/usr/bin/cortex

2026/11/08 02:46:26 maxprocs: Leaving GOMAXPROCS=64: CPU quota undefined
Usage of /usr/bin/cortex:
  -alertmanager-storage.azure.account-key value
    	Azure storage account key
  -alertmanager-storage.azure.account-name string
    	Azure storage account name
  -alertmanager-storage.azure.connection-string account-name
    	The values of account-name and `endpoint-suffix` values will not be ignored if `connection-string` is set. Use this method over `account-key` if you need to authenticate via a SAS token or if you use the Azurite emulator.
  -alertmanager-storage.azure.container-name string
    	Azure storage container name
  -alertmanager-storage.azure.endpoint-suffix string
    	Azure storage endpoint suffix without schema. The account name will be prefixed to this value to create the FQDN
  -alertmanager-storage.azure.expect-continue-timeout duration
    	The time to wait for a server's first response headers after fully writing the request headers if the request has an Expect header. 0 to send the request body immediately. (default 1s)
  -alertmanager-storage.azure.http.idle-conn-timeout duration
    	The time an idle connection will remain idle before closing. (default 1m30s)
  -alertmanager-storage.azure.http.insecure-skip-verify
    	If the client connects via HTTPS and this option is enabled, the client will accept any certificate and hostname.
  -alertmanager-storage.azure.http.response-header-timeout duration
    	The amount of time the client will wait for a servers response headers. (default 2m0s)
  -alertmanager-storage.azure.max-connections-per-host int
    	Maximum number of connections per host. 0 means no limit.
  -alertmanager-storage.azure.max-idle-connections int
    	Maximum number of idle (keep-alive) connections across all hosts. 0 means no limit. (default 100)
  -alertmanager-storage.azure.max-idle-connections-per-host int
    	Maximum number of idle (keep-alive) connections to keep per-host. If 0, a built-in default value is used. (default 100)
  -alertmanager-storage.azure.max-retries int
    	Number of retries for recoverable errors (default 20)
  -alertmanager-storage.azure.msi-resource string
    	Deprecated: Azure storage MSI resource. It will be set automatically by Azure SDK.
  -alertmanager-storage.azure.tls-handshake-timeout duration
    	Maximum time to wait for a TLS handshake. 0 means no limit. (default 10s)
  -alertmanager-storage.azure.user-assigned-id string
    	Azure storage MSI resource managed identity client Id. If not supplied default Azure credential will be used. Set it to empty if you need to authenticate via Azure Workload Identity.
  -alertmanager-storage.backend string
    	Backend storage to use. Supported backends are: s3, gcs, azure, swift, filesystem, configdb, local. (default "s3")
  -alertmanager-storage.configs.client-timeout duration
    	Timeout for requests to Weave Cloud configs service. (default 5s)
  -alertmanager-storage.configs.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -alertmanager-storage.configs.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -alertmanager-storage.configs.tls-insecure-skip-verify
    	Skip validating server certificate.
  -alertmanager-storage.configs.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -alertmanager-storage.configs.tls-server-name string
    	Override the expected name on the server certificate.
  -alertmanager-storage.configs.url value
    	URL of configs API server.
  -alertmanager-storage.filesystem.dir string
    	Local filesystem storage directory.
  -alertmanager-storage.gcs.bucket-name string
    	GCS bucket name
  -alertmanager-storage.gcs.service-account value
    	JSON representing either a Google Developers Console client_credentials.json file or a Google Developers service account key file. If empty, fallback to Google default logic.
  -alertmanager-storage.local.path string
    	Path at which alertmanager configurations are stored.
  -alertmanager-storage.s3.access-key-id string
    	S3 access key ID
  -alertmanager-storage.s3.bucket-lookup-type string
    	The s3 bucket lookup style. Supported values are: auto, virtual-hosted, path. (default "auto")
  -alertmanager-storage.s3.bucket-name string
    	S3 bucket name
  -alertmanager-storage.s3.disable-dualstack
    	If enabled, S3 endpoint will use the non-dualstack variant.
  -alertmanager-storage.s3.endpoint string
    	The S3 bucket endpoint. It could be an AWS S3 endpoint listed at https://docs.aws.amazon.com/general/latest/gr/s3.html or the address of an S3-compatible service in hostname:port format.
  -alertmanager-storage.s3.expect-continue-timeout duration
    	The time to wait for a server's first response headers after fully writing the request headers if the request has an Expect header. 0 to send the request body immediately. (default 1s)
  -alertmanager-storage.s3.http.idle-conn-timeout duration
    	The time an idle connection will remain idle before closing. (default 1m30s)
  -alertmanager-storage.s3.http.insecure-skip-verify
    	If the client connects via HTTPS and this option is enabled, the client will accept any certificate and hostname.
  -alertmanager-storage.s3.http.response-header-timeout duration
    	The amount of time the client will wait for a servers response headers. (default 2m0s)
  -alertmanager-storage.s3.insecure
    	If enabled, use http:// for the S3 endpoint instead of https://. This could be useful in local dev/test environments while using an S3-compatible backend storage, like Minio.
  -alertmanager-storage.s3.list-objects-version string
    	The list api version. Supported values are: v1, v2, and ''.
  -alertmanager-storage.s3.max-connections-per-host int
    	Maximum number of connections per host. 0 means no limit.
  -alertmanager-storage.s3.max-idle-connections int
    	Maximum number of idle (keep-alive) connections across all hosts. 0 means no limit. (default 100)
  -alertmanager-storage.s3.max-idle-connections-per-host int
    	Maximum number of idle (keep-alive) connections to keep per-host. If 0, a built-in default value is used. (default 100)
  -alertmanager-storage.s3.region string
    	S3 region. If unset, the client will issue a S3 GetBucketLocation API call to autodetect it.
  -alertmanager-storage.s3.secret-access-key value
    	S3 secret access key
  -alertmanager-storage.s3.send-content-md5
    	If true, attach MD5 checksum when upload objects and S3 uses MD5 checksum algorithm to verify the provided digest. If false, use CRC32C algorithm instead. (default true)
  -alertmanager-storage.s3.signature-version string
    	The signature version to use for authenticating against S3. Supported values are: v4, v2. (default "v4")
  -alertmanager-storage.s3.sse.kms-encryption-context string
    	KMS Encryption Context used for object encryption. It expects JSON formatted string.
  -alertmanager-storage.s3.sse.kms-key-id string
    	KMS Key ID used to encrypt objects in S3
  -alertmanager-storage.s3.sse.type string
    	Enable AWS Server Side Encryption. Supported values: SSE-KMS, SSE-S3.
  -alertmanager-storage.s3.tls-handshake-timeout duration
    	Maximum time to wait for a TLS handshake. 0 means no limit. (default 10s)
  -alertmanager-storage.swift.application-credential-id string
    	OpenStack Swift application credential ID.
  -alertmanager-storage.swift.application-credential-name string
    	OpenStack Swift application credential name.
  -alertmanager-storage.swift.application-credential-secret value
    	OpenStack Swift application credential secret.
  -alertmanager-storage.swift.auth-url string
    	OpenStack Swift authentication URL
  -alertmanager-storage.swift.auth-version int
    	OpenStack Swift authentication API version. 0 to autodetect.
  -alertmanager-storage.swift.connect-timeout duration
    	Time after which a connection attempt is aborted. (default 10s)
  -alertmanager-storage.swift.container-name string
    	Name of the OpenStack Swift container to put chunks in.
  -alertmanager-storage.swift.domain-id string
    	OpenStack Swift user's domain ID.
  -alertmanager-storage.swift.domain-name string
    	OpenStack Swift user's domain name.
  -alertmanager-storage.swift.max-retries int
    	Max retries on requests error. (default 3)
  -alertmanager-storage.swift.password value
    	OpenStack Swift API key.
  -alertmanager-storage.swift.project-domain-id string
    	ID of the OpenStack Swift project's domain (v3 auth only), only needed if it differs the from user domain.
  -alertmanager-storage.swift.project-domain-name string
    	Name of the OpenStack Swift project's domain (v3 auth only), only needed if it differs from the user domain.
  -alertmanager-storage.swift.project-id string
    	OpenStack Swift project ID (v2,v3 auth only).
  -alertmanager-storage.swift.project-name string
    	OpenStack Swift project name (v2,v3 auth only).
  -alertmanager-storage.swift.region-name string
    	OpenStack Swift Region to use (v2,v3 auth only).
  -alertmanager-storage.swift.request-timeout duration
    	Time after which an idle request is aborted. The timeout watchdog is reset each time some data is received, so the timeout triggers after X time no data is received on a request. (default 5s)
  -alertmanager-storage.swift.user-domain-id string
    	OpenStack Swift user's domain ID.
  -alertmanager-storage.swift.user-domain-name string
    	OpenStack Swift user's domain name.
  -alertmanager-storage.swift.user-id string
    	OpenStack Swift user ID.
  -alertmanager-storage.swift.username string
    	OpenStack Swift username.
  -alertmanager-storage.users-scanner.cache-ttl duration
    	TTL of the cached users. 0 disables caching and relies on caching at bucket client level.
  -alertmanager-storage.users-scanner.strategy string
    	Strategy to use to scan users. Supported values are: list, user_index. (default "list")
  -alertmanager-storage.users-scanner.user-index.max-stale-period duration
    	Maximum period of time to consider the user index as stale. Fall back to the base scanner if stale. Only valid when strategy is user_index. (default 1h0m0s)
  -alertmanager-storage.users-scanner.user-index.update-interval duration
    	How frequently user index file is updated. It only takes effect when user scan strategy is user_index. (default 15m0s)
  -alertmanager.alertmanager-client.connect-timeout duration
    	The maximum amount of time to establish a connection. A value of 0 means using default gRPC client connect timeout 5s. (default 5s)
  -alertmanager.alertmanager-client.grpc-compression string
    	Use compression when sending messages. Supported values are: 'gzip', 'snappy' and '' (disable compression)
  -alertmanager.alertmanager-client.grpc-max-recv-msg-size int
    	gRPC client max receive message size (bytes). (default 16777216)
  -alertmanager.alertmanager-client.grpc-max-send-msg-size int
    	gRPC client max send message size (bytes). (default 4194304)
  -alertmanager.alertmanager-client.remote-timeout duration
    	Timeout for downstream alertmanagers. (default 2s)
  -alertmanager.alertmanager-client.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -alertmanager.alertmanager-client.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -alertmanager.alertmanager-client.tls-enabled
    	Enable TLS in the GRPC client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to gRPC server will be used.
  -alertmanager.alertmanager-client.tls-insecure-skip-verify
    	Skip validating server certificate.
  -alertmanager.alertmanager-client.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -alertmanager.alertmanager-client.tls-server-name string
    	Override the expected name on the server certificate.
  -alertmanager.alerts-gc-interval duration
    	Alertmanager alerts Garbage collection interval. (default 30m0s)
  -alertmanager.api-concurrency int
    	Maximum number of concurrent GET API requests before returning an error.
  -alertmanager.cluster.advertise-address string
    	Explicit address or hostname to advertise in cluster.
  -alertmanager.cluster.gossip-interval duration
    	The interval between sending gossip messages. By lowering this value (more frequent) gossip messages are propagated across cluster more quickly at the expense of increased bandwidth usage. (default 200ms)
  -alertmanager.cluster.listen-address string
    	Listen address and port for the cluster. Not specifying this flag disables high-availability mode. (default "0.0.0.0:9094")
  -alertmanager.cluster.peer-timeout duration
    	Time to wait between peers to send notifications. (default 15s)
  -alertmanager.cluster.peers value
    	Comma-separated list of initial peers.
  -alertmanager.cluster.push-pull-interval duration
    	The interval between gossip state syncs. Setting this interval lower (more frequent) will increase convergence speeds across larger clusters at the expense of increased bandwidth usage. (default 1m0s)
  -alertmanager.configs.auto-webhook-root string
    	Root of URL to generate if config is http://internal.monitor
  -alertmanager.configs.fallback string
    	Filename of fallback config to use if none specified for instance.
  -alertmanager.configs.poll-interval duration
    	How frequently to poll Cortex configs (default 15s)
  -alertmanager.disabled-tenants value
    	Comma separated list of tenants whose alerts this alertmanager cannot process. If specified, a alertmanager that would normally pick the specified tenant(s) for processing will ignore them instead.
  -alertmanager.enable-api
    	Enable the alertmanager config api.
  -alertmanager.enabled-tenants value
    	Comma separated list of tenants whose alerts this alertmanager can process. If specified, only these tenants will be handled by alertmanager, otherwise this alertmanager can process alerts from all tenants.
  -alertmanager.max-alerts-count int
    	Maximum number of alerts that a single user can have. Inserting more alerts will fail with a log message and metric increment. 0 = no limit.
  -alertmanager.max-alerts-size-bytes int
    	Maximum total size of alerts that a single user can have, alert size is the sum of the bytes of its labels, annotations and generatorURL. Inserting more alerts will fail with a log message and metric increment. 0 = no limit.
  -alertmanager.max-config-size-bytes int
    	Maximum size of configuration file for Alertmanager that tenant can upload via Alertmanager API. 0 = no limit.
  -alertmanager.max-dispatcher-aggregation-groups int
    	Maximum number of aggregation groups in Alertmanager's dispatcher that a tenant can have. Each active aggregation group uses single goroutine. When the limit is reached, dispatcher will not dispatch alerts that belong to additional aggregation groups, but existing groups will keep working properly. 0 = no limit.
