File type
The file type is used for writing data to a file.
If you delete a destination of the 'file' type used in a service, that service must be restarted.
Basic settings tab
Setting | Description |
---|---|
Name | Required setting. Unique name of the resource. Must contain 1 to 128 Unicode characters. |
Tenant | Required setting. The name of the tenant that owns the resource. |
The State toggle switch | Used when events must be sent to the destination. By default, sending events is enabled. |
Type | Required setting. Destination type, file. |
URL | Required setting. Path to the file to which the events must be written. |
Description | Resource description: up to 4,000 Unicode characters. |
Advanced settings tab
Setting | Description |
---|---|
Buffer size | Sets the size of the buffer. The default value is 1 KB, and the maximum value is 64 MB. |
Disk buffer size limit | Size of the disk buffer in bytes. The default value is 10 GB. |
Delimiter | In the drop-down list, you can select the character to mark the boundary between events. \n is used by default. |
Buffer flush interval | Time (in seconds) between sending batches of data to the destination. The default value is |
Number of handlers | This field is used to set the number of services processing the queue. By default, this value is equal to the number of vCPUs of the KUMA Core server. |
Output format | Format for sending events to an external destination. Available values:
If the CEF format is selected, the sent event contains the CEF header and only non-empty fields. |
Debug | This toggle switch lets you specify whether resource logging must be enabled. The default value is Disabled. |
Disk buffer disabled | Drop-down list that lets you enable or disable the disk buffer. By default, the disk buffer is enabled. The disk buffer is used if the collector cannot send normalized events to the destination. The amount of allocated disk space is limited by the value of the Disk buffer size limit setting. If the disk space allocated for the disk buffer is exhausted, events are rotated as follows: new events replace the oldest events written to the buffer. |
Filter | In the Filter section, you can specify the criteria for identifying events that must be processed by the resource. You can select an existing filter from the drop-down list or create a new filter. |