> For the complete documentation index, see [llms.txt](https://elastiflow.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://elastiflow.gitbook.io/docs/elastiflow-documentation/configuration-reference/unified-flow-collector/configuration-changes.md). # Configuration Changes To improve the consistency of configuration options and prepare for future features on ElastiFlow's roadmap, many of the configuration options have been renamed or otherwise changed. The following is a list of all changes. :::tip You may want to start with a clean 6.0 configuration file from either our provided `docker-compose.yml` example, or the `flowcoll.conf` file in the native packages. You can then provide only the modifications necessary to add to the new configuration. ::: ## Licensing Options | 5.6.x Option | Status | Notes for 6.0 | | ------------------------- | :---------: | --------------------- | | \_\_\_ | **NEW** | EF\_LICENSE\_ACCEPTED | | EF\_FLOW\_ACCOUNT\_ID | **RENAMED** | EF\_ACCOUNT\_ID | | EF\_FLOW\_LICENSE\_KEY | **✓** | Unchanged | | EF\_FLOW\_LICENSED\_UNITS | **✓** | Unchanged | ## Logging Options The only change is that `FLOW_` has been removed from the option names. | 5.6.x Option | Status | Notes for 6.0 | | ----------------------------------------- | :---------: | ----------------------------------- | | EF\_FLOW\_LOGGER\_LEVEL | **RENAMED** | EF\_LOGGER\_LEVEL | | EF\_FLOW\_LOGGER\_ENCODING | **RENAMED** | EF\_LOGGER\_ENCODING | | EF\_FLOW\_LOGGER\_FILE\_LOG\_ENABLE | **RENAMED** | EF\_LOGGER\_FILE\_LOG\_ENABLE | | EF\_FLOW\_LOGGER\_FILE\_LOG\_FILENAME | **RENAMED** | EF\_LOGGER\_FILE\_LOG\_FILENAME | | EF\_FLOW\_LOGGER\_FILE\_LOG\_MAX\_SIZE | **RENAMED** | EF\_LOGGER\_FILE\_LOG\_MAX\_SIZE | | EF\_FLOW\_LOGGER\_FILE\_LOG\_MAX\_AGE | **RENAMED** | EF\_LOGGER\_FILE\_LOG\_MAX\_AGE | | EF\_FLOW\_LOGGER\_FILE\_LOG\_MAX\_BACKUPS | **RENAMED** | EF\_LOGGER\_FILE\_LOG\_MAX\_BACKUPS | | EF\_FLOW\_LOGGER\_FILE\_LOG\_COMPRESS | **RENAMED** | EF\_LOGGER\_FILE\_LOG\_COMPRESS | ## Metrics Options | 5.6.x Option | Status | Notes for 6.0 | | ------------ | :-----: | -------------------------------- | | \_\_\_ | **NEW** | EF\_INSTANCE\_NAME | | \_\_\_ | **NEW** | EF\_METRICS\_PORT | | \_\_\_ | **NEW** | EF\_METRICS\_TLS\_ENABLE | | \_\_\_ | **NEW** | EF\_METRICS\_TLS\_CERT\_FILEPATH | | \_\_\_ | **NEW** | EF\_METRICS\_TLS\_KEY\_FILEPATH | ## Flow UDP Server Options | 5.6.x Option | Status | Notes for 6.0 | | ------------------------------------------------ | :---------: | ----------------------------------- | | EF\_FLOW\_SERVER\_UDP\_IP | **✓** | Unchanged | | EF\_FLOW\_SERVER\_UDP\_PORT | **✓** | Unchanged | | EF\_FLOW\_SERVER\_UDP\_READ\_BUFFER\_MAX\_SIZE | **✓** | Unchanged | | EF\_FLOW\_SERVER\_UDP\_PACKET\_STREAM\_MAX\_SIZE | **RENAMED** | EF\_FLOW\_PACKET\_STREAM\_MAX\_SIZE | ## AWS VPC Flow Logs Options | 5.6.x Option | Status | Notes for 6.0 | | ------------ | :-----: | ----------------------------------- | | \_\_\_ | **NEW** | EF\_AWS\_VPC\_FLOW\_LOG\_ENABLE | | \_\_\_ | **NEW** | EF\_AWS\_VPC\_FLOW\_LOG\_S3\_BUCKET | | \_\_\_ | **NEW** | EF\_AWS\_VPC\_FLOW\_LOG\_PREFIX | | \_\_\_ | **NEW** | AWS\_REGION | | \_\_\_ | **NEW** | AWS\_ACCESS\_KEY\_ID | | \_\_\_ | **NEW** | AWS\_SECRET\_ACCESS\_KEY | ## Decoding Options | 5.6.x Option | Status | Notes for 6.0 | | ---------------------------------------------- | :---------: | --------------------------------------------------------------------------------------------------------- | | EF\_FLOW\_DECODER\_POOL\_SIZE | **RENAMED** | EF\_PROCESSOR\_POOL\_SIZE | | EF\_FLOW\_DECODER\_SETTINGS\_PATH | **✕** | REMOVED: Absolute paths MUST now be used for all option values that define a path to a file or directory. | | EF\_FLOW\_DECODER\_IPFIX\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_IPFIX\_ENABLE | | EF\_FLOW\_DECODER\_NETFLOW1\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_NETFLOW1\_ENABLE | | EF\_FLOW\_DECODER\_NETFLOW5\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_NETFLOW5\_ENABLE | | EF\_FLOW\_DECODER\_NETFLOW6\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_NETFLOW6\_ENABLE | | EF\_FLOW\_DECODER\_NETFLOW7\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_NETFLOW7\_ENABLE | | EF\_FLOW\_DECODER\_NETFLOW9\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_NETFLOW9\_ENABLE | | EF\_FLOW\_DECODER\_SFLOW5\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_SFLOW5\_ENABLE | | EF\_FLOW\_DECODER\_SFLOW\_FLOWS\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_SFLOW\_FLOWS\_ENABLE | | EF\_FLOW\_DECODER\_SFLOW\_FLOWS\_KEEP\_SAMPLES | **RENAMED** | EF\_PROCESSOR\_DECODE\_SFLOW\_FLOWS\_KEEP\_SAMPLES | | EF\_FLOW\_DECODER\_SFLOW\_COUNTERS\_ENABLE | **RENAMED** | EF\_PROCESSOR\_DECODE\_SFLOW\_COUNTERS\_ENABLE | | EF\_FLOW\_DECODER\_TRANSLATE\_KEEP\_IDS | **RENAMED** | EF\_PROCESSOR\_TRANSLATE\_KEEP\_IDS | ## Application Enrichment Options | 5.6.x Option | Status | Notes for 6.0 | | ------------------------------------------------ | :---------: | ---------------------------------------------------- | | \_\_\_ | **NEW** | EF\_PROCESSOR\_ENRICH\_APP\_ID\_ENABLE | | \_\_\_ | **NEW** | EF\_PROCESSOR\_ENRICH\_APP\_ID\_PATH | | \_\_\_ | **NEW** | EF\_PROCESSOR\_ENRICH\_APP\_ID\_TTL | | EF\_FLOW\_DECODER\_ENRICH\_APP\_CACHE\_SIZE | **✕** | REMOVED: TTL is now used to flush old cache entries. | | EF\_FLOW\_DECODER\_ENRICH\_APP\_USERDEF\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_APP\_USERDEF\_PRIVATE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_PRIVATE | | EF\_FLOW\_DECODER\_ENRICH\_APP\_USERDEF\_PUBLIC | **RENAMED** | EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_PUBLIC | | EF\_FLOW\_DECODER\_ENRICH\_APP\_USERDEF\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_PATH | | \_\_\_ | **NEW** | EF\_PROCESSOR\_ENRICH\_APP\_IPPORT\_TTL | | \_\_\_ | **NEW** | EF\_PROCESSOR\_ENRICH\_APP\_REFRESH\_RATE | :::danger While the configuration options for IP/port to application attributes enrichment are renamed, the format of the file pointed to by `EF_PROCESSOR_ENRICH_APP_IPPORT_PATH` has changed significantly. Please refer to the configuration reference page for an example. ::: ## IP Address Enrichment Options The primary change is that `FLOW_DECODER` has been renamed to `PROCESSOR` in the option names. | 5.6.x Option | Status | Notes for 6.0 | | ------------------------------------------------------------------ | :---------: | ---------------------------------------------------------------------- | | \_\_\_ | **NEW** | EF\_PROCESSOR\_ENRICH\_OPTION\_ENUM\_TTL | | EF\_FLOW\_DECODER\_ENRICH\_IPADDR\_TTL | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_TTL | | EF\_FLOW\_DECODER\_ENRICH\_IPADDR\_METADATA\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_IPADDR\_METADATA\_USERDEF\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_USERDEF\_PATH | | EF\_FLOW\_DECODER\_ENRICH\_IPADDR\_METADATA\_REFRESH\_RATE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_METADATA\_REFRESH\_RATE | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_NAMESERVER\_IP | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_NAMESERVER\_IP | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_NAMESERVER\_TIMEOUT | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_NAMESERVER\_TIMEOUT | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_RESOLVE\_PRIVATE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_RESOLVE\_PRIVATE | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_RESOLVE\_PUBLIC | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_RESOLVE\_PUBLIC | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_USERDEF\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_USERDEF\_PATH | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_USERDEF\_REFRESH\_RATE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_USERDEF\_REFRESH\_RATE | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_INCLEXCL\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_INCLEXCL\_PATH | | EF\_FLOW\_DECODER\_ENRICH\_DNS\_INCLEXCL\_REFRESH\_RATE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_DNS\_INCLEXCL\_REFRESH\_RATE | | EF\_FLOW\_DECODER\_ENRICH\_MAXMIND\_ASN\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_ASN\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_MAXMIND\_ASN\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_ASN\_PATH | | EF\_FLOW\_DECODER\_ENRICH\_MAXMIND\_GEOIP\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_MAXMIND\_GEOIP\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_PATH | | EF\_FLOW\_DECODER\_ENRICH\_MAXMIND\_GEOIP\_VALUES | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_VALUES | | EF\_FLOW\_DECODER\_ENRICH\_MAXMIND\_GEOIP\_LANG | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_LANG | | EF\_FLOW\_DECODER\_ENRICH\_MAXMIND\_GEOIP\_INCLEXCL\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_INCLEXCL\_PATH | | EF\_FLOW\_DECODER\_ENRICH\_MAXMIND\_GEOIP\_INCLEXCL\_REFRESH\_RATE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_MAXMIND\_GEOIP\_INCLEXCL\_REFRESH\_RATE | | EF\_FLOW\_DECODER\_ENRICH\_RISKIQ\_THREAT\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_RISKIQ\_THREAT\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_RISKIQ\_THREAT\_ENDPOINT | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_RISKIQ\_THREAT\_ENDPOINT | | EF\_FLOW\_DECODER\_ENRICH\_RISKIQ\_THREAT\_REFRESH\_INTERVAL | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_RISKIQ\_THREAT\_REFRESH\_INTERVAL | | EF\_FLOW\_DECODER\_ENRICH\_RISKIQ\_THREAT\_INCLEXCL\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_RISKIQ\_THREAT\_INCLEXCL\_PATH | | EF\_FLOW\_DECODER\_ENRICH\_RISKIQ\_THREAT\_INCLEXCL\_REFRESH\_RATE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_RISKIQ\_THREAT\_INCLEXCL\_REFRESH\_RATE | | EF\_FLOW\_DECODER\_ENRICH\_RISKIQ\_API\_USER | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_RISKIQ\_API\_USER | | EF\_FLOW\_DECODER\_ENRICH\_RISKIQ\_API\_KEY | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_RISKIQ\_API\_KEY | | EF\_FLOW\_DECODER\_ENRICH\_RISKIQ\_API\_TIMEOUT | **RENAMED** | EF\_PROCESSOR\_ENRICH\_IPADDR\_RISKIQ\_API\_TIMEOUT | | EF\_FLOW\_DECODER\_ENRICH\_ASN\_PREF | **RENAMED** | EF\_PROCESSOR\_ENRICH\_ASN\_PREF | ## Network Interface Enrichment Options The only change is that `FLOW_DECODER` has been renamed to `PROCESSOR` in the option names. | 5.6.x Option | Status | Notes for 6.0 | | --------------------------------------------------------- | :---------: | ----------------------------------------------------- | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_TTL | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_TTL | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_METADATA\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_METADATA\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_METADATA\_USERDEF\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_METADATA\_USERDEF\_PATH | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_METADATA\_REFRESH\_RATE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_METADATA\_REFRESH\_RATE | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_FLOW\_OPTIONS\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_FLOW\_OPTIONS\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_SNMP\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_SNMP\_PORT | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_PORT | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_SNMP\_VERSION | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_VERSION | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_SNMP\_COMMUNITIES | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_COMMUNITIES | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_SNMP\_TIMEOUT | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_TIMEOUT | | EF\_FLOW\_DECODER\_ENRICH\_NETIF\_SNMP\_RETRIES | **RENAMED** | EF\_PROCESSOR\_ENRICH\_NETIF\_SNMP\_RETRIES | ## Post-Processing Enrichment Options | 5.6.x Option | Status | Notes for 6.0 | | ------------------------------------------------------ | :---------: | --------------------------------------------------------------------------------------------------- | | EF\_FLOW\_DECODER\_ENRICH\_TOTALS\_IF\_NO\_DELTAS | **RENAMED** | EF\_PROCESSOR\_ENRICH\_TOTALS\_IF\_NO\_DELTAS | | EF\_FLOW\_DECODER\_ENRICH\_SAMPLERATE\_CACHE\_SIZE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_SAMPLERATE\_CACHE\_SIZE | | EF\_FLOW\_DECODER\_ENRICH\_SAMPLERATE\_USERDEF\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_SAMPLERATE\_USERDEF\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_SAMPLERATE\_USERDEF\_PATH | **RENAMED** | EF\_PROCESSOR\_ENRICH\_SAMPLERATE\_USERDEF\_PATH | | \_\_\_ | **NEW** | EF\_PROCESSOR\_ENRICH\_SAMPLERATE\_USERDEF\_OVERRIDE | | EF\_FLOW\_DECODER\_ENRICH\_COMMUNITYID\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_COMMUNITYID\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_COMMUNITYID\_SEED | **RENAMED** | EF\_PROCESSOR\_ENRICH\_COMMUNITYID\_SEED | | EF\_FLOW\_DECODER\_ENRICH\_CONVERSATIONID\_ENABLE | **RENAMED** | EF\_PROCESSOR\_ENRICH\_CONVERSATIONID\_ENABLE | | EF\_FLOW\_DECODER\_ENRICH\_CONVERSATIONID\_SEED | **RENAMED** | EF\_PROCESSOR\_ENRICH\_CONVERSATIONID\_SEED | | EF\_FLOW\_DECODER\_ENRICH\_JOIN\_ASN | **RENAMED** | EF\_PROCESSOR\_ENRICH\_JOIN\_ASN | | EF\_FLOW\_DECODER\_ENRICH\_JOIN\_GEOIP | **RENAMED** | EF\_PROCESSOR\_ENRICH\_JOIN\_GEOIP | | EF\_FLOW\_DECODER\_ENRICH\_JOIN\_SEC | **RENAMED** | EF\_PROCESSOR\_ENRICH\_JOIN\_SEC | | EF\_FLOW\_DECODER\_ENRICH\_JOIN\_NETATTR | **RENAMED** | EF\_PROCESSOR\_ENRICH\_JOIN\_NETATTR | | EF\_FLOW\_DECODER\_ENRICH\_JOIN\_SUBNETATTR | **RENAMED** | EF\_PROCESSOR\_ENRICH\_JOIN\_SUBNETATTR | | EF\_FLOW\_DECODER\_DURATION\_PRECISION | **RENAMED** | EF\_PROCESSOR\_DURATION\_PRECISION | | EF\_FLOW\_DECODER\_TIMESTAMP\_PRECISION | **RENAMED** | EF\_PROCESSOR\_TIMESTAMP\_PRECISION | | EF\_FLOW\_DECODER\_PERCENT\_NORM | **RENAMED** | EF\_PROCESSOR\_PERCENT\_NORM | | EF\_FLOW\_DECODER\_ENRICH\_EXPAND\_CLISRV | **RENAMED** | EF\_PROCESSOR\_EXPAND\_CLISRV | | \_\_\_ | **NEW** | EF\_PROCESSOR\_EXPAND\_CLISRV\_NO\_L4\_PORTS | | EF\_FLOW\_DECODER\_ENRICH\_KEEP\_CPU\_TICKS | **RENAMED** | EF\_PROCESSOR\_KEEP\_CPU\_TICKS | | EF\_FLOW\_DECODER\_ENRICH\_DROP\_FIELDS | **RENAMED** | EF\_PROCESSOR\_DROP\_FIELDS | | EF\_FLOW\_RECORD\_STREAM\_MAX\_SIZE | **✕** | REMOVED: The record stream size has been optimized for peak performance and requires no adjustment. | ## stdout Output Options The only change is that `FLOW_` has been removed from the option names. | 5.6.x Option | Status | Notes for 6.0 | | -------------------------------- | :---------: | -------------------------- | | EF\_FLOW\_OUTPUT\_STDOUT\_ENABLE | **RENAMED** | EF\_OUTPUT\_STDOUT\_ENABLE | | EF\_FLOW\_OUTPUT\_STDOUT\_FORMAT | **RENAMED** | EF\_OUTPUT\_STDOUT\_FORMAT | ## Monitor Output Options The only change is that `FLOW_` has been removed from the option names. | 5.6.x Option | Status | Notes for 6.0 | | ----------------------------------- | :---------: | ----------------------------- | | EF\_FLOW\_OUTPUT\_MONITOR\_ENABLE | **RENAMED** | EF\_OUTPUT\_MONITOR\_ENABLE | | EF\_FLOW\_OUTPUT\_MONITOR\_INTERVAL | **RENAMED** | EF\_OUTPUT\_MONITOR\_INTERVAL | ## Elasticsearch Output Options The primary change is that `FLOW_` has been removed from the option names. A few options have been removed. | 5.6.x Option | Status | Notes for 6.0 | | ---------------------------------------------------------------------- | :---------: | ---------------------------------------------------------------------------------- | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_ENABLE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_ENABLE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_ECS\_ENABLE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_ECS\_ENABLE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_BATCH\_DEADLINE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_BATCH\_DEADLINE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_BATCH\_MAX\_BYTES | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_BATCH\_MAX\_BYTES | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_TIMESTAMP\_SOURCE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_TIMESTAMP\_SOURCE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_PERIOD | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_PERIOD | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_SUFFIX | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_SUFFIX | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_DROP\_FIELDS | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_DROP\_FIELDS | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ENABLE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ENABLE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_OVERWRITE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_OVERWRITE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_SHARDS | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_SHARDS | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REPLICAS | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REPLICAS | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_CODEC | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_CODEC | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ILM\_LIFECYCLE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ILM\_LIFECYCLE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ILM\_ROLLOVER\_ALIAS | **✕** | REMOVED: The rollover alias is generated automatically by the collector. | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_ISM\_POLICY | **✕** | REMOVED: The Elasticsearch output no longer supports OpenSearch-specific features. | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_PIPELINE\_DEFAULT | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_DEFAULT | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_INDEX\_PIPELINE\_FINAL | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_FINAL | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_ADDRESSES | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_ADDRESSES | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_USERNAME | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_USERNAME | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_PASSWORD | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_PASSWORD | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_CLOUD\_ID | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_CLOUD\_ID | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_API\_KEY | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_API\_KEY | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_CLIENT\_CA\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_CA\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_CLIENT\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_CLIENT\_KEY\_FILEPATH | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_CLIENT\_KEY\_FILEPATH | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_TLS\_ENABLE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_TLS\_ENABLE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_TLS\_SKIP\_VERIFICATION | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_TLS\_SKIP\_VERIFICATION | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_TLS\_CA\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_TLS\_CA\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_RETRY\_ENABLE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_ENABLE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_RETRY\_ON\_TIMEOUT\_ENABLE | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_ON\_TIMEOUT\_ENABLE | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_MAX\_RETRIES | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_MAX\_RETRIES | | EF\_FLOW\_OUTPUT\_ELASTICSEARCH\_RETRY\_BACKOFF | **RENAMED** | EF\_OUTPUT\_ELASTICSEARCH\_RETRY\_BACKOFF | | \_\_\_ | **NEW** | EF\_OUTPUT\_ELASTICSEARCH\_ALLOWED\_RECORD\_TYPES | ## OpenSearch Output Options