[general] save_aggregate = True save_forensic = True output = /output/ [elasticsearch] hosts = elasticsearch:9200 ssl = False