/usr/bin/loki

Usage of config-file-loader:
  -auth.enabled
    	Enables authentication through the X-Scope-OrgID header, which must be present if true. If false, the OrgID will always be set to 'fake'. (default true)
  -azure.account-key value
    	Azure storage account key.
  -azure.account-name string
    	Azure storage account name.
  -azure.active-directory-endpoint string
    	Azure active directory endpoint override. Use when the Azure SDK does not support your environment.
  -azure.chunk-delimiter string
    	Chunk delimiter for blob ID to be used (default "-")
  -azure.client-id string
    	Azure Service Principal ID(GUID).
  -azure.client-secret value
    	Azure Service Principal secret key.
  -azure.connection-string connection-string
    	If connection-string is set, the values of `account-name` and `endpoint-suffix` values will not be used. Use this method over `account-key` if you need to authenticate via a SAS token. Or if you use the Azurite emulator.
  -azure.container-name string
    	Name of the storage account blob container used to store chunks. This container must be created before running cortex. (default "loki")
  -azure.download-buffer-count int
    	Number of buffers used to used to upload a chunk. (default 1)
  -azure.download-buffer-size int
    	Preallocated buffer size for downloads. (default 512000)
  -azure.endpoint-suffix string
    	Azure storage endpoint suffix without schema. The storage account name will be prefixed to this value to create the FQDN.
  -azure.environment string
    	Azure Cloud environment. Supported values are: AzureGlobal, AzureChinaCloud, AzureGermanCloud, AzureUSGovernment. (default "AzureGlobal")
  -azure.max-retries int
    	Number of retries for a request which times out. (default 5)
  -azure.max-retry-delay duration
    	Maximum time to wait before retrying a request. (default 500ms)
  -azure.min-retry-delay duration
    	Minimum time to wait before retrying a request. (default 10ms)
  -azure.request-timeout duration
    	Timeout for requests made against azure blob storage. (default 30s)
  -azure.tenant-id string
    	Azure Tenant ID is used to authenticate through Azure OAuth.
  -azure.upload-buffer-size int
    	Preallocated buffer size for uploads. (default 256000)
  -azure.use-federated-token
    	Use Federated Token to authenticate to the Azure storage account.
  -azure.use-managed-identity
    	Use Managed Identity to authenticate to the Azure storage account.
  -azure.use-service-principal
    	Use Service Principal to authenticate through Azure OAuth.
  -azure.user-assigned-id string
    	User assigned identity ID to authenticate to the Azure storage account.
  -bigtable.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -bigtable.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -bigtable.backoff-on-ratelimits
    	Enable backoff and retry when we hit rate limits.
  -bigtable.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -bigtable.cluster-validation.label string
    	Primary cluster validation label.
  -bigtable.connect-backoff-base-delay duration
    	Initial backoff delay after first connection failure. Only relevant if ConnectTimeout > 0. (default 1s)
  -bigtable.connect-backoff-max-delay duration
    	Maximum backoff delay when establishing a connection. Only relevant if ConnectTimeout > 0. (default 5s)
  -bigtable.connect-timeout duration
    	The maximum amount of time to establish a connection. A value of 0 means default gRPC client connect timeout and backoff. (default 5s)
  -bigtable.grpc-client-rate-limit float
    	Rate limit for gRPC client; 0 means disabled.
  -bigtable.grpc-client-rate-limit-burst int
    	Rate limit burst for gRPC client.
  -bigtable.grpc-compression string
    	Use compression when sending messages. Supported values are: 'gzip', 'snappy' and '' (disable compression)
  -bigtable.grpc-max-recv-msg-size int
    	gRPC client max receive message size (bytes). (default 104857600)
  -bigtable.grpc-max-send-msg-size int
    	gRPC client max send message size (bytes). (default 104857600)
  -bigtable.initial-connection-window-size value
    	Initial connection window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -bigtable.initial-stream-window-size value
    	Initial stream window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -bigtable.instance string
    	Bigtable instance ID. Please refer to https://cloud.google.com/docs/authentication/production for more information about how to configure authentication.
  -bigtable.project string
    	Bigtable project ID.
  -bigtable.table-cache.enabled
    	If enabled, once a tables info is fetched, it is cached. (default true)
  -bigtable.table-cache.expiration duration
    	Duration to cache tables before checking again. (default 30m0s)
  -bigtable.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -bigtable.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -bigtable.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -bigtable.tls-enabled
    	Enable TLS in the gRPC client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to gRPC server will be used. (default true)
  -bigtable.tls-insecure-skip-verify
    	Skip validating server certificate.
