Cluster Settings

Cluster settings control correlator behavior and are the same for all nodes. A configured value is replicated across the entire cluster.

Overriding Settings

By default, all parameters use their built-in values.

To specify a custom parameter value:

1. Click Override Setting
2. In Select Setting, select the required parameter. Its current default value is displayed next to its name
3. Enter the parameter value
4. Click Add to apply the value, or Cancel to close the form without changes

The parameter appears in a separate table of overridden settings. Resetting a parameter in this table restores its built-in value.

Event Ingestion

Parameter	Description	Default
ingest.queue_size	Event queue capacity	1000000
ingest.dedupe_ttl	Event duplicate suppression window	600s
ingest.dedupe_max_entries	Maximum number of entries in the duplicate table	1000000
ingest.event_sample_size	Number of event samples stored for each alias	10

Cluster Coordination

Parameter	Description	Default
cluster.heartbeat	Interval between node heartbeat messages	3s
cluster.peer_timeout	Timeout after which a node is considered unavailable	30s

Data Retention

Parameter	Description	Default
retention.fires	Firing retention period	30d
retention.processed_sources	Processed source retention period	30d

Negative Filter

Parameter	Description	Default
negative_filter.enabled	Enables the negative filter	true
negative_filter.budget_mb	Filter memory allocation, MB	256
negative_filter.pending_spill_mb	Amount of data spilled to disk, MB	32

Time Model

Parameter	Description	Default
time_model.max_skew_fwd	Maximum allowed event time lead	300s
time_model.max_lag_back_floor	Maximum allowed event time lag	3600s
time_model.retention_grace_floor	Minimum state retention margin	30s
time_model.retention_grace_ceil	Maximum state retention margin	300s

Correlation

Parameter	Description	Default
correlation.max_partials_per_rule	Maximum number of incomplete chains per rule	4096
correlation.reserved_step_pool	Reserved chain step pool	512
correlation.global_partial_ceiling	Maximum total number of incomplete chains per node	1000000
correlation.max_aggregation_set_per_group	Maximum aggregation set size per group	100000