  -alertmanager.max-recv-msg-size int
    	Maximum size (bytes) of an accepted HTTP request body. (default 16777216)
  -alertmanager.max-silences-count int
    	Maximum number of silences that a single user can have, including expired silences. 0 = no limit.
  -alertmanager.max-silences-size-bytes int
    	Maximum size of individual silences that a single user can have. 0 = no limit.
  -alertmanager.max-template-size-bytes int
    	Maximum size of single template in tenant's Alertmanager configuration uploaded via Alertmanager API. 0 = no limit.
  -alertmanager.max-templates-count int
    	Maximum number of templates in tenant's Alertmanager configuration uploaded via Alertmanager API. 0 = no limit.
  -alertmanager.notification-rate-limit float
    	Per-user rate limit for sending notifications from Alertmanager in notifications/sec. 0 = rate limit disabled. Negative value = no notifications are allowed.
  -alertmanager.notification-rate-limit-per-integration value
    	Per-integration notification rate limits. Value is a map, where each key is integration name and value is a rate-limit (float). On command line, this map is given in JSON format. Rate limit has the same meaning as -alertmanager.notification-rate-limit, but only applies for specific integration. Allowed integration names: webhook, email, pagerduty, opsgenie, wechat, slack, victorops, pushover, sns, telegram, discord, webex, msteams, msteamsv2, jira, rocketchat. (default {})
  -alertmanager.persist-interval duration
    	The interval between persisting the current alertmanager state (notification log and silences) to object storage. This is only used when sharding is enabled. This state is read when all replicas for a shard can not be contacted. In this scenario, having persisted the state more frequently will result in potentially fewer lost silences, and fewer duplicate notifications. (default 15m0s)
  -alertmanager.receivers-firewall-block-cidr-networks value
    	Comma-separated list of network CIDRs to block in Alertmanager receiver integrations.
  -alertmanager.receivers-firewall-block-private-addresses
    	True to block private and local addresses in Alertmanager receiver integrations. It blocks private addresses defined by  RFC 1918 (IPv4 addresses) and RFC 4193 (IPv6 addresses), as well as loopback, local unicast and local multicast addresses.
  -alertmanager.sharding-enabled
    	Shard tenants across multiple alertmanager instances.
  -alertmanager.sharding-ring.consul.acl-token value
    	ACL Token used to interact with Consul.
  -alertmanager.sharding-ring.consul.client-timeout duration
    	HTTP timeout when talking to Consul. (default 20s)
  -alertmanager.sharding-ring.consul.consistent-reads
    	Enable consistent reads to Consul.
  -alertmanager.sharding-ring.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -alertmanager.sharding-ring.consul.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -alertmanager.sharding-ring.consul.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -alertmanager.sharding-ring.consul.tls-enabled
    	Enable TLS.
  -alertmanager.sharding-ring.consul.tls-insecure-skip-verify
    	Skip validating server certificate.
  -alertmanager.sharding-ring.consul.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -alertmanager.sharding-ring.consul.tls-server-name string
    	Override the expected name on the server certificate.
  -alertmanager.sharding-ring.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -alertmanager.sharding-ring.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -alertmanager.sharding-ring.detailed-metrics-enabled
    	Set to true to enable ring detailed metrics. These metrics provide detailed information, such as token count and ownership per tenant. Disabling them can significantly decrease the number of metrics emitted. (default true)
  -alertmanager.sharding-ring.disable-replica-set-extension
    	Disable extending the replica set when instances are unhealthy. This limits blast radius during config corruption incidents but reduces availability during normal failures.
  -alertmanager.sharding-ring.dynamodb.max-cas-retries int
    	Maximum number of retries for DDB KV CAS. (default 10)
  -alertmanager.sharding-ring.dynamodb.puller-sync-time duration
    	Time to refresh local ring with information on dynamodb. (default 1m0s)
  -alertmanager.sharding-ring.dynamodb.region string
    	Region to access dynamodb.
  -alertmanager.sharding-ring.dynamodb.table-name string
    	Table name to use on dynamodb.
  -alertmanager.sharding-ring.dynamodb.timeout duration
    	Timeout of dynamoDbClient requests. Default is 2m. (default 2m0s)
  -alertmanager.sharding-ring.dynamodb.ttl-time duration
    	Time to expire items on dynamodb.
  -alertmanager.sharding-ring.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -alertmanager.sharding-ring.etcd.endpoints value
    	The etcd endpoints to connect to.
  -alertmanager.sharding-ring.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -alertmanager.sharding-ring.etcd.password value
    	Etcd password.
  -alertmanager.sharding-ring.etcd.ping-without-stream-allowed
    	Send Keepalive pings with no streams. (default true)
  -alertmanager.sharding-ring.etcd.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -alertmanager.sharding-ring.etcd.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -alertmanager.sharding-ring.etcd.tls-enabled
    	Enable TLS.
  -alertmanager.sharding-ring.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -alertmanager.sharding-ring.etcd.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -alertmanager.sharding-ring.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -alertmanager.sharding-ring.etcd.username string
    	Etcd username.
  -alertmanager.sharding-ring.final-sleep duration
    	The sleep seconds when alertmanager is shutting down. Need to be close to or larger than KV Store information propagation delay
  -alertmanager.sharding-ring.heartbeat-period duration
    	Period at which to heartbeat to the ring. 0 = disabled. (default 15s)
  -alertmanager.sharding-ring.heartbeat-timeout duration
    	The heartbeat timeout after which alertmanagers are considered unhealthy within the ring. 0 = never (timeout disabled). (default 1m0s)
  -alertmanager.sharding-ring.instance-addr string
    	IP address to advertise in the ring.
  -alertmanager.sharding-ring.instance-availability-zone string
    	The availability zone where this instance is running. Required if zone-awareness is enabled.
  -alertmanager.sharding-ring.instance-id string
    	Instance ID to register in the ring. (default "localhost")
  -alertmanager.sharding-ring.instance-interface-names value
    	Name of network interface to read address from. (default [eth0 en0])
  -alertmanager.sharding-ring.instance-port int
    	Port to advertise in the ring (defaults to server.grpc-listen-port).
  -alertmanager.sharding-ring.keep-instance-in-the-ring-on-shutdown
    	Keep instance in the ring on shut down.
  -alertmanager.sharding-ring.multi.mirror-enabled
    	Mirror writes to secondary store.
  -alertmanager.sharding-ring.multi.mirror-timeout duration
    	Timeout for storing value to secondary store. (default 2s)
  -alertmanager.sharding-ring.multi.primary string
    	Primary backend storage used by multi-client.
  -alertmanager.sharding-ring.multi.secondary string
    	Secondary backend storage used by multi-client.
  -alertmanager.sharding-ring.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "alertmanagers/")
  -alertmanager.sharding-ring.replication-factor int
    	The replication factor to use when sharding the alertmanager. (default 3)
  -alertmanager.sharding-ring.store string
    	Backend storage to use for the ring. Supported values are: consul, dynamodb, etcd, inmemory, memberlist, multi. (default "consul")
  -alertmanager.sharding-ring.tokens-file-path string
    	File path where tokens are stored. If empty, tokens are not stored at shutdown and restored at startup.
  -alertmanager.sharding-ring.wait-instance-state-timeout duration
    	Timeout for waiting on alertmanager to become desired state in the ring. (default 10m0s)
  -alertmanager.sharding-ring.zone-awareness-enabled
    	True to enable zone-awareness and replicate alerts across different availability zones.
  -alertmanager.storage.path string
    	Base path for data storage. (default "data/")
  -alertmanager.storage.retention duration
    	How long to keep data for. (default 120h0m0s)
  -alertmanager.web.external-url value
    	The URL under which Alertmanager is externally reachable (for example, if Alertmanager is served via a reverse proxy). Used for generating relative and absolute links back to Alertmanager itself. If the URL has a path portion, it will be used to prefix all HTTP endpoints served by Alertmanager. If omitted, relevant URL components will be derived automatically.
  -api.build-info-enabled
    	If enabled, build Info API will be served by query frontend or querier.
  -api.http-request-headers-to-log value
    	Which HTTP Request headers to add to logs
  -api.querier-default-codec string
    	Choose default codec for querier response serialization. Supports 'json' and 'protobuf'. (default "json")
  -api.request-id-header string
    	HTTP header that can be used as request id
  -api.response-compression-enabled
    	Use GZIP compression for API responses. Some endpoints serve large YAML or JSON blobs which can benefit from compression.
  -auth.enabled
    	Set to false to disable auth. (default true)
  -blocks-storage.azure.account-key value
    	Azure storage account key
  -blocks-storage.azure.account-name string
    	Azure storage account name
  -blocks-storage.azure.connection-string account-name
    	The values of account-name and `endpoint-suffix` values will not be ignored if `connection-string` is set. Use this method over `account-key` if you need to authenticate via a SAS token or if you use the Azurite emulator.
  -blocks-storage.azure.container-name string
    	Azure storage container name
  -blocks-storage.azure.endpoint-suffix string
    	Azure storage endpoint suffix without schema. The account name will be prefixed to this value to create the FQDN
  -blocks-storage.azure.expect-continue-timeout duration
    	The time to wait for a server's first response headers after fully writing the request headers if the request has an Expect header. 0 to send the request body immediately. (default 1s)
  -blocks-storage.azure.http.idle-conn-timeout duration
    	The time an idle connection will remain idle before closing. (default 1m30s)
  -blocks-storage.azure.http.insecure-skip-verify
    	If the client connects via HTTPS and this option is enabled, the client will accept any certificate and hostname.
  -blocks-storage.azure.http.response-header-timeout duration
    	The amount of time the client will wait for a servers response headers. (default 2m0s)
  -blocks-storage.azure.max-connections-per-host int
    	Maximum number of connections per host. 0 means no limit.
  -blocks-storage.azure.max-idle-connections int
    	Maximum number of idle (keep-alive) connections across all hosts. 0 means no limit. (default 100)
  -blocks-storage.azure.max-idle-connections-per-host int
    	Maximum number of idle (keep-alive) connections to keep per-host. If 0, a built-in default value is used. (default 100)
  -blocks-storage.azure.max-retries int
    	Number of retries for recoverable errors (default 20)
  -blocks-storage.azure.msi-resource string
    	Deprecated: Azure storage MSI resource. It will be set automatically by Azure SDK.
  -blocks-storage.azure.tls-handshake-timeout duration
    	Maximum time to wait for a TLS handshake. 0 means no limit. (default 10s)
  -blocks-storage.azure.user-assigned-id string
    	Azure storage MSI resource managed identity client Id. If not supplied default Azure credential will be used. Set it to empty if you need to authenticate via Azure Workload Identity.
  -blocks-storage.backend string
    	Backend storage to use. Supported backends are: s3, gcs, azure, swift, filesystem. (default "s3")
  -blocks-storage.bucket-store.block-discovery-strategy string
    	One of concurrent, recursive, bucket_index. When set to concurrent, stores will concurrently issue one call per directory to discover active blocks in the bucket. The recursive strategy iterates through all objects in the bucket, recursively traversing into each directory. This avoids N+1 calls at the expense of having slower bucket iterations. bucket_index strategy can be used in Compactor only and utilizes the existing bucket index to fetch block IDs to sync. This avoids iterating the bucket but can be impacted by delays of cleaner creating bucket index. (default "concurrent")
  -blocks-storage.bucket-store.block-sync-concurrency int
    	Maximum number of concurrent blocks syncing per tenant. (default 20)
  -blocks-storage.bucket-store.bucket-index.enabled
    	True to enable querier and store-gateway to discover blocks in the storage via bucket index instead of bucket scanning. Disabling the bucket index is not recommended for production. (default true)
  -blocks-storage.bucket-store.bucket-index.idle-timeout duration
    	How long a unused bucket index should be cached. Once this timeout expires, the unused bucket index is removed from the in-memory cache. This option is used only by querier. (default 1h0m0s)
  -blocks-storage.bucket-store.bucket-index.max-stale-period duration
    	The maximum allowed age of a bucket index (last updated) before queries start failing because the bucket index is too old. The bucket index is periodically updated by the compactor, while this check is enforced in the querier (at query time). (default 1h0m0s)
  -blocks-storage.bucket-store.bucket-index.update-on-error-interval duration
    	How frequently a bucket index, which previously failed to load, should be tried to load again. This option is used only by querier. (default 1m0s)
  -blocks-storage.bucket-store.bucket-store-type string
    	Type of bucket store to use (tsdb or parquet). (default "tsdb")
  -blocks-storage.bucket-store.chunk-pool-max-bucket-size-bytes int
    	Size - in bytes - of the largest chunks pool bucket. (default 50000000)
  -blocks-storage.bucket-store.chunk-pool-min-bucket-size-bytes int
    	Size - in bytes - of the smallest chunks pool bucket. (default 16000)
  -blocks-storage.bucket-store.chunks-cache.attributes-ttl duration
    	TTL for caching object attributes for chunks. (default 168h0m0s)
  -blocks-storage.bucket-store.chunks-cache.backend string
    	The chunks cache backend type. Single or Multiple cache backend can be provided. Supported values in single cache: memcached, redis, inmemory, and '' (disable). Supported values in multi level cache: a comma-separated list of (inmemory, memcached, redis)
  -blocks-storage.bucket-store.chunks-cache.inmemory.max-size-bytes uint
    	Maximum size in bytes of in-memory chunks cache used (shared between all tenants). (default 1073741824)
  -blocks-storage.bucket-store.chunks-cache.max-get-range-requests int
    	Maximum number of sub-GetRange requests that a single GetRange request can be split into when fetching chunks. Zero or negative value = unlimited number of sub-requests. (default 3)
  -blocks-storage.bucket-store.chunks-cache.memcached.addresses string
    	Comma separated list of memcached addresses. Supported prefixes are: dns+ (looked up as an A/AAAA query), dnssrv+ (looked up as a SRV query, dnssrvnoa+ (looked up as a SRV query, with no A/AAAA lookup made after that).