  -bigtable.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -bigtable.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -bigtable.tls-server-name string
    	Override the expected name on the server certificate.
  -bloom-build.block-encoding string
    	Experimental. Compression algorithm for bloom block pages. (default "none")
  -bloom-build.builder-response-timeout duration
    	Experimental. Timeout for a builder to finish a task. If a builder does not respond within this time, it is considered failed and the task will be requeued. 0 disables the timeout.
  -bloom-build.builder.backoff.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -bloom-build.builder.backoff.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -bloom-build.builder.backoff.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -bloom-build.builder.grpc.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -bloom-build.builder.grpc.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -bloom-build.builder.grpc.backoff-on-ratelimits
    	Enable backoff and retry when we hit rate limits.
  -bloom-build.builder.grpc.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -bloom-build.builder.grpc.cluster-validation.label string
    	Primary cluster validation label.
  -bloom-build.builder.grpc.connect-backoff-base-delay duration
    	Initial backoff delay after first connection failure. Only relevant if ConnectTimeout > 0. (default 1s)
  -bloom-build.builder.grpc.connect-backoff-max-delay duration
    	Maximum backoff delay when establishing a connection. Only relevant if ConnectTimeout > 0. (default 5s)
  -bloom-build.builder.grpc.connect-timeout duration
    	The maximum amount of time to establish a connection. A value of 0 means default gRPC client connect timeout and backoff. (default 5s)
  -bloom-build.builder.grpc.grpc-client-rate-limit float
    	Rate limit for gRPC client; 0 means disabled.
  -bloom-build.builder.grpc.grpc-client-rate-limit-burst int
    	Rate limit burst for gRPC client.
  -bloom-build.builder.grpc.grpc-compression string
    	Use compression when sending messages. Supported values are: 'gzip', 'snappy' and '' (disable compression)
  -bloom-build.builder.grpc.grpc-max-recv-msg-size int
    	gRPC client max receive message size (bytes). (default 104857600)
  -bloom-build.builder.grpc.grpc-max-send-msg-size int
    	gRPC client max send message size (bytes). (default 104857600)
  -bloom-build.builder.grpc.initial-connection-window-size value
    	Initial connection window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -bloom-build.builder.grpc.initial-stream-window-size value
    	Initial stream window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -bloom-build.builder.grpc.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -bloom-build.builder.grpc.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -bloom-build.builder.grpc.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -bloom-build.builder.grpc.tls-enabled
    	Enable TLS in the gRPC client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to gRPC server will be used.
  -bloom-build.builder.grpc.tls-insecure-skip-verify
    	Skip validating server certificate.
  -bloom-build.builder.grpc.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -bloom-build.builder.grpc.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -bloom-build.builder.grpc.tls-server-name string
    	Override the expected name on the server certificate.
  -bloom-build.builder.planner-address string
    	Hostname (and port) of the bloom planner
  -bloom-build.builder.working-directory string
    	Working directory to which blocks are temporarily written to. Empty string defaults to the operating system's temp directory.
  -bloom-build.enable
    	Experimental. Whether to create blooms for the tenant.
  -bloom-build.enabled
    	Flag to enable or disable the usage of the bloom-planner and bloom-builder components.
  -bloom-build.max-block-size value
    	Experimental. The maximum bloom block size. A value of 0 sets an unlimited size. Default is 200MB. The actual block size might exceed this limit since blooms will be added to blocks until the block exceeds the maximum block size. (default 200MB)
  -bloom-build.max-bloom-size value
    	Experimental. The maximum bloom size per log stream. A log stream whose generated bloom filter exceeds this size will be discarded. A value of 0 sets an unlimited size. Default is 128MB. (default 128MB)
  -bloom-build.max-builders int
    	Experimental. Maximum number of builders to use when building blooms. 0 allows unlimited builders.
  -bloom-build.planner.interval duration
    	Interval at which to re-run the bloom creation planning. (default 8h0m0s)
  -bloom-build.planner.max-table-offset reject_old_samples_max_age
    	Oldest day-table offset (from today, inclusive) to build blooms for. 1 till yesterday, 2 till day before yesterday and so on. This can be used to lower cost by not trying to build blooms for older data which doesn't change. This can be optimized by aligning it with the maximum reject_old_samples_max_age setting of any tenant. (default 1)
  -bloom-build.planner.min-table-offset int
    	Newest day-table offset (from today, inclusive) to build blooms for. 0 start building from today, 1 from yesterday and so on. Increase to lower cost by not re-writing data to object storage too frequently since recent data changes more often at the cost of not having blooms available as quickly.
