Usage of /usr/bin/query-tee:
  -backend.config-file string
    	Path to a file with YAML or JSON configuration for each backend. Each key in the YAML/JSON document is a backend hostname. This is an example configuration value for a backend in JSON: {"request_headers":{"Cache-Control":["no-store"]},"request_proportion":0.5,"min_data_queried_age":"24h","exclude_tenants":["tenant-a","tenant-b"]}
  -backend.endpoints string
    	Comma-separated list of backend endpoints to query. If the client request contains basic auth, it will be forwarded to the backend. Basic auth is also accepted as part of the endpoint URL and takes precedence over the basic auth in the client request. If the endpoint URL doesn't contain basic auth password, then the basic auth password from the client request is used. If the endpoint basic auth username is __REQUEST_HEADER_X_SCOPE_ORGID__, then the value of the X-Scope-OrgID header will be used as the username.
  -backend.preferred string
    	The hostname of the preferred backend when selecting the response to send back to the client. If no preferred backend is configured then the query-tee will send back to the client the first successful response received without waiting for other backends.
  -backend.read-timeout duration
    	The timeout when reading the response from a backend. (default 2m30s)
  -backend.skip-tls-verify
    	Skip TLS verification on backend targets.
  -log.format string
    	Output log messages in the given format. Valid formats: [logfmt, json] (default "logfmt")
  -log.level value
    	Only log messages with the given severity or above. Valid levels: [debug, info, warn, error] (default info)
  -proxy.add-missing-time-parameter-to-instant-queries
    	Add a 'time' parameter to proxied instant query requests if they do not have one. (default true)
  -proxy.backends-lookback-delta duration
    	The lookback configured in the backends query engines. Used to accurately extract min time from queries for backends that require it. (default 5m0s)
  -proxy.compare-exact-error-matching
    	If true, errors will be considered the same only if they are exactly the same. If false, errors will be considered the same if they are considered equivalent.
  -proxy.compare-responses
    	Compare responses between preferred and secondary endpoints for supported routes.
  -proxy.compare-skip-preferred-backend-failures
    	If true, the proxy will 'skip' result comparisons where the preferred backend returned a 5xx status code. This is useful in the case where the secondary backend is more reliable.
  -proxy.compare-skip-recent-samples duration
    	The window from now to skip comparing samples. 0 to disable. (default 2m0s)
  -proxy.compare-skip-samples-before value
    	Skip the samples before the given time for comparison. The time can be in RFC3339 format (or) RFC3339 without the timezone and seconds (or) date only.
  -proxy.compare-use-relative-error
    	Use relative error tolerance when comparing floating point values.
  -proxy.log-slow-query-response-threshold duration
    	The minimum difference in response time between slowest and fastest back-end over which to log the query. 0 to disable. (default 10s)
  -proxy.passthrough-non-registered-routes
    	Passthrough requests for non-registered routes to preferred backend.
  -proxy.secondary-backends-request-proportion float
    	Proportion of requests to send to secondary backends. Must be between 0 and 1 (inclusive), and if not 1, then -backend.preferred must be set. Optionally this global setting can be overrided on a per-backend basis via the backend config file. (default 1)
  -proxy.value-comparison-tolerance float
    	The tolerance to apply when comparing floating point values in the responses. 0 to disable tolerance and require exact match (not recommended). (default 1e-06)
  -query-tee.client-cluster-validation.label string
    	Primary cluster validation label.
  -server.cluster-validation.additional-labels value
    	Comma-separated list of additional cluster validation labels that the server will accept from incoming requests.
  -server.cluster-validation.grpc.enabled
    	When enabled, cluster label validation is executed: configured cluster validation label is compared with the cluster validation label received through the requests.
  -server.cluster-validation.grpc.soft-validation
    	When enabled, soft cluster label validation is executed. Can be enabled only together with server.cluster-validation.grpc.enabled
  -server.cluster-validation.http.enabled
    	When enabled, cluster label validation is executed: configured cluster validation label is compared with the cluster validation label received through the requests.
  -server.cluster-validation.http.excluded-paths value
    	Comma-separated list of url paths that are excluded from the cluster validation check.