  -blocks-storage.bucket-store.chunks-cache.memcached.auto-discovery
    	Use memcached auto-discovery mechanism provided by some cloud provider like GCP and AWS
  -blocks-storage.bucket-store.chunks-cache.memcached.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed. (default 10000)
  -blocks-storage.bucket-store.chunks-cache.memcached.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur. (default 3)
  -blocks-storage.bucket-store.chunks-cache.memcached.max-get-multi-batch-size int
    	The maximum number of keys a single underlying get operation should run. If more keys are specified, internally keys are split into multiple batches and fetched concurrently, honoring the max concurrency. If set to 0, the max batch size is unlimited.
  -blocks-storage.bucket-store.chunks-cache.memcached.max-get-multi-concurrency int
    	The maximum number of concurrent connections running get operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.chunks-cache.memcached.max-idle-connections int
    	The maximum number of idle connections that will be maintained per address. (default 16)
  -blocks-storage.bucket-store.chunks-cache.memcached.max-item-size int
    	The maximum size of an item stored in memcached. Bigger items are not stored. If set to 0, no maximum size is enforced. (default 1048576)
  -blocks-storage.bucket-store.chunks-cache.memcached.set-async.circuit-breaker.consecutive-failures uint
    	Consecutive failures to determine if the circuit breaker should open. (default 5)
  -blocks-storage.bucket-store.chunks-cache.memcached.set-async.circuit-breaker.enabled
    	If true, enable circuit breaker.
  -blocks-storage.bucket-store.chunks-cache.memcached.set-async.circuit-breaker.failure-percent float
    	Failure percentage to determine if the circuit breaker should open. (default 0.05)
  -blocks-storage.bucket-store.chunks-cache.memcached.set-async.circuit-breaker.half-open-max-requests uint
    	Maximum number of requests allowed to pass through when the circuit breaker is half-open. If set to 0, by default it allows 1 request. (default 10)
  -blocks-storage.bucket-store.chunks-cache.memcached.set-async.circuit-breaker.min-requests uint
    	Minimal requests to trigger the circuit breaker. (default 50)
  -blocks-storage.bucket-store.chunks-cache.memcached.set-async.circuit-breaker.open-duration duration
    	Period of the open state after which the state of the circuit breaker becomes half-open. If set to 0, by default open duration is 60 seconds. (default 5s)
  -blocks-storage.bucket-store.chunks-cache.memcached.timeout duration
    	The socket read/write timeout. (default 100ms)
  -blocks-storage.bucket-store.chunks-cache.multilevel.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed when backfilling cache items. (default 10000)
  -blocks-storage.bucket-store.chunks-cache.multilevel.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur when backfilling cache items. (default 3)
  -blocks-storage.bucket-store.chunks-cache.multilevel.max-backfill-items int
    	The maximum number of items to backfill per asynchronous operation. (default 10000)
  -blocks-storage.bucket-store.chunks-cache.redis.addresses string
    	Comma separated list of redis addresses. Supported prefixes are: dns+ (looked up as an A/AAAA query), dnssrv+ (looked up as a SRV query, dnssrvnoa+ (looked up as a SRV query, with no A/AAAA lookup made after that).
  -blocks-storage.bucket-store.chunks-cache.redis.cache-size int
    	If not zero then client-side caching is enabled. Client-side caching is when data is stored in memory instead of fetching data each time. See https://redis.io/docs/manual/client-side-caching/ for more info.
  -blocks-storage.bucket-store.chunks-cache.redis.db int
    	Database to be selected after connecting to the server.
  -blocks-storage.bucket-store.chunks-cache.redis.dial-timeout duration
    	Client dial timeout. (default 5s)
  -blocks-storage.bucket-store.chunks-cache.redis.get-multi-batch-size int
    	The maximum size per batch for mget. (default 100)
  -blocks-storage.bucket-store.chunks-cache.redis.master-name string
    	Specifies the master's name. Must be not empty for Redis Sentinel.
  -blocks-storage.bucket-store.chunks-cache.redis.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed. (default 10000)
  -blocks-storage.bucket-store.chunks-cache.redis.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur. (default 3)
  -blocks-storage.bucket-store.chunks-cache.redis.max-get-multi-concurrency int
    	The maximum number of concurrent GetMulti() operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.chunks-cache.redis.max-set-multi-concurrency int
    	The maximum number of concurrent SetMulti() operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.chunks-cache.redis.password value
    	Redis password.
  -blocks-storage.bucket-store.chunks-cache.redis.read-timeout duration
    	Client read timeout. (default 3s)
  -blocks-storage.bucket-store.chunks-cache.redis.set-async.circuit-breaker.consecutive-failures uint
    	Consecutive failures to determine if the circuit breaker should open. (default 5)
  -blocks-storage.bucket-store.chunks-cache.redis.set-async.circuit-breaker.enabled
    	If true, enable circuit breaker.
  -blocks-storage.bucket-store.chunks-cache.redis.set-async.circuit-breaker.failure-percent float
    	Failure percentage to determine if the circuit breaker should open. (default 0.05)
  -blocks-storage.bucket-store.chunks-cache.redis.set-async.circuit-breaker.half-open-max-requests uint
    	Maximum number of requests allowed to pass through when the circuit breaker is half-open. If set to 0, by default it allows 1 request. (default 10)
  -blocks-storage.bucket-store.chunks-cache.redis.set-async.circuit-breaker.min-requests uint
    	Minimal requests to trigger the circuit breaker. (default 50)
  -blocks-storage.bucket-store.chunks-cache.redis.set-async.circuit-breaker.open-duration duration
    	Period of the open state after which the state of the circuit breaker becomes half-open. If set to 0, by default open duration is 60 seconds. (default 5s)
  -blocks-storage.bucket-store.chunks-cache.redis.set-multi-batch-size int
    	The maximum size per batch for pipeline set. (default 100)
  -blocks-storage.bucket-store.chunks-cache.redis.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -blocks-storage.bucket-store.chunks-cache.redis.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -blocks-storage.bucket-store.chunks-cache.redis.tls-enabled
    	Whether to enable tls for redis connection.
  -blocks-storage.bucket-store.chunks-cache.redis.tls-insecure-skip-verify
    	Skip validating server certificate.
  -blocks-storage.bucket-store.chunks-cache.redis.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -blocks-storage.bucket-store.chunks-cache.redis.tls-server-name string
    	Override the expected name on the server certificate.
  -blocks-storage.bucket-store.chunks-cache.redis.username string
    	Redis username.
  -blocks-storage.bucket-store.chunks-cache.redis.write-timeout duration
    	Client write timeout. (default 3s)
  -blocks-storage.bucket-store.chunks-cache.subrange-size int
    	Size of each subrange that bucket object is split into for better caching. (default 16000)
  -blocks-storage.bucket-store.chunks-cache.subrange-ttl duration
    	TTL for caching individual chunks subranges. (default 24h0m0s)
  -blocks-storage.bucket-store.consistency-delay duration
    	Minimum age of a block before it's being read. Set it to safe value (e.g 30m) if your object storage is eventually consistent. GCS and S3 are (roughly) strongly consistent.
  -blocks-storage.bucket-store.estimated-max-chunk-size-bytes uint
    	Estimated max chunk size in bytes. Setting a large value might result in over fetching data while a small value might result in data refetch. Default value is 16KiB. (default 16000)
  -blocks-storage.bucket-store.estimated-max-series-size-bytes uint
    	Estimated max series size in bytes. Setting a large value might result in over fetching data while a small value might result in data refetch. Default value is 64KB. (default 65536)
  -blocks-storage.bucket-store.ignore-blocks-before now() - ignore_blocks_before
    	The blocks created before now() - ignore_blocks_before will not be synced. 0 to disable.
  -blocks-storage.bucket-store.ignore-blocks-within now() - ignore_blocks_within
    	The blocks created since now() - ignore_blocks_within will not be synced. This should be used together with `-querier.query-store-after` to filter out the blocks that are too new to be queried. A reasonable value for this flag would be `-querier.query-store-after - blocks-storage.bucket-store.bucket-index.max-stale-period` to give some buffer. 0 to disable.
  -blocks-storage.bucket-store.ignore-deletion-marks-delay duration
    	Duration after which the blocks marked for deletion will be filtered out while fetching blocks. The idea of ignore-deletion-marks-delay is to ignore blocks that are marked for deletion with some delay. This ensures store can still serve blocks that are meant to be deleted but do not have a replacement yet. Default is 6h, half of the default value for -compactor.deletion-delay. (default 6h0m0s)
  -blocks-storage.bucket-store.index-cache.backend string
    	The index cache backend type. Multiple cache backend can be provided as a comma-separated ordered list to enable the implementation of a cache hierarchy. Supported values: inmemory, memcached, redis. (default "inmemory")
  -blocks-storage.bucket-store.index-cache.inmemory.enabled-items value
    	Selectively cache index item types. Supported values are Postings, ExpandedPostings and Series
  -blocks-storage.bucket-store.index-cache.inmemory.max-size-bytes uint
    	Maximum size in bytes of in-memory index cache used to speed up blocks index lookups (shared between all tenants). (default 1073741824)
  -blocks-storage.bucket-store.index-cache.memcached.addresses string
    	Comma separated list of memcached addresses. Supported prefixes are: dns+ (looked up as an A/AAAA query), dnssrv+ (looked up as a SRV query, dnssrvnoa+ (looked up as a SRV query, with no A/AAAA lookup made after that).
  -blocks-storage.bucket-store.index-cache.memcached.auto-discovery
    	Use memcached auto-discovery mechanism provided by some cloud provider like GCP and AWS
  -blocks-storage.bucket-store.index-cache.memcached.enabled-items value
    	Selectively cache index item types. Supported values are Postings, ExpandedPostings and Series
  -blocks-storage.bucket-store.index-cache.memcached.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed. (default 10000)
  -blocks-storage.bucket-store.index-cache.memcached.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur. (default 3)
  -blocks-storage.bucket-store.index-cache.memcached.max-get-multi-batch-size int
    	The maximum number of keys a single underlying get operation should run. If more keys are specified, internally keys are split into multiple batches and fetched concurrently, honoring the max concurrency. If set to 0, the max batch size is unlimited.
  -blocks-storage.bucket-store.index-cache.memcached.max-get-multi-concurrency int
    	The maximum number of concurrent connections running get operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.index-cache.memcached.max-idle-connections int
    	The maximum number of idle connections that will be maintained per address. (default 16)
  -blocks-storage.bucket-store.index-cache.memcached.max-item-size int
    	The maximum size of an item stored in memcached. Bigger items are not stored. If set to 0, no maximum size is enforced. (default 1048576)
  -blocks-storage.bucket-store.index-cache.memcached.set-async.circuit-breaker.consecutive-failures uint
    	Consecutive failures to determine if the circuit breaker should open. (default 5)
  -blocks-storage.bucket-store.index-cache.memcached.set-async.circuit-breaker.enabled
    	If true, enable circuit breaker.
  -blocks-storage.bucket-store.index-cache.memcached.set-async.circuit-breaker.failure-percent float
    	Failure percentage to determine if the circuit breaker should open. (default 0.05)
  -blocks-storage.bucket-store.index-cache.memcached.set-async.circuit-breaker.half-open-max-requests uint
    	Maximum number of requests allowed to pass through when the circuit breaker is half-open. If set to 0, by default it allows 1 request. (default 10)
  -blocks-storage.bucket-store.index-cache.memcached.set-async.circuit-breaker.min-requests uint
    	Minimal requests to trigger the circuit breaker. (default 50)
  -blocks-storage.bucket-store.index-cache.memcached.set-async.circuit-breaker.open-duration duration
    	Period of the open state after which the state of the circuit breaker becomes half-open. If set to 0, by default open duration is 60 seconds. (default 5s)
  -blocks-storage.bucket-store.index-cache.memcached.timeout duration
    	The socket read/write timeout. (default 100ms)
  -blocks-storage.bucket-store.index-cache.multilevel.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed when backfilling cache items. (default 10000)
  -blocks-storage.bucket-store.index-cache.multilevel.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur when backfilling cache items. (default 3)
  -blocks-storage.bucket-store.index-cache.multilevel.max-backfill-items int
    	The maximum number of items to backfill per asynchronous operation. (default 10000)
  -blocks-storage.bucket-store.index-cache.redis.addresses string
    	Comma separated list of redis addresses. Supported prefixes are: dns+ (looked up as an A/AAAA query), dnssrv+ (looked up as a SRV query, dnssrvnoa+ (looked up as a SRV query, with no A/AAAA lookup made after that).
  -blocks-storage.bucket-store.index-cache.redis.cache-size int
    	If not zero then client-side caching is enabled. Client-side caching is when data is stored in memory instead of fetching data each time. See https://redis.io/docs/manual/client-side-caching/ for more info.
  -blocks-storage.bucket-store.index-cache.redis.db int
    	Database to be selected after connecting to the server.