  -bloom-build.planner.queue.clean-tasks-directory
    	Whether to clean the tasks directory on startup.
  -bloom-build.planner.queue.max-tasks-per-tenant int
    	Maximum number of tasks to queue per tenant. (default 30000)
  -bloom-build.planner.queue.store-tasks-on-disk
    	Whether to store tasks on disk.
  -bloom-build.planner.queue.tasks-disk-directory string
    	Directory to store tasks on disk. (default "/tmp/bloom-planner-queue")
  -bloom-build.planner.retention.enabled
    	Enable bloom retention.
  -bloom-build.planner.retention.max-lookback-days int
    	Max lookback days for retention. (default 365)
  -bloom-build.planning-strategy string
    	Experimental. Bloom planning strategy to use in bloom creation. Can be one of: 'split_keyspace_by_factor', 'split_by_series_chunks_size' (default "split_keyspace_by_factor")
  -bloom-build.prefetch-blocks
    	Experimental. Prefetch blocks on bloom gateways as soon as they are built.
  -bloom-build.split-keyspace-by bloom-build.planning-strategy
    	Experimental. Only if bloom-build.planning-strategy is 'split'. Number of splits to create for the series keyspace when building blooms. The series keyspace is split into this many parts to parallelize bloom creation. (default 256)
  -bloom-build.split-target-series-chunk-size value
    	Experimental. Target chunk size in bytes for bloom tasks. Default is 20GB. (default 20GB)
  -bloom-build.task-max-retries int
    	Experimental. Maximum number of retries for a failed task. If a task fails more than this number of times, it is considered failed and will not be retried. A value of 0 disables this limit. (default 3)
  -bloom-gateway-client.addresses string
    	Comma separated addresses list in DNS Service Discovery format: https://grafana.com/docs/mimir/latest/configure/about-dns-service-discovery/#supported-discovery-modes
  -bloom-gateway-client.grpc.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -bloom-gateway-client.grpc.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -bloom-gateway-client.grpc.backoff-on-ratelimits
    	Enable backoff and retry when we hit rate limits.
  -bloom-gateway-client.grpc.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -bloom-gateway-client.grpc.cluster-validation.label string
    	Primary cluster validation label.
  -bloom-gateway-client.grpc.connect-backoff-base-delay duration
    	Initial backoff delay after first connection failure. Only relevant if ConnectTimeout > 0. (default 1s)
  -bloom-gateway-client.grpc.connect-backoff-max-delay duration
    	Maximum backoff delay when establishing a connection. Only relevant if ConnectTimeout > 0. (default 5s)
  -bloom-gateway-client.grpc.connect-timeout duration
    	The maximum amount of time to establish a connection. A value of 0 means default gRPC client connect timeout and backoff. (default 5s)
  -bloom-gateway-client.grpc.grpc-client-rate-limit float
    	Rate limit for gRPC client; 0 means disabled.
  -bloom-gateway-client.grpc.grpc-client-rate-limit-burst int
    	Rate limit burst for gRPC client.
  -bloom-gateway-client.grpc.grpc-compression string
    	Use compression when sending messages. Supported values are: 'gzip', 'snappy' and '' (disable compression)
  -bloom-gateway-client.grpc.grpc-max-recv-msg-size int
    	gRPC client max receive message size (bytes). (default 104857600)
  -bloom-gateway-client.grpc.grpc-max-send-msg-size int
    	gRPC client max send message size (bytes). (default 104857600)
  -bloom-gateway-client.grpc.initial-connection-window-size value
    	Initial connection window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -bloom-gateway-client.grpc.initial-stream-window-size value
    	Initial stream window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -bloom-gateway-client.grpc.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -bloom-gateway-client.grpc.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -bloom-gateway-client.grpc.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -bloom-gateway-client.grpc.tls-enabled
    	Enable TLS in the gRPC client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to gRPC server will be used.
  -bloom-gateway-client.grpc.tls-insecure-skip-verify
    	Skip validating server certificate.
  -bloom-gateway-client.grpc.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -bloom-gateway-client.grpc.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -bloom-gateway-client.grpc.tls-server-name string
    	Override the expected name on the server certificate.
