSizeLimit | 1,000 queries | Number of GraphQL queries on the total number of selected fields and fragments. | |
GraphQlDirectivesAmountLimit | 25 directives | The amount of GraphQL directives allowed in a query. | |
GroupDefaultLimit | 20,000 group elements |
Default limit of group elements allowed in functions like
groupBy() or selfJoin() .
| |
GroupMaxLimit | 1,000,000 group elements |
Maximum limit of group elements allowed in
groupBy() .
| |
IngestFeedAwsDownloadMaxObjectSize | 2,147,483,648 bytes | Max size of objects downloaded from S3. | |
IngestFeedAwsProcessingDownloadBufferSize | 8,388,608 bytes | Size of the buffer when downloading. | |
IngestFeedAwsProcessingEventBufferSize | 1 MB | Size of the buffer after preprocessing and splitting into individual events. | |
IngestFeedAwsProcessingEventsPerBatch | 1,000 events | Number of events ingested per batch. | |
IngestFeedGovernorRateOverride | 100,000 | Change in rate when under/over the setpoint. Increasing this will make the governor more aggressive in changing the ingest rate. | |
IngestFeedGovernorIngestDelayHigh | 10 seconds |
Default ingest delay high setpoint for the ingest feed governor. | |
IngestFeedGovernorIngestDelayLow | 5 seconds |
Default ingest delay low setpoint for the ingest feed governor. | |
JoinRowLimit | 200,000 rows |
Max number of rows that | |
LiveAdhocTableUpdatePeriodMinimumMs | 10,000 ms | introduced in 1.163.0 | Defines the minimum period of time between two table updates. The default value is 10.000 ms and the value is restricted to 10,000 - 604,800,000 (1 week). See Ad-hoc Tables Update Frequency and Cluster Performance. |
LiveQueryMemoryLimit | 100,000,000 bytes | deprecated in 1.116.0 | Amount of memory that a live query can consume during its execution. |
LookupTableSyncAwaitSeconds | 30 seconds | Waiting time before the lookup operation fails. | |
MatchFilesMaxHeapFraction | 0.5 | Total fraction of the heap allowed for lookup tables. Defaults to half of the total configured heap. | |
MaxCsvFileUploadSizeBytes | 209,715,200 bytes |
Maximum size of uploaded CSV files. | |
MaxIngestRequestSize | 33,554,432 bytes | Size limit of ingest requests after content-encoding has been applied. | |
MaxJsonFileUploadSizeBytes | 104,857,600 bytes |
Maximum size of uploaded JSON files.
If | |
MaxOpenSegmentsOnWorker | 50,000 segment files | Maximum open segment files for the scheduler. Do not modify this setting unless advised to do so by CrowdStrike Support. | |
ParserBacktrackingLimit | 2,000 backtracks | Number of backtracks for how many new events can be created from a single input event in parsers. | |
QueryBacktrackingLimit | 2,000 backtracks | Number of allowed query backtracks to limit a query iterating over individual events too many times. | |
QueryCoordinatorMaxHeapFraction | 0.5 | Configures query queueing based on the available memory in the query coordinator. | |
QueryCoordinatorMemoryLimit | 4,000,000,000 bytes | Memory that the query coordinator can consume during execution per query, to ensure that the coordinating nodes of a cluster do not run out of memory. | |
QueryMemoryLimit | 100,000,000 bytes | deprecated in 1.116.0 | How much memory a non-live query can consume during its execution. |
QueryPartitionAutoBalance | true | Turns on/off automatic balancing of query partitions across nodes. | |
QueryResultRowCountLimit | 100,000 rows | How many events a query can return. | |
RdnsDefaultLimit | 5,000 events |
Default number of resulting events allowed in
rdns() .
| |
RdnsMaxLimit | 20,000 events |
Maximum allowed number of resulting events in
rdns() .
| |
ReplaceANSIEscapeCodes | true | Specifies whether LogScale replaces ANSI escape codes in the result set. | |
StateRowLimit | 20,000 rows |
Maximum number of rows allowed in functions. | |
StaticQueryFractionOfCores | 2 | Limit in the queries that one organization or user can run on a certain percentage of mapper threads. | |
TableCacheMaxStorageFraction | 0.001 |
Fraction of disk space allowed for caching file data used for
query functions such as match() and
readFile() .
| |
TableCacheMaxStorageFractionForIngestAndHttpOnly | 0.1 |
Fraction of disk space allowed on
ingest
or
httponly
node for caching file data used for query functions such as
match() and readFile() .
| |
TargetMaxRateForDatasource | 2 MB | Target maximum rate of ingest for each shard of a datasource. | |
UnauthenticatedGraphQLSelectionSizeLimit | 150 queries | Number of GraphQL queries on the total number of selected fields and fragments for unauthenticated users. | |
UndersizedMergingRetentionPercentage | 20 % | Time span percentage that can be merged together when selecting undersized segments to merge. |