  -blocks-storage.bucket-store.index-cache.redis.dial-timeout duration
    	Client dial timeout. (default 5s)
  -blocks-storage.bucket-store.index-cache.redis.enabled-items value
    	Selectively cache index item types. Supported values are Postings, ExpandedPostings and Series
  -blocks-storage.bucket-store.index-cache.redis.get-multi-batch-size int
    	The maximum size per batch for mget. (default 100)
  -blocks-storage.bucket-store.index-cache.redis.master-name string
    	Specifies the master's name. Must be not empty for Redis Sentinel.
  -blocks-storage.bucket-store.index-cache.redis.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed. (default 10000)
  -blocks-storage.bucket-store.index-cache.redis.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur. (default 3)
  -blocks-storage.bucket-store.index-cache.redis.max-get-multi-concurrency int
    	The maximum number of concurrent GetMulti() operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.index-cache.redis.max-set-multi-concurrency int
    	The maximum number of concurrent SetMulti() operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.index-cache.redis.password value
    	Redis password.
  -blocks-storage.bucket-store.index-cache.redis.read-timeout duration
    	Client read timeout. (default 3s)
  -blocks-storage.bucket-store.index-cache.redis.set-async.circuit-breaker.consecutive-failures uint
    	Consecutive failures to determine if the circuit breaker should open. (default 5)
  -blocks-storage.bucket-store.index-cache.redis.set-async.circuit-breaker.enabled
    	If true, enable circuit breaker.
  -blocks-storage.bucket-store.index-cache.redis.set-async.circuit-breaker.failure-percent float
    	Failure percentage to determine if the circuit breaker should open. (default 0.05)
  -blocks-storage.bucket-store.index-cache.redis.set-async.circuit-breaker.half-open-max-requests uint
    	Maximum number of requests allowed to pass through when the circuit breaker is half-open. If set to 0, by default it allows 1 request. (default 10)
  -blocks-storage.bucket-store.index-cache.redis.set-async.circuit-breaker.min-requests uint
    	Minimal requests to trigger the circuit breaker. (default 50)
  -blocks-storage.bucket-store.index-cache.redis.set-async.circuit-breaker.open-duration duration
    	Period of the open state after which the state of the circuit breaker becomes half-open. If set to 0, by default open duration is 60 seconds. (default 5s)
  -blocks-storage.bucket-store.index-cache.redis.set-multi-batch-size int
    	The maximum size per batch for pipeline set. (default 100)
  -blocks-storage.bucket-store.index-cache.redis.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -blocks-storage.bucket-store.index-cache.redis.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -blocks-storage.bucket-store.index-cache.redis.tls-enabled
    	Whether to enable tls for redis connection.
  -blocks-storage.bucket-store.index-cache.redis.tls-insecure-skip-verify
    	Skip validating server certificate.
  -blocks-storage.bucket-store.index-cache.redis.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -blocks-storage.bucket-store.index-cache.redis.tls-server-name string
    	Override the expected name on the server certificate.
  -blocks-storage.bucket-store.index-cache.redis.username string
    	Redis username.
  -blocks-storage.bucket-store.index-cache.redis.write-timeout duration
    	Client write timeout. (default 3s)
  -blocks-storage.bucket-store.index-header-lazy-loading-enabled
    	If enabled, store-gateway will lazily memory-map an index-header only once required by a query.
  -blocks-storage.bucket-store.index-header-lazy-loading-idle-timeout duration
    	If index-header lazy loading is enabled and this setting is > 0, the store-gateway will release memory-mapped index-headers after 'idle timeout' inactivity. (default 20m0s)
  -blocks-storage.bucket-store.lazy-expanded-posting-group-max-key-series-ratio float
    	Mark posting group as lazy if it fetches more keys than R * max series the query should fetch. With R set to 100, a posting group which fetches 100K keys will be marked as lazy if the current query only fetches 1000 series. This config is only valid if lazy expanded posting is enabled. 0 disables the limit. (default 100)
  -blocks-storage.bucket-store.lazy-expanded-postings-enabled
    	If true, Store Gateway will estimate postings size and try to lazily expand postings if it downloads less data than expanding all postings.
  -blocks-storage.bucket-store.matchers-cache-max-items int
    	Maximum number of entries in the regex matchers cache. 0 to disable.
  -blocks-storage.bucket-store.max-chunk-pool-bytes uint
    	Max size - in bytes - of a chunks pool, used to reduce memory allocations. The pool is shared across all tenants. 0 to disable the limit. (default 2147483648)
  -blocks-storage.bucket-store.max-concurrent int
    	Max number of concurrent queries to execute against the long-term storage. The limit is shared across all tenants. (default 100)
  -blocks-storage.bucket-store.max-inflight-requests int
    	Max number of inflight queries to execute against the long-term storage. The limit is shared across all tenants. 0 to disable.
  -blocks-storage.bucket-store.meta-sync-concurrency int
    	Number of Go routines to use when syncing block meta files from object storage per tenant. (default 20)
  -blocks-storage.bucket-store.metadata-cache.backend string
    	The metadata cache backend type. Single or Multiple cache backend can be provided. Supported values in single cache: memcached, redis, inmemory, and '' (disable). Supported values in multi level cache: a comma-separated list of (inmemory, memcached, redis)
  -blocks-storage.bucket-store.metadata-cache.block-index-attributes-ttl duration
    	How long to cache attributes of the block index. (default 168h0m0s)
  -blocks-storage.bucket-store.metadata-cache.bucket-index-content-ttl duration
    	How long to cache content of the bucket index. (default 5m0s)
  -blocks-storage.bucket-store.metadata-cache.bucket-index-max-size-bytes int
    	Maximum size of bucket index content to cache in bytes. Caching will be skipped if the content exceeds this size. This is useful to avoid network round trip for large content if the configured caching backend has an hard limit on cached items size (in this case, you should set this limit to the same limit in the caching backend). (default 1048576)
  -blocks-storage.bucket-store.metadata-cache.chunks-list-ttl duration
    	How long to cache list of chunks for a block. (default 24h0m0s)
  -blocks-storage.bucket-store.metadata-cache.inmemory.max-size-bytes uint
    	Maximum size in bytes of in-memory metadata cache used (shared between all tenants). (default 1073741824)
  -blocks-storage.bucket-store.metadata-cache.memcached.addresses string
    	Comma separated list of memcached addresses. Supported prefixes are: dns+ (looked up as an A/AAAA query), dnssrv+ (looked up as a SRV query, dnssrvnoa+ (looked up as a SRV query, with no A/AAAA lookup made after that).
  -blocks-storage.bucket-store.metadata-cache.memcached.auto-discovery
    	Use memcached auto-discovery mechanism provided by some cloud provider like GCP and AWS
  -blocks-storage.bucket-store.metadata-cache.memcached.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed. (default 10000)
  -blocks-storage.bucket-store.metadata-cache.memcached.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur. (default 3)
  -blocks-storage.bucket-store.metadata-cache.memcached.max-get-multi-batch-size int
    	The maximum number of keys a single underlying get operation should run. If more keys are specified, internally keys are split into multiple batches and fetched concurrently, honoring the max concurrency. If set to 0, the max batch size is unlimited.
  -blocks-storage.bucket-store.metadata-cache.memcached.max-get-multi-concurrency int
    	The maximum number of concurrent connections running get operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.metadata-cache.memcached.max-idle-connections int
    	The maximum number of idle connections that will be maintained per address. (default 16)
  -blocks-storage.bucket-store.metadata-cache.memcached.max-item-size int
    	The maximum size of an item stored in memcached. Bigger items are not stored. If set to 0, no maximum size is enforced. (default 1048576)
  -blocks-storage.bucket-store.metadata-cache.memcached.set-async.circuit-breaker.consecutive-failures uint
    	Consecutive failures to determine if the circuit breaker should open. (default 5)
  -blocks-storage.bucket-store.metadata-cache.memcached.set-async.circuit-breaker.enabled
    	If true, enable circuit breaker.
  -blocks-storage.bucket-store.metadata-cache.memcached.set-async.circuit-breaker.failure-percent float
    	Failure percentage to determine if the circuit breaker should open. (default 0.05)
  -blocks-storage.bucket-store.metadata-cache.memcached.set-async.circuit-breaker.half-open-max-requests uint
    	Maximum number of requests allowed to pass through when the circuit breaker is half-open. If set to 0, by default it allows 1 request. (default 10)
  -blocks-storage.bucket-store.metadata-cache.memcached.set-async.circuit-breaker.min-requests uint
    	Minimal requests to trigger the circuit breaker. (default 50)
  -blocks-storage.bucket-store.metadata-cache.memcached.set-async.circuit-breaker.open-duration duration
    	Period of the open state after which the state of the circuit breaker becomes half-open. If set to 0, by default open duration is 60 seconds. (default 5s)
  -blocks-storage.bucket-store.metadata-cache.memcached.timeout duration
    	The socket read/write timeout. (default 100ms)
  -blocks-storage.bucket-store.metadata-cache.metafile-attributes-ttl duration
    	How long to cache attributes of the block metafile. (default 168h0m0s)
  -blocks-storage.bucket-store.metadata-cache.metafile-content-ttl duration
    	How long to cache content of the metafile. (default 24h0m0s)
  -blocks-storage.bucket-store.metadata-cache.metafile-doesnt-exist-ttl duration
    	How long to cache information that block metafile doesn't exist. Also used for user deletion mark file. (default 5m0s)
  -blocks-storage.bucket-store.metadata-cache.metafile-exists-ttl duration
    	How long to cache information that block metafile exists. Also used for user deletion mark file. (default 2h0m0s)
  -blocks-storage.bucket-store.metadata-cache.metafile-max-size-bytes int
    	Maximum size of metafile content to cache in bytes. Caching will be skipped if the content exceeds this size. This is useful to avoid network round trip for large content if the configured caching backend has an hard limit on cached items size (in this case, you should set this limit to the same limit in the caching backend). (default 1048576)
  -blocks-storage.bucket-store.metadata-cache.multilevel.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed when backfilling cache items. (default 10000)
  -blocks-storage.bucket-store.metadata-cache.multilevel.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur when backfilling cache items. (default 3)
  -blocks-storage.bucket-store.metadata-cache.multilevel.max-backfill-items int
    	The maximum number of items to backfill per asynchronous operation. (default 10000)
  -blocks-storage.bucket-store.metadata-cache.partitioned-groups-list-ttl duration
    	How long to cache list of partitioned groups for an user. 0 disables caching
  -blocks-storage.bucket-store.metadata-cache.redis.addresses string
    	Comma separated list of redis addresses. Supported prefixes are: dns+ (looked up as an A/AAAA query), dnssrv+ (looked up as a SRV query, dnssrvnoa+ (looked up as a SRV query, with no A/AAAA lookup made after that).
  -blocks-storage.bucket-store.metadata-cache.redis.cache-size int
    	If not zero then client-side caching is enabled. Client-side caching is when data is stored in memory instead of fetching data each time. See https://redis.io/docs/manual/client-side-caching/ for more info.
  -blocks-storage.bucket-store.metadata-cache.redis.db int
    	Database to be selected after connecting to the server.
  -blocks-storage.bucket-store.metadata-cache.redis.dial-timeout duration
    	Client dial timeout. (default 5s)
  -blocks-storage.bucket-store.metadata-cache.redis.get-multi-batch-size int
    	The maximum size per batch for mget. (default 100)
  -blocks-storage.bucket-store.metadata-cache.redis.master-name string
    	Specifies the master's name. Must be not empty for Redis Sentinel.
  -blocks-storage.bucket-store.metadata-cache.redis.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed. (default 10000)
  -blocks-storage.bucket-store.metadata-cache.redis.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur. (default 3)
  -blocks-storage.bucket-store.metadata-cache.redis.max-get-multi-concurrency int
    	The maximum number of concurrent GetMulti() operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.metadata-cache.redis.max-set-multi-concurrency int
    	The maximum number of concurrent SetMulti() operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.metadata-cache.redis.password value
    	Redis password.
  -blocks-storage.bucket-store.metadata-cache.redis.read-timeout duration
    	Client read timeout. (default 3s)
  -blocks-storage.bucket-store.metadata-cache.redis.set-async.circuit-breaker.consecutive-failures uint
    	Consecutive failures to determine if the circuit breaker should open. (default 5)
  -blocks-storage.bucket-store.metadata-cache.redis.set-async.circuit-breaker.enabled
    	If true, enable circuit breaker.
  -blocks-storage.bucket-store.metadata-cache.redis.set-async.circuit-breaker.failure-percent float
    	Failure percentage to determine if the circuit breaker should open. (default 0.05)
  -blocks-storage.bucket-store.metadata-cache.redis.set-async.circuit-breaker.half-open-max-requests uint
    	Maximum number of requests allowed to pass through when the circuit breaker is half-open. If set to 0, by default it allows 1 request. (default 10)
  -blocks-storage.bucket-store.metadata-cache.redis.set-async.circuit-breaker.min-requests uint
    	Minimal requests to trigger the circuit breaker. (default 50)
  -blocks-storage.bucket-store.metadata-cache.redis.set-async.circuit-breaker.open-duration duration
    	Period of the open state after which the state of the circuit breaker becomes half-open. If set to 0, by default open duration is 60 seconds. (default 5s)
  -blocks-storage.bucket-store.metadata-cache.redis.set-multi-batch-size int
    	The maximum size per batch for pipeline set. (default 100)
  -blocks-storage.bucket-store.metadata-cache.redis.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -blocks-storage.bucket-store.metadata-cache.redis.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -blocks-storage.bucket-store.metadata-cache.redis.tls-enabled
    	Whether to enable tls for redis connection.