  -bloom-gateway-client.pool.check-interval duration
    	How frequently to update the list of servers. (default 15s)
  -bloom-gateway.block-query-concurrency int
    	Number of blocks processed concurrently on a single worker. Usually set to 2x number of CPU cores. (default 8)
  -bloom-gateway.enable-filtering
    	Experimental. Whether to use the bloom gateway component in the read path to filter chunks.
  -bloom-gateway.enabled
    	Flag to enable or disable the bloom gateway component globally.
  -bloom-gateway.fetch-blocks-async
    	Whether blocks should be fetched asynchronously. (default true)
  -bloom-gateway.max-outstanding-per-tenant int
    	Maximum number of outstanding tasks per tenant. (default 1024)
  -bloom-gateway.num-multiplex-tasks int
    	How many tasks are multiplexed at once. (default 512)
  -bloom-gateway.worker-concurrency int
    	Number of workers to use for filtering chunks concurrently. Usually set to 1x number of CPU cores. (default 4)
  -bloom.blocks-cache.hard-limit value
    	Cache for bloom blocks. Hard limit of the cache in bytes. Exceeding this limit will block execution until soft limit is deceeded. (default 64GiB)
  -bloom.blocks-cache.soft-limit value
    	Cache for bloom blocks. Soft limit of the cache in bytes. Exceeding this limit will trigger evictions of least recently used items in the background. (default 32GiB)
  -bloom.blocks-cache.ttl duration
    	Cache for bloom blocks. The time to live for items in the cache before they get purged. (default 24h0m0s)
  -bloom.cache-list-ops
    	Cache LIST operations. This is a hidden flag. (default true)
  -bloom.download-parallelism int
    	The amount of maximum concurrent bloom blocks downloads. Usually set to 2x number of CPU cores. (default 8)
  -bloom.max-query-page-size value
    	Maximum size of bloom pages that should be queried. Larger pages than this limit are skipped when querying blooms to limit memory usage. (default 64MiB)
  -bloom.memory-management.alloc-type string
    	One of: simple (simple heap allocations using Go's make([]byte, n) and no re-cycling of buffers), dynamic (a buffer pool with variable sized buckets and best effort re-cycling of buffers using Go's sync.Pool), fixed (a fixed size memory pool with configurable slab sizes, see mem-pool-buckets) (default "dynamic")
  -bloom.memory-management.mem-pool-buckets value
    	Comma separated list of buckets in the format {size}x{bytes} (default 128x64KB,512x2MB,128x8MB,32x32MB,8x128MB)
  -bloom.metas-cache.background.write-back-buffer int
    	Cache for bloom metas. How many key batches to buffer for background write-back. Default is large to prefer size based limiting. (default 500000)
  -bloom.metas-cache.background.write-back-concurrency int
    	Cache for bloom metas. At what concurrency to write back to cache. (default 1)
  -bloom.metas-cache.background.write-back-size-limit value
    	Cache for bloom metas. Size limit in bytes for background write-back. (default 500MB)
  -bloom.metas-cache.default-validity duration
    	Cache for bloom metas. The default validity of entries for caches unless overridden. (default 1h0m0s)
  -bloom.metas-cache.embedded-cache.enabled
    	Cache for bloom metas. Whether embedded cache is enabled.
  -bloom.metas-cache.embedded-cache.max-size-items int
    	Cache for bloom metas. Maximum number of entries in the cache.
  -bloom.metas-cache.embedded-cache.max-size-mb int
    	Cache for bloom metas. Maximum memory size of the cache in MB. (default 100)
  -bloom.metas-cache.embedded-cache.ttl duration
    	Cache for bloom metas. The time to live for items in the cache before they get purged. (default 1h0m0s)
  -bloom.metas-cache.memcached.addresses string
    	Cache for bloom metas. Comma separated addresses list in DNS Service Discovery format: https://grafana.com/docs/mimir/latest/configure/about-dns-service-discovery/#supported-discovery-modes
  -bloom.metas-cache.memcached.batchsize int
    	Cache for bloom metas. How many keys to fetch in each batch. (default 4)
  -bloom.metas-cache.memcached.circuit-breaker-consecutive-failures uint
    	Cache for bloom metas. Trip circuit-breaker after this number of consecutive dial failures (if zero then circuit-breaker is disabled). (default 10)
  -bloom.metas-cache.memcached.circuit-breaker-interval duration
    	Cache for bloom metas. Reset circuit-breaker counts after this long (if zero then never reset). (default 10s)
  -bloom.metas-cache.memcached.circuit-breaker-timeout duration
    	Cache for bloom metas. Duration circuit-breaker remains open after tripping (if zero then 60 seconds is used). (default 10s)
  -bloom.metas-cache.memcached.consistent-hash
    	Cache for bloom metas. Use consistent hashing to distribute to memcache servers. (default true)
  -bloom.metas-cache.memcached.expiration duration
    	Cache for bloom metas. How long keys stay in the memcache.