  -server.cluster-validation.http.excluded-user-agents value
    	Comma-separated list of user agents that are excluded from the cluster validation check.
  -server.cluster-validation.http.soft-validation
    	When enabled, soft cluster label validation is executed. Can be enabled only together with server.cluster-validation.http.enabled
  -server.cluster-validation.label string
    	Primary cluster validation label.
  -server.create-new-traces
    	Creates new traces for each call rather than continuing the existing trace. A span link is used to allow navigation to the parent trace. Only works when using Open-Telemetry tracing.
  -server.graceful-shutdown-timeout duration
    	Timeout for graceful shutdowns (default 30s)
  -server.grpc-collect-max-streams-by-conn
    	If true, the max streams by connection gauge will be collected. (default true)
  -server.grpc-conn-limit int
    	Maximum number of simultaneous grpc connections, <=0 to disable
  -server.grpc-listen-address string
    	gRPC server listen address.
  -server.grpc-listen-network string
    	gRPC server listen network (default "tcp")
  -server.grpc-listen-port int
    	gRPC server listen port. (default 9095)
  -server.grpc-max-concurrent-streams uint
    	Limit on the number of concurrent streams for gRPC calls per client connection (0 = unlimited) (default 10000)
  -server.grpc-max-recv-msg-size-bytes int
    	Limit on the size of a gRPC message this server can receive (bytes). (default 104857600)
  -server.grpc-max-send-msg-size-bytes int
    	Limit on the size of a gRPC message this server can send (bytes). (default 104857600)
  -server.grpc-service-address string
    	Bind address for server where query-tee service listens for HTTP over gRPC requests.
  -server.grpc-service-port int
    	The GRPC port where the query-tee service listens for HTTP over gRPC messages. (default 9095)
  -server.grpc-tls-ca-path string
    	GRPC TLS Client CA path.
  -server.grpc-tls-cert-path string
    	GRPC TLS server cert path.
  -server.grpc-tls-client-auth string
    	GRPC TLS Client Auth type.
  -server.grpc-tls-key-path string
    	GRPC TLS server key path.
  -server.grpc.keepalive.max-connection-age duration
    	The duration for the maximum amount of time a connection may exist before it will be closed. Default: infinity (default 2562047h47m16.854775807s)
  -server.grpc.keepalive.max-connection-age-grace duration
    	An additive period after max-connection-age after which the connection will be forcibly closed. Default: infinity (default 2562047h47m16.854775807s)
  -server.grpc.keepalive.max-connection-idle duration
    	The duration after which an idle connection should be closed. Default: infinity (default 2562047h47m16.854775807s)
  -server.grpc.keepalive.min-time-between-pings duration
    	Minimum amount of time a client should wait before sending a keepalive ping. If client sends keepalive ping more often, server will send GOAWAY and close the connection. (default 10s)
  -server.grpc.keepalive.ping-without-stream-allowed
    	If true, server allows keepalive pings even when there are no active streams(RPCs). If false, and client sends ping when there are no active streams, server will send GOAWAY and close the connection. (default true)
  -server.grpc.keepalive.time duration
    	Duration after which a keepalive probe is sent in case of no activity over the connection., Default: 2h (default 2h0m0s)
  -server.grpc.keepalive.timeout duration
    	After having pinged for keepalive check, the duration after which an idle connection should be closed, Default: 20s (default 20s)
  -server.grpc.num-workers int
    	If non-zero, configures the amount of GRPC server workers used to serve the requests.
  -server.grpc.read-buffer-size-bytes int
    	Size of the read buffer for each gRPC connection (bytes). A smaller buffer may reduce memory usage but may lead to more system calls. (default 32768)
  -server.grpc.recv-buffer-pools-enabled
    	Deprecated option, has no effect and will be removed in a future version.
