Base Options
Properties
Enables the admin servlets (/ping, /version, /healthcheck, /threaddump) on this process. Resolved from CLI → ADMIN_ENABLED env var → <role>.admin.enabled config (default false).
Listen port for this process's admin servlets. -1 means "fall back to ADMIN_PORT env var, then <role>.admin.port config (Proxy default 8092, Agent default 8093)".
Filesystem path to the TLS certificate chain (PEM). Must be paired with privateKeyFilePath; supplying one without the other is rejected by validateTlsConfig. Empty disables TLS on this side and exposes plaintext gRPC. See also isTlsEnabled.
Enables the /debug admin servlet on this process — exposes recent activity / scrape-request introspection. Distinct from DEBUG (the servlet path constant). Resolved from CLI → DEBUG_ENABLED env var → <role>.admin.debugEnabled config (default false).
Dynamic HOCON property overrides accepted as -Dkey=value (multiple -D flags allowed). Each pair is merged into the resolved config with highest precedence over the loaded config file, and any surrounding double-quotes on the value are stripped. Useful for one-off overrides that don't have a dedicated flag.
gRPC keepalive ping timeout, in seconds — how long this side waits for a keepalive ack before considering the connection dead. -1L means "fall back to KEEPALIVE_TIMEOUT_SECS env var, then <role>.grpc.keepAliveTimeoutSecs config; -1L after resolution leaves the gRPC default in place".
gRPC keepalive ping interval, in seconds — how often this side sends a keepalive ping on an idle channel. -1L means "fall back to KEEPALIVE_TIME_SECS env var, then <role>.grpc.keepAliveTimeSecs config; -1L after resolution leaves the gRPC default in place".
Logback log level for this process: one of all, trace, debug, info, warn, error, off. Empty falls back to the role-specific env var (io.prometheus.common.EnvVars.PROXY_LOG_LEVEL or io.prometheus.common.EnvVars.AGENT_LOG_LEVEL) and then <role>.logLevel config; if still empty, the level configured in logback.xml is used.
Enables this process's Prometheus metrics endpoint. Resolved from CLI → METRICS_ENABLED env var → <role>.metrics.enabled config (default false).
Listen port for this process's Prometheus metrics endpoint. -1 means "fall back to METRICS_PORT env var, then <role>.metrics.port config (Proxy default 8082, Agent default 8083)".
Filesystem path to the TLS private key (PEM) matching certChainFilePath. Must be paired with the cert file; supplying one without the other is rejected by validateTlsConfig. Empty disables TLS on this side.
Disables the gRPC transport filter that records remote-peer information per call. Set when running behind an L7 reverse proxy (e.g. nginx) that already strips this information.
Filesystem path to the trust-store certificate collection (PEM) used to validate the peer's certificate. Required for mTLS; for one-way TLS the JDK default trust store is used when this is empty.