  -bloom.metas-cache.memcached.hostname string
    	Cache for bloom metas. Hostname for memcached service to use. If empty and if addresses is unset, no memcached will be used.
  -bloom.metas-cache.memcached.max-idle-conns int
    	Cache for bloom metas. Maximum number of idle connections in pool. (default 16)
  -bloom.metas-cache.memcached.max-item-size int
    	Cache for bloom metas. The maximum size of an item stored in memcached. Bigger items are not stored. If set to 0, no maximum size is enforced.
  -bloom.metas-cache.memcached.parallelism int
    	Cache for bloom metas. Maximum active requests to memcache. (default 5)
  -bloom.metas-cache.memcached.service string
    	Cache for bloom metas. SRV service used to discover memcache servers. (default "memcached")
  -bloom.metas-cache.memcached.timeout duration
    	Cache for bloom metas. Maximum time to wait before giving up on memcached requests. (default 100ms)
  -bloom.metas-cache.memcached.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -bloom.metas-cache.memcached.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -bloom.metas-cache.memcached.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -bloom.metas-cache.memcached.tls-enabled
    	Enable connecting to Memcached with TLS.
  -bloom.metas-cache.memcached.tls-insecure-skip-verify
    	Skip validating server certificate.
  -bloom.metas-cache.memcached.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -bloom.metas-cache.memcached.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -bloom.metas-cache.memcached.tls-server-name string
    	Override the expected name on the server certificate.
  -bloom.metas-cache.memcached.update-interval duration
    	Cache for bloom metas. Period with which to poll DNS for memcache servers. (default 1m0s)
  -bloom.metas-cache.redis.db int
    	Cache for bloom metas. Database index.
  -bloom.metas-cache.redis.endpoint string
    	Cache for bloom metas. Redis Server or Cluster configuration endpoint to use for caching. A comma-separated list of endpoints for Redis Cluster or Redis Sentinel. If empty, no redis will be used.
  -bloom.metas-cache.redis.expiration duration
    	Cache for bloom metas. How long keys stay in the redis.
  -bloom.metas-cache.redis.idle-timeout duration
    	Cache for bloom metas. Close connections after remaining idle for this duration. If the value is zero, then idle connections are not closed.
  -bloom.metas-cache.redis.master-name string
    	Cache for bloom metas. Redis Sentinel master name. An empty string for Redis Server or Redis Cluster.
  -bloom.metas-cache.redis.max-connection-age duration
    	Cache for bloom metas. Close connections older than this duration. If the value is zero, then the pool does not close connections based on age.
  -bloom.metas-cache.redis.password value
    	Cache for bloom metas. Password to use when connecting to redis.
  -bloom.metas-cache.redis.pool-size int
    	Cache for bloom metas. Maximum number of connections in the pool.
  -bloom.metas-cache.redis.route-randomly
    	Cache for bloom metas. By default, the Redis client only reads from the master node. Enabling this option can lower pressure on the master node by randomly routing read-only commands to the master and any available replicas.
  -bloom.metas-cache.redis.timeout duration
    	Cache for bloom metas. Maximum time to wait before giving up on redis requests. (default 500ms)
  -bloom.metas-cache.redis.tls-enabled
    	Cache for bloom metas. Enable connecting to redis with TLS.
  -bloom.metas-cache.redis.tls-insecure-skip-verify
    	Cache for bloom metas. Skip validating server certificate.
  -bloom.metas-cache.redis.username string
    	Cache for bloom metas. Username to use when connecting to redis.
  -bloom.metas-lru-cache.enabled
    	In-memory LRU cache for bloom metas. Whether embedded cache is enabled.
  -bloom.metas-lru-cache.max-size-items int
    	In-memory LRU cache for bloom metas. Maximum number of entries in the cache.
  -bloom.metas-lru-cache.max-size-mb int
    	In-memory LRU cache for bloom metas. Maximum memory size of the cache in MB. (default 100)
  -bloom.metas-lru-cache.ttl duration
    	In-memory LRU cache for bloom metas. The time to live for items in the cache before they get purged. (default 1h0m0s)
  -bloom.shipper.working-directory value
    	Working directory to store downloaded bloom blocks. Supports multiple directories, separated by comma. (default /data/blooms)
  -boltdb.dir string
    	Location of BoltDB index files.