  -blocks-storage.bucket-store.metadata-cache.redis.tls-insecure-skip-verify
    	Skip validating server certificate.
  -blocks-storage.bucket-store.metadata-cache.redis.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -blocks-storage.bucket-store.metadata-cache.redis.tls-server-name string
    	Override the expected name on the server certificate.
  -blocks-storage.bucket-store.metadata-cache.redis.username string
    	Redis username.
  -blocks-storage.bucket-store.metadata-cache.redis.write-timeout duration
    	Client write timeout. (default 3s)
  -blocks-storage.bucket-store.metadata-cache.tenant-blocks-list-ttl duration
    	How long to cache list of blocks for each tenant. (default 5m0s)
  -blocks-storage.bucket-store.metadata-cache.tenants-list-ttl duration
    	How long to cache list of tenants in the bucket. (default 15m0s)
  -blocks-storage.bucket-store.parquet-labels-cache.attributes-ttl duration
    	TTL for caching object attributes for parquet labels file. (default 168h0m0s)
  -blocks-storage.bucket-store.parquet-labels-cache.backend string
    	The parquet labels cache backend type. Single or Multiple cache backend can be provided. Supported values in single cache: memcached, redis, inmemory, and '' (disable). Supported values in multi level cache: a comma-separated list of (inmemory, memcached, redis)
  -blocks-storage.bucket-store.parquet-labels-cache.inmemory.max-size-bytes uint
    	Maximum size in bytes of in-memory parquet-labels cache used (shared between all tenants). (default 1073741824)
  -blocks-storage.bucket-store.parquet-labels-cache.max-get-range-requests int
    	Maximum number of sub-GetRange requests that a single GetRange request can be split into when fetching parquet labels file. Zero or negative value = unlimited number of sub-requests. (default 3)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.addresses string
    	Comma separated list of memcached addresses. Supported prefixes are: dns+ (looked up as an A/AAAA query), dnssrv+ (looked up as a SRV query, dnssrvnoa+ (looked up as a SRV query, with no A/AAAA lookup made after that).
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.auto-discovery
    	Use memcached auto-discovery mechanism provided by some cloud provider like GCP and AWS
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed. (default 10000)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur. (default 3)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.max-get-multi-batch-size int
    	The maximum number of keys a single underlying get operation should run. If more keys are specified, internally keys are split into multiple batches and fetched concurrently, honoring the max concurrency. If set to 0, the max batch size is unlimited.
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.max-get-multi-concurrency int
    	The maximum number of concurrent connections running get operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.max-idle-connections int
    	The maximum number of idle connections that will be maintained per address. (default 16)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.max-item-size int
    	The maximum size of an item stored in memcached. Bigger items are not stored. If set to 0, no maximum size is enforced. (default 1048576)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.set-async.circuit-breaker.consecutive-failures uint
    	Consecutive failures to determine if the circuit breaker should open. (default 5)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.set-async.circuit-breaker.enabled
    	If true, enable circuit breaker.
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.set-async.circuit-breaker.failure-percent float
    	Failure percentage to determine if the circuit breaker should open. (default 0.05)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.set-async.circuit-breaker.half-open-max-requests uint
    	Maximum number of requests allowed to pass through when the circuit breaker is half-open. If set to 0, by default it allows 1 request. (default 10)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.set-async.circuit-breaker.min-requests uint
    	Minimal requests to trigger the circuit breaker. (default 50)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.set-async.circuit-breaker.open-duration duration
    	Period of the open state after which the state of the circuit breaker becomes half-open. If set to 0, by default open duration is 60 seconds. (default 5s)
  -blocks-storage.bucket-store.parquet-labels-cache.memcached.timeout duration
    	The socket read/write timeout. (default 100ms)
  -blocks-storage.bucket-store.parquet-labels-cache.multilevel.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed when backfilling cache items. (default 10000)
  -blocks-storage.bucket-store.parquet-labels-cache.multilevel.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur when backfilling cache items. (default 3)
  -blocks-storage.bucket-store.parquet-labels-cache.multilevel.max-backfill-items int
    	The maximum number of items to backfill per asynchronous operation. (default 10000)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.addresses string
    	Comma separated list of redis addresses. Supported prefixes are: dns+ (looked up as an A/AAAA query), dnssrv+ (looked up as a SRV query, dnssrvnoa+ (looked up as a SRV query, with no A/AAAA lookup made after that).
  -blocks-storage.bucket-store.parquet-labels-cache.redis.cache-size int
    	If not zero then client-side caching is enabled. Client-side caching is when data is stored in memory instead of fetching data each time. See https://redis.io/docs/manual/client-side-caching/ for more info.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.db int
    	Database to be selected after connecting to the server.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.dial-timeout duration
    	Client dial timeout. (default 5s)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.get-multi-batch-size int
    	The maximum size per batch for mget. (default 100)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.master-name string
    	Specifies the master's name. Must be not empty for Redis Sentinel.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.max-async-buffer-size int
    	The maximum number of enqueued asynchronous operations allowed. (default 10000)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.max-async-concurrency int
    	The maximum number of concurrent asynchronous operations can occur. (default 3)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.max-get-multi-concurrency int
    	The maximum number of concurrent GetMulti() operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.max-set-multi-concurrency int
    	The maximum number of concurrent SetMulti() operations. If set to 0, concurrency is unlimited. (default 100)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.password value
    	Redis password.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.read-timeout duration
    	Client read timeout. (default 3s)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.set-async.circuit-breaker.consecutive-failures uint
    	Consecutive failures to determine if the circuit breaker should open. (default 5)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.set-async.circuit-breaker.enabled
    	If true, enable circuit breaker.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.set-async.circuit-breaker.failure-percent float
    	Failure percentage to determine if the circuit breaker should open. (default 0.05)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.set-async.circuit-breaker.half-open-max-requests uint
    	Maximum number of requests allowed to pass through when the circuit breaker is half-open. If set to 0, by default it allows 1 request. (default 10)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.set-async.circuit-breaker.min-requests uint
    	Minimal requests to trigger the circuit breaker. (default 50)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.set-async.circuit-breaker.open-duration duration
    	Period of the open state after which the state of the circuit breaker becomes half-open. If set to 0, by default open duration is 60 seconds. (default 5s)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.set-multi-batch-size int
    	The maximum size per batch for pipeline set. (default 100)
  -blocks-storage.bucket-store.parquet-labels-cache.redis.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.tls-enabled
    	Whether to enable tls for redis connection.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.tls-insecure-skip-verify
    	Skip validating server certificate.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.tls-server-name string
    	Override the expected name on the server certificate.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.username string
    	Redis username.
  -blocks-storage.bucket-store.parquet-labels-cache.redis.write-timeout duration
    	Client write timeout. (default 3s)
  -blocks-storage.bucket-store.parquet-labels-cache.subrange-size int
    	Size of each subrange that bucket object is split into for better caching. (default 16000)
  -blocks-storage.bucket-store.parquet-labels-cache.subrange-ttl duration
    	TTL for caching individual subranges. (default 24h0m0s)
  -blocks-storage.bucket-store.parquet-shard-cache-size int
    	[Experimental] Maximum size of the Parquet shard cache. 0 to disable. (default 512)
  -blocks-storage.bucket-store.parquet-shard-cache-ttl duration
    	[Experimental] TTL of the Parquet shard cache. 0 to no TTL. (default 24h0m0s)
  -blocks-storage.bucket-store.partitioner-max-gap-bytes uint
    	Max size - in bytes - of a gap for which the partitioner aggregates together two bucket GET object requests. (default 524288)
  -blocks-storage.bucket-store.posting-offsets-in-mem-sampling int
    	Controls what is the ratio of postings offsets that the store will hold in memory. (default 32)
  -blocks-storage.bucket-store.series-batch-size int
    	Controls how many series to fetch per batch in Store Gateway. Default value is 10000. (default 10000)
  -blocks-storage.bucket-store.sync-dir string
    	Directory to store synchronized TSDB index headers. (default "tsdb-sync")
  -blocks-storage.bucket-store.sync-interval duration
    	How frequently to scan the bucket, or to refresh the bucket index (if enabled), in order to look for changes (new blocks shipped by ingesters and blocks deleted by retention or compaction). (default 15m0s)
  -blocks-storage.bucket-store.tenant-sync-concurrency int
    	Maximum number of concurrent tenants syncing blocks. (default 10)
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.fetched-chunks-token-factor float
    	Multiplication factor used for fetched chunks token
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.fetched-postings-token-factor float
    	Multiplication factor used for fetched postings token
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.fetched-series-token-factor float
    	Multiplication factor used for fetched series token
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.instance-token-bucket-size int
    	Instance token bucket size (default 859832320)
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.mode string
    	Token bucket bytes limiter mode. Supported values are: disabled, dryrun, enabled (default "disabled")
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.request-token-bucket-size int
    	Request token bucket size (default 4194304)
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.touched-chunks-token-factor float
    	Multiplication factor used for touched chunks token (default 1)
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.touched-postings-token-factor float
    	Multiplication factor used for touched postings token (default 5)
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.touched-series-token-factor float
    	Multiplication factor used for touched series token (default 25)
  -blocks-storage.bucket-store.token-bucket-bytes-limiter.user-token-bucket-size int
    	User token bucket size (default 644874240)
  -blocks-storage.expanded_postings_cache.block.enabled
    	Whether the postings cache is enabled or not
  -blocks-storage.expanded_postings_cache.block.fetch-timeout duration
    	Timeout for fetching postings from TSDB index when cache miss occurs. This prevents runaway queries from consuming resources when all callers have given up.
  -blocks-storage.expanded_postings_cache.block.max-bytes int
    	Max bytes for postings cache (default 10485760)
  -blocks-storage.expanded_postings_cache.block.ttl duration
    	TTL for postings cache (default 10m0s)
  -blocks-storage.expanded_postings_cache.head.enabled
    	Whether the postings cache is enabled or not
  -blocks-storage.expanded_postings_cache.head.fetch-timeout duration
    	Timeout for fetching postings from TSDB index when cache miss occurs. This prevents runaway queries from consuming resources when all callers have given up.
  -blocks-storage.expanded_postings_cache.head.max-bytes int
    	Max bytes for postings cache (default 10485760)
  -blocks-storage.expanded_postings_cache.head.ttl duration
    	TTL for postings cache (default 10m0s)
  -blocks-storage.filesystem.dir string
    	Local filesystem storage directory.
  -blocks-storage.gcs.bucket-name string
    	GCS bucket name
  -blocks-storage.gcs.service-account value
    	JSON representing either a Google Developers Console client_credentials.json file or a Google Developers service account key file. If empty, fallback to Google default logic.
  -blocks-storage.s3.access-key-id string
    	S3 access key ID
  -blocks-storage.s3.bucket-lookup-type string
    	The s3 bucket lookup style. Supported values are: auto, virtual-hosted, path. (default "auto")
  -blocks-storage.s3.bucket-name string
    	S3 bucket name
  -blocks-storage.s3.disable-dualstack
    	If enabled, S3 endpoint will use the non-dualstack variant.
  -blocks-storage.s3.endpoint string
    	The S3 bucket endpoint. It could be an AWS S3 endpoint listed at https://docs.aws.amazon.com/general/latest/gr/s3.html or the address of an S3-compatible service in hostname:port format.
  -blocks-storage.s3.expect-continue-timeout duration
    	The time to wait for a server's first response headers after fully writing the request headers if the request has an Expect header. 0 to send the request body immediately. (default 1s)
  -blocks-storage.s3.http.idle-conn-timeout duration
    	The time an idle connection will remain idle before closing. (default 1m30s)
  -blocks-storage.s3.http.insecure-skip-verify
    	If the client connects via HTTPS and this option is enabled, the client will accept any certificate and hostname.
  -blocks-storage.s3.http.response-header-timeout duration
    	The amount of time the client will wait for a servers response headers. (default 2m0s)
  -blocks-storage.s3.insecure
    	If enabled, use http:// for the S3 endpoint instead of https://. This could be useful in local dev/test environments while using an S3-compatible backend storage, like Minio.
  -blocks-storage.s3.list-objects-version string
    	The list api version. Supported values are: v1, v2, and ''.
  -blocks-storage.s3.max-connections-per-host int
    	Maximum number of connections per host. 0 means no limit.
  -blocks-storage.s3.max-idle-connections int
    	Maximum number of idle (keep-alive) connections across all hosts. 0 means no limit. (default 100)
  -blocks-storage.s3.max-idle-connections-per-host int
    	Maximum number of idle (keep-alive) connections to keep per-host. If 0, a built-in default value is used. (default 100)
  -blocks-storage.s3.region string
    	S3 region. If unset, the client will issue a S3 GetBucketLocation API call to autodetect it.
  -blocks-storage.s3.secret-access-key value
    	S3 secret access key
  -blocks-storage.s3.send-content-md5
    	If true, attach MD5 checksum when upload objects and S3 uses MD5 checksum algorithm to verify the provided digest. If false, use CRC32C algorithm instead. (default true)
  -blocks-storage.s3.signature-version string
    	The signature version to use for authenticating against S3. Supported values are: v4, v2. (default "v4")
  -blocks-storage.s3.sse.kms-encryption-context string
    	KMS Encryption Context used for object encryption. It expects JSON formatted string.
  -blocks-storage.s3.sse.kms-key-id string
    	KMS Key ID used to encrypt objects in S3
  -blocks-storage.s3.sse.type string
    	Enable AWS Server Side Encryption. Supported values: SSE-KMS, SSE-S3.