  -server.grpc.stats-tracking-enabled
    	If true, the request_message_bytes, response_message_bytes, and inflight_requests metrics will be tracked. Enabling this option prevents the use of memory pools for parsing gRPC request bodies and may lead to more memory allocations. (default true)
  -server.grpc.write-buffer-size-bytes int
    	Size of the write buffer for each gRPC connection (bytes). A smaller buffer may reduce memory usage but may lead to more system calls. (default 32768)
  -server.http-conn-limit int
    	Maximum number of simultaneous http connections, <=0 to disable
  -server.http-idle-timeout duration
    	Idle timeout for HTTP server (default 2m0s)
  -server.http-listen-address string
    	HTTP server listen address.
  -server.http-listen-network string
    	HTTP server listen network, default tcp (default "tcp")
  -server.http-listen-port int
    	HTTP server listen port. (default 80)
  -server.http-log-closed-connections-without-response-enabled
    	Log closed connections that did not receive any response, most likely because client didn't send any request within timeout.
  -server.http-read-header-timeout duration
    	Read timeout for HTTP request headers. If set to 0, value of -server.http-read-timeout is used.
  -server.http-read-timeout duration
    	Read timeout for entire HTTP request, including headers and body. (default 1m0s)
  -server.http-service-address string
    	Bind address for server where query-tee service listens for HTTP requests.
  -server.http-service-port int
    	The HTTP port where the query-tee service listens for HTTP requests. (default 80)
  -server.http-tls-ca-path string
    	HTTP TLS Client CA path.
  -server.http-tls-cert-path string
    	HTTP server cert path.
  -server.http-tls-client-auth string
    	HTTP TLS Client Auth type.
  -server.http-tls-key-path string
    	HTTP server key path.
  -server.http-write-timeout duration
    	Write timeout for HTTP server (default 2m0s)
  -server.log-request-at-info-level-enabled
    	Optionally log requests at info level instead of debug level. Applies to request headers as well if server.log-request-headers is enabled.
  -server.log-request-headers
    	Optionally log request headers.
  -server.log-request-headers-exclude-list string
    	Comma separated list of headers to exclude from loggin. Only used if server.log-request-headers is true.
  -server.log-source-ips-enabled
    	Optionally log the source IPs.
  -server.log-source-ips-full
    	Log all source IPs instead of only the originating one. Only used if server.log-source-ips-enabled is true
  -server.log-source-ips-header string
    	Header field storing the source IPs. Only used if server.log-source-ips-enabled is true. If not set the default Forwarded, X-Real-IP and X-Forwarded-For headers are used
  -server.log-source-ips-regex string
    	Regex for matching the source IPs. Only used if server.log-source-ips-enabled is true. If not set the default Forwarded, X-Real-IP and X-Forwarded-For headers are used
  -server.metrics-port int
    	The port where metrics are exposed. (default 9900)
  -server.path-prefix string
    	Base path to serve all API routes from (e.g. /v1/)
  -server.proxy-protocol-enabled
    	Enables PROXY protocol.
  -server.register-instrumentation
    	Register the intrumentation handlers (/metrics etc). (default true)
  -server.report-grpc-codes-in-instrumentation-label-enabled
    	If set to true, gRPC statuses will be reported in instrumentation labels with their string representations. Otherwise, they will be reported as "error". (default true)
  -server.throughput.latency-cutoff duration
    	Requests taking over the cutoff are be observed to measure throughput. Server-Timing header is used with specified unit as the indicator, for example 'Server-Timing: unit;val=8.2'. If set to 0, the throughput is not calculated.
  -server.throughput.unit string
    	Unit of the server throughput metric, for example 'processed_bytes' or 'samples_processed'. Observed values are gathered from the 'Server-Timing' header with the 'val' key. If set, it is appended to the request_server_throughput metric name. (default "samples_processed")
  -server.tls-cipher-suites string
    	Comma-separated list of cipher suites to use. If blank, the default Go cipher suites is used.
  -server.tls-min-version string
    	Minimum TLS version to use. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. If blank, the Go TLS minimum version is used.
  -server.trace-request-headers
    	Optionally add request headers to tracing spans.
  -server.trace-request-headers-exclude-list string
    	Comma separated list of headers to exclude from tracing spans. Only used if server.trace-request-headers is true. The following headers are always excluded: Authorization, Cookie, X-Access-Token, X-Csrf-Token, X-Grafana-Id.