  -boltdb.shipper.active-index-directory string
    	Directory where ingesters would write index files which would then be uploaded by shipper to configured storage
  -boltdb.shipper.build-per-tenant-index
    	Build per tenant index files
  -boltdb.shipper.cache-location string
    	Cache location for restoring index files from storage for queries
  -boltdb.shipper.cache-ttl duration
    	TTL for index files restored in cache for queries (default 24h0m0s)
  -boltdb.shipper.index-gateway-client.grpc.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -boltdb.shipper.index-gateway-client.grpc.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -boltdb.shipper.index-gateway-client.grpc.backoff-on-ratelimits
    	Enable backoff and retry when we hit rate limits.
  -boltdb.shipper.index-gateway-client.grpc.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -boltdb.shipper.index-gateway-client.grpc.cluster-validation.label string
    	Primary cluster validation label.
  -boltdb.shipper.index-gateway-client.grpc.connect-backoff-base-delay duration
    	Initial backoff delay after first connection failure. Only relevant if ConnectTimeout > 0. (default 1s)
  -boltdb.shipper.index-gateway-client.grpc.connect-backoff-max-delay duration
    	Maximum backoff delay when establishing a connection. Only relevant if ConnectTimeout > 0. (default 5s)
  -boltdb.shipper.index-gateway-client.grpc.connect-timeout duration
    	The maximum amount of time to establish a connection. A value of 0 means default gRPC client connect timeout and backoff. (default 5s)
  -boltdb.shipper.index-gateway-client.grpc.grpc-client-rate-limit float
    	Rate limit for gRPC client; 0 means disabled.
  -boltdb.shipper.index-gateway-client.grpc.grpc-client-rate-limit-burst int
    	Rate limit burst for gRPC client.
  -boltdb.shipper.index-gateway-client.grpc.grpc-compression string
    	Use compression when sending messages. Supported values are: 'gzip', 'snappy' and '' (disable compression)
  -boltdb.shipper.index-gateway-client.grpc.grpc-max-recv-msg-size int
    	gRPC client max receive message size (bytes). (default 104857600)
  -boltdb.shipper.index-gateway-client.grpc.grpc-max-send-msg-size int
    	gRPC client max send message size (bytes). (default 104857600)
  -boltdb.shipper.index-gateway-client.grpc.initial-connection-window-size value
    	Initial connection window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -boltdb.shipper.index-gateway-client.grpc.initial-stream-window-size value
    	Initial stream window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -boltdb.shipper.index-gateway-client.grpc.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -boltdb.shipper.index-gateway-client.grpc.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -boltdb.shipper.index-gateway-client.grpc.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -boltdb.shipper.index-gateway-client.grpc.tls-enabled
    	Enable TLS in the gRPC client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to gRPC server will be used.
  -boltdb.shipper.index-gateway-client.grpc.tls-insecure-skip-verify
    	Skip validating server certificate.
  -boltdb.shipper.index-gateway-client.grpc.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -boltdb.shipper.index-gateway-client.grpc.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -boltdb.shipper.index-gateway-client.grpc.tls-server-name string
    	Override the expected name on the server certificate.
  -boltdb.shipper.index-gateway-client.log-gateway-requests
    	Whether requests sent to the gateway should be logged or not.
  -boltdb.shipper.index-gateway-client.server-address string
    	Hostname or IP of the Index Gateway gRPC server running in simple mode. Can also be prefixed with dns+, dnssrv+, or dnssrvnoa+ to resolve a DNS A record with multiple IP's, a DNS SRV record with a followup A record lookup, or a DNS SRV record without a followup A record lookup, respectively.
  -boltdb.shipper.index-gateway-client.time-based-sharding-buckets value
    	Experimental: Defines buckets for time-based sharding. Time based sharding only takes affect when index gateways run in simple mode. To enable client side time-based sharding of queries across index gateway instances set at least one bucket in the format of a string representation of a time.Duration, e.g. ['168h', '336h', '504h']
  -boltdb.shipper.query-ready-num-days int
    	Number of days of common index to be kept downloaded for queries. For per tenant index query readiness, use limits overrides config.