  -blocks-storage.s3.tls-handshake-timeout duration
    	Maximum time to wait for a TLS handshake. 0 means no limit. (default 10s)
  -blocks-storage.swift.application-credential-id string
    	OpenStack Swift application credential ID.
  -blocks-storage.swift.application-credential-name string
    	OpenStack Swift application credential name.
  -blocks-storage.swift.application-credential-secret value
    	OpenStack Swift application credential secret.
  -blocks-storage.swift.auth-url string
    	OpenStack Swift authentication URL
  -blocks-storage.swift.auth-version int
    	OpenStack Swift authentication API version. 0 to autodetect.
  -blocks-storage.swift.connect-timeout duration
    	Time after which a connection attempt is aborted. (default 10s)
  -blocks-storage.swift.container-name string
    	Name of the OpenStack Swift container to put chunks in.
  -blocks-storage.swift.domain-id string
    	OpenStack Swift user's domain ID.
  -blocks-storage.swift.domain-name string
    	OpenStack Swift user's domain name.
  -blocks-storage.swift.max-retries int
    	Max retries on requests error. (default 3)
  -blocks-storage.swift.password value
    	OpenStack Swift API key.
  -blocks-storage.swift.project-domain-id string
    	ID of the OpenStack Swift project's domain (v3 auth only), only needed if it differs the from user domain.
  -blocks-storage.swift.project-domain-name string
    	Name of the OpenStack Swift project's domain (v3 auth only), only needed if it differs from the user domain.
  -blocks-storage.swift.project-id string
    	OpenStack Swift project ID (v2,v3 auth only).
  -blocks-storage.swift.project-name string
    	OpenStack Swift project name (v2,v3 auth only).
  -blocks-storage.swift.region-name string
    	OpenStack Swift Region to use (v2,v3 auth only).
  -blocks-storage.swift.request-timeout duration
    	Time after which an idle request is aborted. The timeout watchdog is reset each time some data is received, so the timeout triggers after X time no data is received on a request. (default 5s)
  -blocks-storage.swift.user-domain-id string
    	OpenStack Swift user's domain ID.
  -blocks-storage.swift.user-domain-name string
    	OpenStack Swift user's domain name.
  -blocks-storage.swift.user-id string
    	OpenStack Swift user ID.
  -blocks-storage.swift.username string
    	OpenStack Swift username.
  -blocks-storage.tsdb.block-ranges-period value
    	TSDB blocks range period. (default 2h0m0s)
  -blocks-storage.tsdb.close-idle-tsdb-timeout duration
    	If TSDB has not received any data for this duration, and all blocks from TSDB have been shipped, TSDB is closed and deleted from local disk. If set to positive value, this value should be equal or higher than -querier.query-ingesters-within flag to make sure that TSDB is not closed prematurely, which could cause partial query results. 0 or negative value disables closing of idle TSDB.
  -blocks-storage.tsdb.dir string
    	Local directory to store TSDBs in the ingesters. (default "tsdb")
  -blocks-storage.tsdb.enable-native-histograms
    	[EXPERIMENTAL] True to enable native histogram.
  -blocks-storage.tsdb.flush-blocks-on-shutdown
    	True to flush blocks to storage on shutdown. If false, incomplete blocks will be reused after restart.
  -blocks-storage.tsdb.head-chunks-write-buffer-size-bytes int
    	The write buffer size used by the head chunks mapper. Lower values reduce memory utilisation on clusters with a large number of tenants at the cost of increased disk I/O operations. (default 4194304)
  -blocks-storage.tsdb.head-chunks-write-queue-size int
    	The size of the in-memory queue used before flushing chunks to the disk.
  -blocks-storage.tsdb.head-compaction-concurrency int
    	Maximum number of tenants concurrently compacting TSDB head into a new block (default 5)
  -blocks-storage.tsdb.head-compaction-idle-timeout duration
    	If TSDB head is idle for this duration, it is compacted. Note that up to 25% jitter is added to the value to avoid ingesters compacting concurrently. 0 means disabled. (default 1h0m0s)
  -blocks-storage.tsdb.head-compaction-interval duration
    	How frequently does Cortex try to compact TSDB head. Block is only created if data covers smallest block range. Must be greater than 0 and max 30 minutes. Note that up to 50% jitter is added to the value for the first compaction to avoid ingesters compacting concurrently. (default 1m0s)
  -blocks-storage.tsdb.max-exemplars int
    	Deprecated, use maxExemplars in limits instead. If the MaxExemplars value in limits is set to zero, cortex will fallback on this value. This setting enables support for exemplars in TSDB and sets the maximum number that will be stored. 0 or less means disabled.
  -blocks-storage.tsdb.max-tsdb-opening-concurrency-on-startup int
    	limit the number of concurrently opening TSDB's on startup (default 10)
  -blocks-storage.tsdb.memory-snapshot-on-shutdown
    	True to enable snapshotting of in-memory TSDB data on disk when shutting down.
  -blocks-storage.tsdb.out-of-order-cap-max int
    	[EXPERIMENTAL] Configures the maximum number of samples per chunk that can be out-of-order. (default 32)
  -blocks-storage.tsdb.retention-period duration
    	TSDB blocks retention in the ingester before a block is removed. This should be larger than the block_ranges_period and large enough to give store-gateways and queriers enough time to discover newly uploaded blocks. (default 6h0m0s)
  -blocks-storage.tsdb.ship-concurrency int
    	Maximum number of tenants concurrently shipping blocks to the storage. (default 10)
  -blocks-storage.tsdb.ship-interval duration
    	How frequently the TSDB blocks are scanned and new ones are shipped to the storage. 0 means shipping is disabled. (default 1m0s)
  -blocks-storage.tsdb.stripe-size int
    	The number of shards of series to use in TSDB (must be a power of 2). Reducing this will decrease memory footprint, but can negatively impact performance. (default 16384)
  -blocks-storage.tsdb.wal-compression-enabled value
    	Deprecated (use blocks-storage.tsdb.wal-compression-type instead): True to enable TSDB WAL compression.
  -blocks-storage.tsdb.wal-compression-type string
    	TSDB WAL type. Supported values are: 'snappy', 'zstd' and '' (disable compression)
  -blocks-storage.tsdb.wal-segment-size-bytes int
    	TSDB WAL segments files max size (bytes). (default 134217728)
  -blocks-storage.users-scanner.cache-ttl duration
    	TTL of the cached users. 0 disables caching and relies on caching at bucket client level.
  -blocks-storage.users-scanner.strategy string
    	Strategy to use to scan users. Supported values are: list, user_index. (default "list")
  -blocks-storage.users-scanner.user-index.max-stale-period duration
    	Maximum period of time to consider the user index as stale. Fall back to the base scanner if stale. Only valid when strategy is user_index. (default 1h0m0s)
  -blocks-storage.users-scanner.user-index.update-interval duration
    	How frequently user index file is updated. It only takes effect when user scan strategy is user_index. (default 15m0s)
  -compactor.accept-malformed-index
    	When enabled, index verification will ignore out of order label names.
  -compactor.auto-forget-delay duration
    	Time since last heartbeat before compactor will be removed from ring. 0 to disable (default 2m0s)
  -compactor.block-deletion-marks-migration-enabled
    	When enabled, at compactor startup the bucket will be scanned and all found deletion marks inside the block location will be copied to the markers global location too. This option can (and should) be safely disabled as soon as the compactor has successfully run at least once.
  -compactor.block-files-concurrency int
    	Number of goroutines to use when fetching/uploading block files from object storage. (default 10)
  -compactor.block-ranges value
    	List of compaction time ranges. (default 2h0m0s,12h0m0s,24h0m0s)
  -compactor.block-sync-concurrency int
    	Number of Go routines to use when syncing block index and chunks files from the long term storage. (default 20)
  -compactor.blocks-fetch-concurrency int
    	Number of goroutines to use when fetching blocks from object storage when compacting. (default 3)
  -compactor.blocks-retention-period value
    	Delete blocks containing samples older than the specified retention period. 0 to disable.
  -compactor.caching-bucket-enabled
    	When enabled, caching bucket will be used for compactor, except cleaner service, which serves as the source of truth for block status
  -compactor.cleaner-caching-bucket-enabled
    	When enabled, caching bucket will be used for cleaner
  -compactor.cleaner-visit-marker-file-update-interval duration
    	How frequently cleaner visit marker file should be updated when cleaning user. (default 5m0s)
  -compactor.cleaner-visit-marker-timeout duration
    	How long cleaner visit marker file should be considered as expired and able to be picked up by cleaner again. The value should be smaller than -compactor.cleanup-interval (default 10m0s)
  -compactor.cleanup-concurrency int
    	Max number of tenants for which blocks cleanup and maintenance should run concurrently. (default 20)
  -compactor.cleanup-interval duration
    	How frequently compactor should run blocks cleanup and maintenance, as well as update the bucket index. (default 15m0s)
  -compactor.compaction-concurrency int
    	Max number of concurrent compactions running. (default 1)
  -compactor.compaction-interval duration
    	The frequency at which the compaction runs (default 1h0m0s)
  -compactor.compaction-retries int
    	How many times to retry a failed compaction within a single compaction run. (default 3)
  -compactor.compaction-strategy string
    	The compaction strategy to use. Supported values are: default, partitioning. (default "default")
  -compactor.compaction-visit-marker-file-update-interval duration
    	How frequently compaction visit marker file should be updated duration compaction. (default 1m0s)
  -compactor.compaction-visit-marker-timeout duration
    	How long compaction visit marker file should be considered as expired and able to be picked up by compactor again. (default 10m0s)
  -compactor.consistency-delay duration
    	Minimum age of fresh (non-compacted) blocks before they are being processed. Malformed blocks older than the maximum of consistency-delay and 48h0m0s will be removed.
  -compactor.data-dir string
    	Data directory in which to cache blocks and process compactions (default "./data")
  -compactor.deletion-delay duration
    	Time before a block marked for deletion is deleted from bucket. If not 0, blocks will be marked for deletion and compactor component will permanently delete blocks marked for deletion from the bucket. If 0, blocks will be deleted straight away. Note that deleting blocks immediately can cause query failures. (default 12h0m0s)
  -compactor.disabled-tenants value
    	Comma separated list of tenants that cannot be compacted by this compactor. If specified, and compactor would normally pick given tenant for compaction (via -compactor.enabled-tenants or sharding), it will be ignored instead.
  -compactor.enabled-tenants value
    	Comma separated list of tenants that can be compacted. If specified, only these tenants will be compacted by compactor, otherwise all tenants can be compacted. Subject to sharding.
  -compactor.meta-sync-concurrency int
    	Number of Go routines to use when syncing block meta files from the long term storage. (default 20)
  -compactor.partition-index-size-bytes int
    	Index size limit in bytes for each compaction partition. 0 means no limit (default 68719476736)
  -compactor.partition-series-count int
    	Time series count limit for each compaction partition. 0 means no limit
  -compactor.ring.consul.acl-token value
    	ACL Token used to interact with Consul.
  -compactor.ring.consul.client-timeout duration
    	HTTP timeout when talking to Consul. (default 20s)
  -compactor.ring.consul.consistent-reads
    	Enable consistent reads to Consul.
  -compactor.ring.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -compactor.ring.consul.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -compactor.ring.consul.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -compactor.ring.consul.tls-enabled
    	Enable TLS.
  -compactor.ring.consul.tls-insecure-skip-verify
    	Skip validating server certificate.
  -compactor.ring.consul.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -compactor.ring.consul.tls-server-name string
    	Override the expected name on the server certificate.
  -compactor.ring.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -compactor.ring.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -compactor.ring.detailed-metrics-enabled
    	Set to true to enable ring detailed metrics. These metrics provide detailed information, such as token count and ownership per tenant. Disabling them can significantly decrease the number of metrics emitted. (default true)
  -compactor.ring.dynamodb.max-cas-retries int
    	Maximum number of retries for DDB KV CAS. (default 10)
  -compactor.ring.dynamodb.puller-sync-time duration
    	Time to refresh local ring with information on dynamodb. (default 1m0s)
  -compactor.ring.dynamodb.region string
    	Region to access dynamodb.
  -compactor.ring.dynamodb.table-name string
    	Table name to use on dynamodb.
  -compactor.ring.dynamodb.timeout duration
    	Timeout of dynamoDbClient requests. Default is 2m. (default 2m0s)
  -compactor.ring.dynamodb.ttl-time duration
    	Time to expire items on dynamodb.
  -compactor.ring.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -compactor.ring.etcd.endpoints value
    	The etcd endpoints to connect to.
  -compactor.ring.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -compactor.ring.etcd.password value
    	Etcd password.
  -compactor.ring.etcd.ping-without-stream-allowed
    	Send Keepalive pings with no streams. (default true)
  -compactor.ring.etcd.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -compactor.ring.etcd.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -compactor.ring.etcd.tls-enabled
    	Enable TLS.
  -compactor.ring.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -compactor.ring.etcd.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -compactor.ring.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -compactor.ring.etcd.username string
    	Etcd username.
  -compactor.ring.heartbeat-period duration
    	Period at which to heartbeat to the ring. 0 = disabled. (default 5s)
  -compactor.ring.heartbeat-timeout duration
    	The heartbeat timeout after which compactors are considered unhealthy within the ring. 0 = never (timeout disabled). (default 1m0s)
  -compactor.ring.instance-addr string
    	IP address to advertise in the ring.