The primary change is that `FLOW_` has been removed from the option names. | 5.6.x Option | Status | Notes for 6.0 | | ---------------------------------------------------------------- | :---------: | ---------------------------------------------------------- | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_ENABLE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_ENABLE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_ECS\_ENABLE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_ECS\_ENABLE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_BATCH\_DEADLINE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_BATCH\_DEADLINE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_BATCH\_MAX\_BYTES | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_BATCH\_MAX\_BYTES | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_TIMESTAMP\_SOURCE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_TIMESTAMP\_SOURCE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_PERIOD | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_PERIOD | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_SUFFIX | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_SUFFIX | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_DROP\_FIELDS | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_DROP\_FIELDS | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_ENABLE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_ENABLE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_OVERWRITE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_OVERWRITE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_SHARDS | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_SHARDS | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REPLICAS | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REPLICAS | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_REFRESH\_INTERVAL | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_CODEC | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_CODEC | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_ISM\_POLICY | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_ISM\_POLICY | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_DEFAULT | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_DEFAULT | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_FINAL | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_INDEX\_TEMPLATE\_PIPELINE\_FINAL | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_ADDRESSES | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_ADDRESSES | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_USERNAME | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_USERNAME | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_PASSWORD | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_PASSWORD | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_CLIENT\_CA\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_CLIENT\_CA\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_CLIENT\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_CLIENT\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_CLIENT\_KEY\_FILEPATH | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_CLIENT\_KEY\_FILEPATH | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_TLS\_ENABLE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_TLS\_ENABLE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_TLS\_SKIP\_VERIFICATION | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_TLS\_SKIP\_VERIFICATION | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_TLS\_CA\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_TLS\_CA\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_RETRY\_ENABLE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_RETRY\_ENABLE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_RETRY\_ON\_TIMEOUT\_ENABLE | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_RETRY\_ON\_TIMEOUT\_ENABLE | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_MAX\_RETRIES | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_MAX\_RETRIES | | EF\_FLOW\_OUTPUT\_OPENSEARCH\_RETRY\_BACKOFF | **RENAMED** | EF\_OUTPUT\_OPENSEARCH\_RETRY\_BACKOFF | | \_\_\_ | **NEW** | EF\_OUTPUT\_OPENSEARCH\_ALLOWED\_RECORD\_TYPES | ## Splunk Output Options The only change is that `FLOW_` has been removed from the option names. | 5.6.x Option | Status | Notes for 6.0 | | ------------------------------------------------------ | :---------: | ------------------------------------------------ | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_ENABLE | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_ENABLE | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_CIM\_ENABLE | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_CIM\_ENABLE | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_ADDRESSES | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_ADDRESSES | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_TOKEN | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_TOKEN | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_BATCH\_MAX\_BYTES | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_BATCH\_MAX\_BYTES | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_BATCH\_DEADLINE | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_BATCH\_DEADLINE | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_TLS\_ENABLE | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_TLS\_ENABLE | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_TLS\_SKIP\_VERIFICATION | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_TLS\_SKIP\_VERIFICATION | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_TLS\_CA\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_TLS\_CA\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_SPLUNK\_HEC\_DROP\_FIELDS | **RENAMED** | EF\_OUTPUT\_SPLUNK\_HEC\_DROP\_FIELDS | ## Kafka Output Options The primary change is that `FLOW_` has been removed from the option names. | 5.6.x Option | Status | Notes for 6.0 | | ------------------------------------------------------- | :---------: | ------------------------------------------------- | | EF\_FLOW\_OUTPUT\_KAFKA\_ENABLE | **RENAMED** | EF\_OUTPUT\_KAFKA\_ENABLE | | EF\_FLOW\_OUTPUT\_KAFKA\_BROKERS | **RENAMED** | EF\_OUTPUT\_KAFKA\_BROKERS | | EF\_FLOW\_OUTPUT\_KAFKA\_VERSION | **RENAMED** | EF\_OUTPUT\_KAFKA\_VERSION | | EF\_FLOW\_OUTPUT\_KAFKA\_TOPIC | **RENAMED** | EF\_OUTPUT\_KAFKA\_TOPIC | | EF\_FLOW\_OUTPUT\_KAFKA\_CLIENT\_ID | **RENAMED** | EF\_OUTPUT\_KAFKA\_CLIENT\_ID | | EF\_FLOW\_OUTPUT\_KAFKA\_PARTITION\_KEY | **RENAMED** | EF\_OUTPUT\_KAFKA\_PARTITION\_KEY | | EF\_FLOW\_OUTPUT\_KAFKA\_RACK\_ID | **RENAMED** | EF\_OUTPUT\_KAFKA\_RACK\_ID | | EF\_FLOW\_OUTPUT\_KAFKA\_TIMEOUT | **RENAMED** | EF\_OUTPUT\_KAFKA\_TIMEOUT | | EF\_FLOW\_OUTPUT\_KAFKA\_SASL\_ENABLE | **RENAMED** | EF\_OUTPUT\_KAFKA\_SASL\_ENABLE | | EF\_FLOW\_OUTPUT\_KAFKA\_SASL\_USERNAME | **RENAMED** | EF\_OUTPUT\_KAFKA\_SASL\_USERNAME | | EF\_FLOW\_OUTPUT\_KAFKA\_SASL\_PASSWORD | **RENAMED** | EF\_OUTPUT\_KAFKA\_SASL\_PASSWORD | | EF\_FLOW\_OUTPUT\_KAFKA\_TLS\_ENABLE | **RENAMED** | EF\_OUTPUT\_KAFKA\_TLS\_ENABLE | | EF\_FLOW\_OUTPUT\_KAFKA\_TLS\_CA\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_KAFKA\_TLS\_CA\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_KAFKA\_TLS\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_KAFKA\_TLS\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_KAFKA\_TLS\_KEY\_FILEPATH | **RENAMED** | EF\_OUTPUT\_KAFKA\_TLS\_KEY\_FILEPATH | | EF\_FLOW\_OUTPUT\_KAFKA\_TLS\_SKIP\_VERIFICATION | **RENAMED** | EF\_OUTPUT\_KAFKA\_TLS\_SKIP\_VERIFICATION | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_MAX\_MESSAGE\_BYTES | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_MAX\_MESSAGE\_BYTES | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_REQUIRED\_ACKS | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_REQUIRED\_ACKS | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_TIMEOUT | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_TIMEOUT | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_COMPRESSION | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_COMPRESSION | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_COMPRESSION\_LEVEL | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_COMPRESSION\_LEVEL | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_BYTES | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_BYTES | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_MESSAGES | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_MESSAGES | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_FREQUENCY | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_FREQUENCY | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_MAX\_MESSAGES | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_FLUSH\_MAX\_MESSAGES | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_RETRY\_MAX | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_RETRY\_MAX | | EF\_FLOW\_OUTPUT\_KAFKA\_PRODUCER\_RETRY\_BACKOFF | **RENAMED** | EF\_OUTPUT\_KAFKA\_PRODUCER\_RETRY\_BACKOFF | | EF\_FLOW\_OUTPUT\_KAFKA\_DROP\_FIELDS | **RENAMED** | EF\_OUTPUT\_KAFKA\_DROP\_FIELDS | | \_\_\_ | **NEW** | EF\_OUTPUT\_KAFKA\_ALLOWED\_RECORD\_TYPES | ## Cribl Stream Output Options The only change is that `FLOW_` has been removed from the option names. | 5.6.x Option | Status | Notes for 6.0 | | ------------------------------------------------ | :---------: | ------------------------------------------ | | EF\_FLOW\_OUTPUT\_CRIBL\_ENABLE | **RENAMED** | EF\_OUTPUT\_CRIBL\_ENABLE | | EF\_FLOW\_OUTPUT\_CRIBL\_ADDRESSES | **RENAMED** | EF\_OUTPUT\_CRIBL\_ADDRESSES | | EF\_FLOW\_OUTPUT\_CRIBL\_TOKEN | **RENAMED** | EF\_OUTPUT\_CRIBL\_TOKEN | | EF\_FLOW\_OUTPUT\_CRIBL\_BATCH\_DEADLINE | **RENAMED** | EF\_OUTPUT\_CRIBL\_BATCH\_DEADLINE | | EF\_FLOW\_OUTPUT\_CRIBL\_BATCH\_MAX\_BYTES | **RENAMED** | EF\_OUTPUT\_CRIBL\_BATCH\_MAX\_BYTES | | EF\_FLOW\_OUTPUT\_CRIBL\_TLS\_ENABLE | **RENAMED** | EF\_OUTPUT\_CRIBL\_TLS\_ENABLE | | EF\_FLOW\_OUTPUT\_CRIBL\_TLS\_SKIP\_VERIFICATION | **RENAMED** | EF\_OUTPUT\_CRIBL\_TLS\_SKIP\_VERIFICATION | | EF\_FLOW\_OUTPUT\_CRIBL\_TLS\_CA\_CERT\_FILEPATH | **RENAMED** | EF\_OUTPUT\_CRIBL\_TLS\_CA\_CERT\_FILEPATH | | EF\_FLOW\_OUTPUT\_CRIBL\_DROP\_FIELDS | **RENAMED** | EF\_OUTPUT\_CRIBL\_DROP\_FIELDS | ## Generic HTTP Output Options | 5.6.x Option | Status | Notes for 6.0 | | ------------ | :-----: | -------------------------------------------------------- | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_ENABLE | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_ECS\_ENABLE | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_BATCH\_DEADLINE | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_BATCH\_MAX\_BYTES | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_ADDRESSES | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_USERNAME | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_PASSWORD | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_TLS\_ENABLE | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_TLS\_SKIP\_VERIFICATION | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_TLS\_CA\_CERT\_FILEPATH | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_DROP\_FIELDS | | \_\_\_ | **NEW** | EF\_FLOW\_OUTPUT\_GENERIC\_HTTP\_TIMESTAMP\_SOURCE | ## RiskIQ Output Options The only change is that `FLOW_` has been removed from the option names. | 5.6.x Option | Status | Notes for 6.0 | | --------------------------------------------------- | :---------: | --------------------------------------------- | | EF\_FLOW\_OUTPUT\_RISKIQ\_ENABLE | **RENAMED** | EF\_OUTPUT\_RISKIQ\_ENABLE | | EF\_FLOW\_OUTPUT\_RISKIQ\_HOST | **RENAMED** | EF\_OUTPUT\_RISKIQ\_HOST | | EF\_FLOW\_OUTPUT\_RISKIQ\_PORT | **RENAMED** | EF\_OUTPUT\_RISKIQ\_PORT | | EF\_FLOW\_OUTPUT\_RISKIQ\_CUSTOMER\_UUID | **RENAMED** | EF\_OUTPUT\_RISKIQ\_CUSTOMER\_UUID | | EF\_FLOW\_OUTPUT\_RISKIQ\_CUSTOMER\_ENCRYPTION\_KEY | **RENAMED** | EF\_OUTPUT\_RISKIQ\_CUSTOMER\_ENCRYPTION\_KEY |