  -boltdb.shipper.resync-interval duration
    	Resync downloaded files with the storage (default 5m0s)
  -bos.access-key-id string
    	Baidu Cloud Engine (BCE) Access Key ID.
  -bos.bucket-name string
    	Name of BOS bucket.
  -bos.endpoint string
    	BOS endpoint to connect to. (default "bj.bcebos.com")
  -bos.secret-access-key value
    	Baidu Cloud Engine (BCE) Secret Access Key.
  -cassandra.addresses string
    	Comma-separated hostnames or IPs of Cassandra instances.
  -cassandra.auth
    	Enable password authentication when connecting to cassandra.
  -cassandra.ca-path string
    	Path to certificate file to verify the peer.
  -cassandra.connect-timeout duration
    	Initial connection timeout, used during initial dial to server. (default 5s)
  -cassandra.consistency string
    	Consistency level for Cassandra. (default "QUORUM")
  -cassandra.convict-hosts-on-failure
    	Convict hosts of being down on failure. (default true)
  -cassandra.custom-authenticator value
    	If set, when authenticating with cassandra a custom authenticator will be expected during the handshake. This flag can be set multiple times.
  -cassandra.disable-initial-host-lookup
    	Instruct the cassandra driver to not attempt to get host info from the system.peers table.
  -cassandra.host-selection-policy string
    	Policy for selecting Cassandra host. Supported values are: round-robin, token-aware. (default "round-robin")
  -cassandra.host-verification
    	Require SSL certificate validation. (default true)
  -cassandra.keyspace string
    	Keyspace to use in Cassandra.
  -cassandra.max-retries int
    	Number of retries to perform on a request. Set to 0 to disable retries.
  -cassandra.num-connections int
    	Number of TCP connections per host. (default 2)
  -cassandra.password value
    	Password to use when connecting to cassandra.
  -cassandra.password-file string
    	File containing password to use when connecting to cassandra.
  -cassandra.port int
    	Port that Cassandra is running on (default 9042)
  -cassandra.query-concurrency int
    	Limit number of concurrent queries to Cassandra. Set to 0 to disable the limit.
  -cassandra.reconnent-interval duration
    	Interval to retry connecting to cassandra nodes marked as DOWN. (default 1s)
  -cassandra.replication-factor int
    	Replication factor to use in Cassandra. (default 3)
  -cassandra.retry-max-backoff duration
    	Maximum time to wait before retrying a failed request. (default 10s)
  -cassandra.retry-min-backoff duration
    	Minimum time to wait before retrying a failed request. (default 100ms)
  -cassandra.ssl
    	Use SSL when connecting to cassandra instances.
  -cassandra.table-options WITH
    	Table options used to create index or chunk tables. This value is used as plain text in the table WITH like this, "CREATE TABLE <generated_by_cortex> (...) WITH <cassandra.table-options>". For details, see https://cortexmetrics.io/docs/production/cassandra. By default it will use the default table options of your Cassandra cluster.
  -cassandra.timeout duration
    	Timeout when connecting to cassandra. (default 2s)
  -cassandra.tls-cert-path string
    	Path to certificate file used by TLS.
  -cassandra.tls-key-path string
    	Path to private key file used by TLS.
  -cassandra.username string
    	Username to use when connecting to cassandra.
  -common.compactor-address string
    	the http address of the compactor in the form http://host:port
  -common.compactor-grpc-address string
    	the grpc address of the compactor in the form host:port
  -common.path-prefix string
    	prefix for the path
  -common.scratch-path string
    	Experimental: path to use for temporary data, where scratch data is supported.
  -common.storage.azure.account-key value
    	Azure storage account key.
  -common.storage.azure.account-name string
    	Azure storage account name.
  -common.storage.azure.active-directory-endpoint string
    	Azure active directory endpoint override. Use when the Azure SDK does not support your environment.
  -common.storage.azure.chunk-delimiter string
    	Chunk delimiter for blob ID to be used (default "-")
  -common.storage.azure.client-id string
    	Azure Service Principal ID(GUID).
  -common.storage.azure.client-secret value
    	Azure Service Principal secret key.
  -common.storage.azure.connection-string connection-string
    	If connection-string is set, the values of `account-name` and `endpoint-suffix` values will not be used. Use this method over `account-key` if you need to authenticate via a SAS token. Or if you use the Azurite emulator.