  -compactor.ring.instance-id string
    	Instance ID to register in the ring. (default "localhost")
  -compactor.ring.instance-interface-names value
    	Name of network interface to read address from. (default [eth0 en0])
  -compactor.ring.instance-port int
    	Port to advertise in the ring (defaults to server.grpc-listen-port).
  -compactor.ring.multi.mirror-enabled
    	Mirror writes to secondary store.
  -compactor.ring.multi.mirror-timeout duration
    	Timeout for storing value to secondary store. (default 2s)
  -compactor.ring.multi.primary string
    	Primary backend storage used by multi-client.
  -compactor.ring.multi.secondary string
    	Secondary backend storage used by multi-client.
  -compactor.ring.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -compactor.ring.store string
    	Backend storage to use for the ring. Supported values are: consul, dynamodb, etcd, inmemory, memberlist, multi. (default "consul")
  -compactor.ring.tokens-file-path string
    	File path where tokens are stored. If empty, tokens are not stored at shutdown and restored at startup.
  -compactor.ring.unregister-on-shutdown
    	Unregister the compactor during shutdown if true. (default true)
  -compactor.ring.wait-active-instance-timeout duration
    	Timeout for waiting on compactor to become ACTIVE in the ring. (default 10m0s)
  -compactor.ring.wait-stability-max-duration duration
    	Maximum time to wait for ring stability at startup. If the compactor ring keeps changing after this period of time, the compactor will start anyway. (default 5m0s)
  -compactor.ring.wait-stability-min-duration duration
    	Minimum time to wait for ring stability at startup. 0 to disable. (default 1m0s)
  -compactor.sharding-enabled
    	Shard tenants across multiple compactor instances. Sharding is required if you run multiple compactor instances, in order to coordinate compactions and avoid race conditions leading to the same tenant blocks simultaneously compacted by different instances.
  -compactor.sharding-planner-delay duration
    	How long shuffle sharding planner would wait before running planning code. This delay would prevent double compaction when two compactors claimed same partition in grouper at same time. (default 10s)
  -compactor.sharding-strategy string
    	The sharding strategy to use. Supported values are: default, shuffle-sharding. (default "default")
  -compactor.skip-blocks-with-out-of-order-chunks-enabled
    	When enabled, mark blocks containing index with out-of-order chunks for no compact instead of halting the compaction.
  -compactor.tenant-cleanup-delay duration
    	For tenants marked for deletion, this is time between deleting of last block, and doing final cleanup (marker files, debug files) of the tenant. (default 6h0m0s)
  -compactor.tenant-shard-size float
    	The default tenant's shard size when the shuffle-sharding strategy is used by the compactor. When this setting is specified in the per-tenant overrides, a value of 0 disables shuffle sharding for the tenant. If the value is < 1 and > 0 the shard size will be a percentage of the total compactors
  -config.expand-env
    	Expands ${var} or $var in config according to the values of the environment variables.
  -config.file value
    	Configuration file to load.
  -configs.database.migrations-dir string
    	Path where the database migration files can be found
  -configs.database.password-file string
    	File containing password (username goes in URI)
  -configs.database.uri string
    	URI where the database can be found (for dev you can use memory://) (default "postgres://postgres@configs-db.weave.local/configs?sslmode=disable")
  -configs.notifications.disable-email
    	Disable Email notifications for Alertmanager.
  -configs.notifications.disable-webhook
    	Disable WebHook notifications for Alertmanager.
  -consul.acl-token value
    	ACL Token used to interact with Consul.
  -consul.client-timeout duration
    	HTTP timeout when talking to Consul. (default 20s)
  -consul.consistent-reads
    	Enable consistent reads to Consul.
  -consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -consul.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -consul.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -consul.tls-enabled
    	Enable TLS.
  -consul.tls-insecure-skip-verify
    	Skip validating server certificate.
  -consul.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -consul.tls-server-name string
    	Override the expected name on the server certificate.
  -consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -debug.block-profile-rate int
    	Fraction of goroutine blocking events that are reported in the blocking profile. 1 to include every blocking event in the profile, 0 to disable.
  -debug.mutex-profile-fraction int
    	Fraction of mutex contention events that are reported in the mutex profile. On average 1/rate events are reported. 0 to disable.
  -distributor.accept-unknown-remote-write-content-type
    	If true, treat requests with unknown or invalid Content-Type header as remote write v1 (legacy behavior). If false, return 415 Unsupported Media Type for non-standard content types.
  -distributor.client-cleanup-period duration
    	How frequently to clean up clients for ingesters that have gone away. (default 15s)
  -distributor.drop-label value
    	This flag can be used to specify label names that to drop during sample ingestion within the distributor and can be repeated in order to drop multiple labels.
  -distributor.enable-type-and-unit-labels
    	EXPERIMENTAL: If true, the __type__ and __unit__ labels are added to metrics. This applies to remote write v2 and OTLP requests.
  -distributor.excluded-zones value
    	Comma-separated list of zones to exclude from the ring. Instances in excluded zones will be filtered out from the ring.
  -distributor.extend-writes
    	Try writing to an additional ingester in the presence of an ingester not in the ACTIVE state. It is useful to disable this along with -ingester.unregister-on-shutdown=false in order to not spread samples to extra ingesters during rolling restarts with consistent naming. (default true)
  -distributor.extra-query-delay duration
    	Time to wait before sending more than the minimum successful query requests.
  -distributor.ha-tracker.cluster string
    	Prometheus label to look for in samples to identify a Prometheus HA cluster. (default "cluster")
  -distributor.ha-tracker.consul.acl-token value
    	ACL Token used to interact with Consul.
  -distributor.ha-tracker.consul.client-timeout duration
    	HTTP timeout when talking to Consul. (default 20s)
  -distributor.ha-tracker.consul.consistent-reads
    	Enable consistent reads to Consul.
  -distributor.ha-tracker.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -distributor.ha-tracker.consul.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -distributor.ha-tracker.consul.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -distributor.ha-tracker.consul.tls-enabled
    	Enable TLS.
  -distributor.ha-tracker.consul.tls-insecure-skip-verify
    	Skip validating server certificate.
  -distributor.ha-tracker.consul.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -distributor.ha-tracker.consul.tls-server-name string
    	Override the expected name on the server certificate.
  -distributor.ha-tracker.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -distributor.ha-tracker.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -distributor.ha-tracker.dynamodb.max-cas-retries int
    	Maximum number of retries for DDB KV CAS. (default 10)
  -distributor.ha-tracker.dynamodb.puller-sync-time duration
    	Time to refresh local ring with information on dynamodb. (default 1m0s)
  -distributor.ha-tracker.dynamodb.region string
    	Region to access dynamodb.
  -distributor.ha-tracker.dynamodb.table-name string
    	Table name to use on dynamodb.
  -distributor.ha-tracker.dynamodb.timeout duration
    	Timeout of dynamoDbClient requests. Default is 2m. (default 2m0s)
  -distributor.ha-tracker.dynamodb.ttl-time duration
    	Time to expire items on dynamodb.
  -distributor.ha-tracker.enable
    	Enable the HA tracker so that it can accept data from Prometheus HA replicas gracefully (requires labels).
  -distributor.ha-tracker.enable-for-all-users
    	Flag to enable, for all users, handling of samples with external labels identifying replicas in an HA Prometheus setup.
  -distributor.ha-tracker.enable-startup-sync
    	[Experimental] If enabled, fetches all tracked keys on startup to populate the local cache. This prevents duplicate GET calls for the same key while the cache is cold, but could cause a spike in GET requests during initialization if the number of tracked keys is large.
  -distributor.ha-tracker.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -distributor.ha-tracker.etcd.endpoints value
    	The etcd endpoints to connect to.
  -distributor.ha-tracker.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -distributor.ha-tracker.etcd.password value
    	Etcd password.
  -distributor.ha-tracker.etcd.ping-without-stream-allowed
    	Send Keepalive pings with no streams. (default true)
  -distributor.ha-tracker.etcd.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -distributor.ha-tracker.etcd.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -distributor.ha-tracker.etcd.tls-enabled
    	Enable TLS.
  -distributor.ha-tracker.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -distributor.ha-tracker.etcd.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -distributor.ha-tracker.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -distributor.ha-tracker.etcd.username string
    	Etcd username.
  -distributor.ha-tracker.failover-timeout duration
    	The timeout after which a new replica will be accepted if the currently elected replica stops sending data. This value must be greater than the update timeout plus the maximum jitter. (default 30s)
  -distributor.ha-tracker.max-clusters int
    	Maximum number of clusters that HA tracker will keep track of for single user. 0 to disable the limit.
  -distributor.ha-tracker.multi.mirror-enabled
    	Mirror writes to secondary store.
  -distributor.ha-tracker.multi.mirror-timeout duration
    	Timeout for storing value to secondary store. (default 2s)
  -distributor.ha-tracker.multi.primary string
    	Primary backend storage used by multi-client.
  -distributor.ha-tracker.multi.secondary string
    	Secondary backend storage used by multi-client.
  -distributor.ha-tracker.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "ha-tracker/")
  -distributor.ha-tracker.replica string
    	Prometheus label to look for in samples to identify a Prometheus HA replica. (default "__replica__")
  -distributor.ha-tracker.store string
    	Backend storage to use for the ring. Supported values are: consul, dynamodb, etcd, inmemory, memberlist, multi. (default "consul")
  -distributor.ha-tracker.update-timeout duration
    	The time interval that must pass since the last timestamp update in the KV store before updating it again for a given cluster. (default 15s)
  -distributor.ha-tracker.update-timeout-jitter-max duration
    	The maximum jitter applied to the update timeout to spread KV store updates over time. (default 5s)
  -distributor.health-check-ingesters
    	Run a health check on each ingester client during periodic cleanup. (default true)
  -distributor.ingestion-burst-size int
    	Per-user allowed ingestion burst size (in number of samples). (default 50000)
  -distributor.ingestion-rate-limit float
    	Per-user ingestion rate limit in samples per second. (default 25000)
  -distributor.ingestion-rate-limit-strategy string
    	Whether the ingestion rate limit should be applied individually to each distributor instance (local), or evenly shared across the cluster (global). (default "local")
  -distributor.ingestion-tenant-shard-size int
    	The default tenant's shard size when the shuffle-sharding strategy is used. Must be set both on ingesters and distributors. When this setting is specified in the per-tenant overrides, a value of 0 disables shuffle sharding for the tenant.
  -distributor.instance-limits.max-inflight-client-requests int
    	Max inflight ingester client requests that this distributor can handle. This limit is per-distributor, not per-tenant. Additional requests will be rejected. 0 = unlimited.
  -distributor.instance-limits.max-inflight-push-requests int
    	Max inflight push requests that this distributor can handle. This limit is per-distributor, not per-tenant. Additional requests will be rejected. 0 = unlimited.
  -distributor.instance-limits.max-ingestion-rate float
    	Max ingestion rate (samples/sec) that this distributor will accept. This limit is per-distributor, not per-tenant. Additional push requests will be rejected. Current ingestion rate is computed as exponentially weighted moving average, updated every second. 0 = unlimited.
  -distributor.max-recv-msg-size int
    	remote_write API max receive message size (bytes). (default 104857600)
  -distributor.native-histogram-ingestion-burst-size int
    	Per-user allowed native histogram ingestion burst size (in number of samples)
  -distributor.native-histogram-ingestion-rate-limit float
    	Per-user native histogram ingestion rate limit in samples per second. Disabled by default (default 1.7976931348623157e+308)
  -distributor.num-push-workers int
    	EXPERIMENTAL: Number of go routines to handle push calls from distributors to ingesters. When no workers are available, a new goroutine will be spawned automatically. If set to 0 (default), workers are disabled, and a new goroutine will be created for each push request.
  -distributor.otlp-max-recv-msg-size int
    	Maximum OTLP request size in bytes that the Distributor can accept. (default 104857600)
  -distributor.otlp.add-metric-suffixes
    	If true, suffixes will be added to the metrics for name normalization. (default true)
  -distributor.otlp.allow-delta-temporality
    	EXPERIMENTAL: If true, delta temporality otlp metrics to be ingested.
  -distributor.otlp.convert-all-attributes
    	If true, all resource attributes are converted to labels.
  -distributor.otlp.disable-target-info
    	If true, a target_info metric is not ingested. (refer to: https://github.com/prometheus/OpenMetrics/blob/main/specification/OpenMetrics.md#supporting-target-metadata-in-both-push-based-and-pull-based-systems)
  -distributor.otlp.enable-type-and-unit-labels -distributor.enable-type-and-unit-labels
    	Deprecated: Use -distributor.enable-type-and-unit-labels flag instead.
  -distributor.promote-resource-attributes value
    	Comma separated list of resource attributes that should be converted to labels.
  -distributor.remote-timeout duration
    	Timeout for downstream ingesters. (default 2s)
  -distributor.remote-writev2-enabled
    	EXPERIMENTAL: If true, accept prometheus remote write v2 protocol push request.
  -distributor.replication-factor int
    	The number of ingesters to write to and read from. (default 3)
  -distributor.ring.consul.acl-token value
    	ACL Token used to interact with Consul.
  -distributor.ring.consul.client-timeout duration
    	HTTP timeout when talking to Consul. (default 20s)
  -distributor.ring.consul.consistent-reads
    	Enable consistent reads to Consul.
  -distributor.ring.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -distributor.ring.consul.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -distributor.ring.consul.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -distributor.ring.consul.tls-enabled
    	Enable TLS.
  -distributor.ring.consul.tls-insecure-skip-verify
    	Skip validating server certificate.
