You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Maximum size of allowed headers. Defaults to `16kb`.
55
55
56
56
[[http-compression]]
57
57
// tag::http-compression-tag[]
58
58
`http.compression` {ess-icon}::
59
-
(<<static-cluster-setting,Static>>)
59
+
(<<static-cluster-setting,Static>>, boolean)
60
60
Support for compression when possible (with Accept-Encoding). If HTTPS is enabled, defaults to `false`. Otherwise, defaults to `true`.
61
61
+
62
62
Disabling compression for HTTPS mitigates potential security risks, such as a
@@ -65,13 +65,13 @@ you must explicitly set `http.compression` to `true`.
65
65
// end::http-compression-tag[]
66
66
67
67
`http.compression_level`::
68
-
(<<static-cluster-setting,Static>>)
68
+
(<<static-cluster-setting,Static>>, integer)
69
69
Defines the compression level to use for HTTP responses. Valid values are in the range of 1 (minimum compression) and 9 (maximum compression). Defaults to `3`.
70
70
71
71
[[http-cors-enabled]]
72
72
// tag::http-cors-enabled-tag[]
73
73
`http.cors.enabled` {ess-icon}::
74
-
(<<static-cluster-setting,Static>>)
74
+
(<<static-cluster-setting,Static>>, boolean)
75
75
Enable or disable cross-origin resource sharing, which determines whether a browser on another origin can execute requests against {es}. Set to `true` to enable {es} to process pre-flight
{es} will respond to those requests with the `Access-Control-Allow-Origin` header if the `Origin` sent in the request is permitted by the `http.cors.allow-origin` list. Set to `false` (the default) to make {es} ignore the `Origin` request header, effectively disabling CORS requests because {es} will never respond with the `Access-Control-Allow-Origin` response header.
@@ -85,7 +85,7 @@ compromised. If CORS is not enabled on {es}, the only way for the client to know
85
85
[[http-cors-allow-origin]]
86
86
// tag::http-cors-allow-origin-tag[]
87
87
`http.cors.allow-origin` {ess-icon}::
88
-
(<<static-cluster-setting,Static>>)
88
+
(<<static-cluster-setting,Static>>, string)
89
89
Which origins to allow. If you prepend and append a forward slash (`/`) to the value, this will be treated as a regular expression, allowing you to support HTTP and HTTPs. For example, using `/https?:\/\/localhost(:[0-9]+)?/` would return the request header appropriately in both cases. Defaults to no origins allowed.
90
90
+
91
91
IMPORTANT: A wildcard (`*`) is a valid value but is considered a security risk, as your {es} instance is open to cross origin requests from *anywhere*.
@@ -95,109 +95,115 @@ IMPORTANT: A wildcard (`*`) is a valid value but is considered a security risk,
95
95
[[http-cors-max-age]]
96
96
// tag::http-cors-max-age-tag[]
97
97
`http.cors.max-age` {ess-icon}::
98
-
(<<static-cluster-setting,Static>>)
99
-
Browsers send a "preflight" OPTIONS-request to determine CORS settings. `max-age` defines how long the result should be cached for. Defaults to `1728000` (20 days).
98
+
(<<static-cluster-setting,Static>>, integer)
99
+
Browsers send a "preflight" OPTIONS-request to determine CORS settings.
100
+
`max-age` defines for how long, in seconds, the result should be cached.
101
+
Defaults to `1728000` (20 days).
100
102
// end::http-cors-max-age-tag[]
101
103
102
104
[[http-cors-allow-methods]]
103
105
// tag::http-cors-allow-methods-tag[]
104
106
`http.cors.allow-methods` {ess-icon}::
105
-
(<<static-cluster-setting,Static>>)
107
+
(<<static-cluster-setting,Static>>, string)
106
108
Which methods to allow. Defaults to `OPTIONS, HEAD, GET, POST, PUT, DELETE`.
107
109
// end::http-cors-allow-methods-tag[]
108
110
109
111
[[http-cors-allow-headers]]
110
112
// tag::http-cors-allow-headers-tag[]
111
113
`http.cors.allow-headers` {ess-icon}::
112
-
(<<static-cluster-setting,Static>>)
114
+
(<<static-cluster-setting,Static>>, string)
113
115
Which headers to allow. Defaults to `X-Requested-With, Content-Type, Content-Length`.
114
116
// end::http-cors-allow-headers-tag[]
115
117
116
118
[[http-cors-allow-credentials]]
117
119
// tag::http-cors-allow-credentials-tag[]
118
120
`http.cors.allow-credentials` {ess-icon}::
119
-
(<<static-cluster-setting,Static>>)
121
+
(<<static-cluster-setting,Static>>, boolean)
120
122
Whether the `Access-Control-Allow-Credentials` header should be returned. Defaults to `false`.
121
123
+
122
124
NOTE: This header is only returned when the setting is set to `true`.
123
125
124
126
// end::http-cors-allow-credentials-tag[]
125
127
126
128
`http.detailed_errors.enabled`::
127
-
(<<static-cluster-setting,Static>>)
129
+
(<<static-cluster-setting,Static>>, boolean)
128
130
If `true`, enables the output of detailed error messages and stack traces in the response output. Defaults to `true`.
129
131
+
130
132
If `false`, use the `error_trace` parameter to <<common-options-error-options,enable stack traces>> and return detailed error messages. Otherwise, only a simple message will be returned.
131
133
132
134
`http.pipelining.max_events`::
133
-
(<<static-cluster-setting,Static>>)
135
+
(<<static-cluster-setting,Static>>, integer)
134
136
The maximum number of events to be queued up in memory before an HTTP connection is closed, defaults to `10000`.
135
137
136
138
`http.max_warning_header_count`::
137
-
(<<static-cluster-setting,Static>>)
138
-
The maximum number of warning headers in client HTTP responses. Defaults to `unbounded`.
139
+
(<<static-cluster-setting,Static>>, integer)
140
+
The maximum number of warning headers in client HTTP responses. Defaults to
141
+
`-1` which means the number of warning headers is unlimited.
139
142
140
143
`http.max_warning_header_size`::
141
-
(<<static-cluster-setting,Static>>)
142
-
The maximum total size of warning headers in client HTTP responses. Defaults to `unbounded`.
143
-
144
-
`http.tcp.no_delay`::
145
-
(<<static-cluster-setting,Static>>)
146
-
Enable or disable the {wikipedia}/Nagle%27s_algorithm[TCP no delay]
0 commit comments