  -distributor.ring.consul.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -distributor.ring.consul.tls-server-name string
    	Override the expected name on the server certificate.
  -distributor.ring.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -distributor.ring.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -distributor.ring.detailed-metrics-enabled
    	Set to true to enable ring detailed metrics. These metrics provide detailed information, such as token count and ownership per tenant. Disabling them can significantly decrease the number of metrics emitted. (default true)
  -distributor.ring.dynamodb.max-cas-retries int
    	Maximum number of retries for DDB KV CAS. (default 10)
  -distributor.ring.dynamodb.puller-sync-time duration
    	Time to refresh local ring with information on dynamodb. (default 1m0s)
  -distributor.ring.dynamodb.region string
    	Region to access dynamodb.
  -distributor.ring.dynamodb.table-name string
    	Table name to use on dynamodb.
  -distributor.ring.dynamodb.timeout duration
    	Timeout of dynamoDbClient requests. Default is 2m. (default 2m0s)
  -distributor.ring.dynamodb.ttl-time duration
    	Time to expire items on dynamodb.
  -distributor.ring.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -distributor.ring.etcd.endpoints value
    	The etcd endpoints to connect to.
  -distributor.ring.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -distributor.ring.etcd.password value
    	Etcd password.
  -distributor.ring.etcd.ping-without-stream-allowed
    	Send Keepalive pings with no streams. (default true)
  -distributor.ring.etcd.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -distributor.ring.etcd.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -distributor.ring.etcd.tls-enabled
    	Enable TLS.
  -distributor.ring.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -distributor.ring.etcd.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -distributor.ring.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -distributor.ring.etcd.username string
    	Etcd username.
  -distributor.ring.heartbeat-period duration
    	Period at which to heartbeat to the ring. 0 = disabled. (default 5s)
  -distributor.ring.heartbeat-timeout duration
    	The heartbeat timeout after which distributors are considered unhealthy within the ring. 0 = never (timeout disabled). (default 1m0s)
  -distributor.ring.instance-addr string
    	IP address to advertise in the ring.
  -distributor.ring.instance-id string
    	Instance ID to register in the ring. (default "localhost")
  -distributor.ring.instance-interface-names value
    	Name of network interface to read address from. (default [eth0 en0])
  -distributor.ring.instance-port int
    	Port to advertise in the ring (defaults to server.grpc-listen-port).
  -distributor.ring.multi.mirror-enabled
    	Mirror writes to secondary store.
  -distributor.ring.multi.mirror-timeout duration
    	Timeout for storing value to secondary store. (default 2s)
  -distributor.ring.multi.primary string
    	Primary backend storage used by multi-client.
  -distributor.ring.multi.secondary string
    	Secondary backend storage used by multi-client.
  -distributor.ring.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -distributor.ring.store string
    	Backend storage to use for the ring. Supported values are: consul, dynamodb, etcd, inmemory, memberlist, multi. (default "consul")
  -distributor.shard-by-all-labels
    	Distribute samples based on all labels, as opposed to solely by user and metric name.
  -distributor.sharding-strategy string
    	The sharding strategy to use. Supported values are: default, shuffle-sharding. (default "default")
  -distributor.sign-write-requests
    	EXPERIMENTAL: If enabled, sign the write request between distributors and ingesters.
  -distributor.sign-write-requests-keys value
    	EXPERIMENTAL: Comma-separated list of HMAC-SHA256 keys authenticating PushStream connections between distributors and ingesters. The first key is used by the distributor to sign; all keys are accepted by the ingester. It only takes effect when the -distributor.sign-write-requests is true. The key change procedure for zero downtime is: (1) redeploy ingesters first with 'newkey,oldkey' — ingester accepts both keys; (2) redeploy distributors with 'newkey,oldkey' — distributor signs with newkey; (3) once stable, redeploy both with 'newkey' to drop the old key.
  -distributor.use-stream-push
    	EXPERIMENTAL: If enabled, distributor would use stream connection to send requests to ingesters.
  -distributor.zone-awareness-enabled
    	True to enable the zone-awareness and replicate ingested samples across different availability zones.
  -distributor.zone-results-quorum-metadata
    	Experimental, this flag may change in the future. If zone awareness and this both enabled, when querying metadata APIs (labels names and values for now), only results from quorum number of zones will be included.
  -dynamodb.max-cas-retries int
    	Maximum number of retries for DDB KV CAS. (default 10)
  -dynamodb.puller-sync-time duration
    	Time to refresh local ring with information on dynamodb. (default 1m0s)
  -dynamodb.region string
    	Region to access dynamodb.
  -dynamodb.table-name string
    	Table name to use on dynamodb.
  -dynamodb.timeout duration
    	Timeout of dynamoDbClient requests. Default is 2m. (default 2m0s)
  -dynamodb.ttl-time duration
    	Time to expire items on dynamodb.
  -etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -etcd.endpoints value
    	The etcd endpoints to connect to.
  -etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -etcd.password value
    	Etcd password.
  -etcd.ping-without-stream-allowed
    	Send Keepalive pings with no streams. (default true)
  -etcd.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -etcd.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -etcd.tls-enabled
    	Enable TLS.
  -etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -etcd.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -etcd.username string
    	Etcd username.
  -event.sample-rate int
    	How often to sample observability events (0 = never).
  -experimental.alertmanager.enable-api
    	Deprecated: Use -alertmanager.enable-api instead.
  -experimental.distributor.ha-tracker.mixed-ha-samples
    	[Experimental] Flag to enable handling of samples with mixed external labels identifying replicas in an HA Prometheus setup. Supported only if -distributor.ha-tracker.enable-for-all-users is true.
  -experimental.ruler.api-deduplicate-rules
    	EXPERIMENTAL: Remove duplicate rules in the prometheus rules and alerts API response. If there are duplicate rules the rule with the latest evaluation timestamp will be kept.
  -experimental.ruler.enable-api
    	Deprecated: Use -ruler.enable-api instead.
  -flusher.exit-after-flush
    	Stop Cortex after flush has finished. If false, Cortex process will keep running, doing nothing. (default true)
  -frontend.background.write-back-buffer int
    	How many key batches to buffer for background write-back. (default 10000)
  -frontend.background.write-back-concurrency int
    	At what concurrency to write back to cache. (default 10)
  -frontend.cache-queryable-samples-stats
    	Cache Statistics queryable samples on results cache.
  -frontend.cache-split-interval value
    	Deprecated: The maximum interval expected for each request, results will be cached per single interval. This behavior is now determined by querier.split-queries-by-interval.
  -frontend.cache.enable-fifocache
    	Enable in-memory cache.
  -frontend.compression string
    	Use compression in results cache. Supported values are: 'snappy' and '' (disable compression).
  -frontend.default-validity duration
    	The default validity of entries for caches unless overridden.
  -frontend.downstream-url string
    	URL of downstream Prometheus.
  -frontend.enabled-ruler-query-stats
    	If enabled, report the query stats log for queries coming from the ruler to evaluate rules. It only takes effect when '-ruler.frontend-address' is configured.
  -frontend.fifocache.duration duration
    	The expiry duration for the cache.
  -frontend.fifocache.max-size-bytes string
    	Maximum memory size of the cache in bytes. A unit suffix (KB, MB, GB) may be applied.
  -frontend.fifocache.max-size-items int
    	Maximum number of entries in the cache.
  -frontend.fifocache.size int
    	Deprecated (use max-size-items or max-size-bytes instead): The number of entries to cache.
  -frontend.forward-headers-list value
    	List of headers forwarded by the query Frontend to downstream querier.
  -frontend.grpc-client-config.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -frontend.grpc-client-config.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -frontend.grpc-client-config.backoff-on-ratelimits
    	Enable backoff and retry when we hit ratelimits.
  -frontend.grpc-client-config.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -frontend.grpc-client-config.connect-timeout duration
    	The maximum amount of time to establish a connection. A value of 0 means using default gRPC client connect timeout 20s. (default 5s)
  -frontend.grpc-client-config.grpc-client-rate-limit float
    	Rate limit for gRPC client; 0 means disabled.
  -frontend.grpc-client-config.grpc-client-rate-limit-burst int
    	Rate limit burst for gRPC client.
  -frontend.grpc-client-config.grpc-compression string
    	Use compression when sending messages. Supported values are: 'gzip', 'snappy', 'snappy-block' ,'zstd' and '' (disable compression)
  -frontend.grpc-client-config.grpc-max-recv-msg-size int
    	gRPC client max receive message size (bytes). (default 104857600)
  -frontend.grpc-client-config.grpc-max-send-msg-size int
    	gRPC client max send message size (bytes). (default 16777216)
  -frontend.grpc-client-config.tls-ca-path string
    	Path to the CA certificates file to validate server certificate against. If not set, the host's root CA certificates are used.
  -frontend.grpc-client-config.tls-cert-path string
    	Path to the client certificate file, which will be used for authenticating with the server. Also requires the key path to be configured.
  -frontend.grpc-client-config.tls-enabled
    	Enable TLS in the GRPC client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to gRPC server will be used.
  -frontend.grpc-client-config.tls-insecure-skip-verify
    	Skip validating server certificate.
  -frontend.grpc-client-config.tls-key-path string
    	Path to the key file for the client certificate. Also requires the client certificate to be configured.
  -frontend.grpc-client-config.tls-server-name string
    	Override the expected name on the server certificate.
  -frontend.instance-addr string
    	IP address to advertise to querier (via scheduler) (resolved via interfaces by default).
  -frontend.instance-interface-names value
    	Name of network interface to read address from. This address is sent to query-scheduler and querier, which uses it to send the query response back to query-frontend. (default [eth0 en0])
  -frontend.instance-port int
    	Port to advertise to querier (via scheduler) (defaults to server.grpc-listen-port).
  -frontend.log-queries-longer-than duration
    	Log queries that are slower than the specified duration. Set to 0 to disable. Set to < 0 to enable on all queries.
  -frontend.max-body-size int
    	Max body size for downstream prometheus. (default 10485760)
  -frontend.max-cache-freshness value
    	Most recent allowed cacheable result per-tenant, to prevent caching very recent results that might still be in flux. (default 1m)
  -frontend.max-outstanding-requests-per-tenant int
    	Maximum number of outstanding requests per tenant per request queue (either query frontend or query scheduler); requests beyond this error with HTTP 429. (default 100)
  -frontend.max-queriers-per-tenant float
    	Maximum number of queriers that can handle requests for a single tenant. If set to 0 or value higher than number of available queriers, *all* queriers will handle requests for the tenant. If the value is < 1, it will be treated as a percentage and the gets a percentage of the total queriers. Each frontend (or query-scheduler, if used) will select the same set of queriers for the same tenant (given that all queriers are connected to all frontends / query-schedulers). This option only works with queriers connecting to the query-frontend / query-scheduler, not when using downstream URL.
  -frontend.max-query-response-size query
    	The maximum total uncompressed query response size. If the query was sharded the limit is applied to the total response size of all shards. This limit is enforced in query-frontend for query and `query_range` APIs. 0 to disable.
  -frontend.memcached.addresses string
    	Comma separated addresses list in DNS Service Discovery format: https://cortexmetrics.io/docs/configuration/arguments/#dns-service-discovery
  -frontend.memcached.batchsize int
    	How many keys to fetch in each batch. (default 1024)
  -frontend.memcached.circuit-breaker-consecutive-failures uint
    	Trip circuit-breaker after this number of consecutive dial failures (if zero then circuit-breaker is disabled). (default 10)
  -frontend.memcached.circuit-breaker-interval duration
    	Reset circuit-breaker counts after this long (if zero then never reset). (default 10s)
  -frontend.memcached.circuit-breaker-timeout duration
    	Duration circuit-breaker remains open after tripping (if zero then 60 seconds is used). (default 10s)
  -frontend.memcached.consistent-hash
    	Use consistent hashing to distribute to memcache servers. (default true)
  -frontend.memcached.expiration duration
    	How long keys stay in the memcache.
  -frontend.memcached.hostname string
    	Hostname for memcached service to use. If empty and if addresses is unset, no memcached will be used.
  -frontend.memcached.max-idle-conns int
    	Maximum number of idle connections in pool. (default 16)
  -frontend.memcached.max-item-size int
    	The maximum size of an item stored in memcached. Bigger items are not stored. If set to 0, no maximum size is enforced.
  -frontend.memcached.parallelism int
    	Maximum active requests to memcache. (default 100)
  -frontend.memcached.service string
    	SRV service used to discover memcache servers. (default "memcached")
  -frontend.memcached.timeout duration
    	Maximum time to wait before giving up on memcached requests. (default 100ms)
  -frontend.memcached.update-interval duration
    	Period with which to poll DNS for memcache servers. (default 1m0s)
  -frontend.query-priority.default-priority int
    	Priority assigned to all queries by default. Must be a unique value. Use this as a baseline to make certain queries higher/lower priority.
  -frontend.query-priority.enabled
    	Whether queries are assigned with priorities.
  -frontend.query-rejection.enabled
    	Whether query rejection is enabled.
  -frontend.query-stats-enabled
    	True to enable query statistics tracking. When enabled, a message with some statistics is logged for every query.
  -frontend.query-vertical-shard-size int
    	[Experimental] Number of shards to use when distributing shardable PromQL queries.
  -frontend.redis.db int
    	Database index.
  -frontend.redis.endpoint string
    	Redis Server endpoint to use for caching. A comma-separated list of endpoints for Redis Cluster or Redis Sentinel. If empty, no redis will be used.
  -frontend.redis.expiration duration
    	How long keys stay in the redis.
[truncated]