  -common.storage.azure.container-name string
    	Name of the storage account blob container used to store chunks. This container must be created before running cortex. (default "loki")
  -common.storage.azure.download-buffer-count int
    	Number of buffers used to used to upload a chunk. (default 1)
  -common.storage.azure.download-buffer-size int
    	Preallocated buffer size for downloads. (default 512000)
  -common.storage.azure.endpoint-suffix string
    	Azure storage endpoint suffix without schema. The storage account name will be prefixed to this value to create the FQDN.
  -common.storage.azure.environment string
    	Azure Cloud environment. Supported values are: AzureGlobal, AzureChinaCloud, AzureGermanCloud, AzureUSGovernment. (default "AzureGlobal")
  -common.storage.azure.max-retries int
    	Number of retries for a request which times out. (default 5)
  -common.storage.azure.max-retry-delay duration
    	Maximum time to wait before retrying a request. (default 500ms)
  -common.storage.azure.min-retry-delay duration
    	Minimum time to wait before retrying a request. (default 10ms)
  -common.storage.azure.request-timeout duration
    	Timeout for requests made against azure blob storage. (default 30s)
  -common.storage.azure.tenant-id string
    	Azure Tenant ID is used to authenticate through Azure OAuth.
  -common.storage.azure.upload-buffer-size int
    	Preallocated buffer size for uploads. (default 256000)
  -common.storage.azure.use-federated-token
    	Use Federated Token to authenticate to the Azure storage account.
  -common.storage.azure.use-managed-identity
    	Use Managed Identity to authenticate to the Azure storage account.
  -common.storage.azure.use-service-principal
    	Use Service Principal to authenticate through Azure OAuth.
  -common.storage.azure.user-assigned-id string
    	User assigned identity ID to authenticate to the Azure storage account.
  -common.storage.bos.access-key-id string
    	Baidu Cloud Engine (BCE) Access Key ID.
  -common.storage.bos.bucket-name string
    	Name of BOS bucket.
  -common.storage.bos.endpoint string
    	BOS endpoint to connect to. (default "bj.bcebos.com")
  -common.storage.bos.secret-access-key value
    	Baidu Cloud Engine (BCE) Secret Access Key.
  -common.storage.congestion-control.enabled
    	Use storage congestion control (default: disabled).
  -common.storage.congestion-control.hedge.strategy string
    	Congestion control hedge strategy to use (default: none, options: 'limited').
  -common.storage.congestion-control.retry.strategy string
    	Congestion control retry strategy to use (default: none, options: 'limited').
  -common.storage.congestion-control.retry.strategy.limited.limit int
    	Maximum number of retries allowed. (default 2)
  -common.storage.congestion-control.strategy string
    	Congestion control strategy to use (default: none, options: 'aimd').
  -common.storage.congestion-control.strategy.aimd.backoff-factor float
    	AIMD backoff factor when upstream service is throttled to decrease number of requests sent per second (default: 0.5). (default 0.5)
  -common.storage.congestion-control.strategy.aimd.start uint
    	AIMD starting throughput window size: how many requests can be sent per second (default: 2000). (default 2000)
  -common.storage.congestion-control.strategy.aimd.upper-bound uint
    	AIMD maximum throughput window size: upper limit of requests sent per second (default: 10000). (default 10000)
  -common.storage.cos.access-key-id string
    	COS HMAC Access Key ID.
  -common.storage.cos.api-key value
    	IAM API key to access COS.
  -common.storage.cos.auth-endpoint string
    	IAM Auth Endpoint for authentication. (default "https://iam.cloud.ibm.com/identity/token")
  -common.storage.cos.buckets string
    	Comma separated list of bucket names to evenly distribute chunks over.
  -common.storage.cos.cr-token-file-path string
    	Compute resource token file path.
  -common.storage.cos.endpoint string
    	COS Endpoint to connect to.
  -common.storage.cos.force-path-style true
    	Set this to true to force the request to use path-style addressing.
  -common.storage.cos.http.idle-conn-timeout duration
    	The maximum amount of time an idle connection will be held open. (default 1m30s)
  -common.storage.cos.http.response-header-timeout duration
    	If non-zero, specifies the amount of time to wait for a server's response headers after fully writing the request.
  -common.storage.cos.max-backoff duration
    	Maximum backoff time when cos get Object. (default 3s)
  -common.storage.cos.max-retries int
    	Maximum number of times to retry when cos get Object. (default 5)
  -common.storage.cos.min-backoff duration
    	Minimum backoff time when cos get Object. (default 100ms)
  -common.storage.cos.region string
    	COS region to use.
  -common.storage.cos.secret-access-key value
    	COS HMAC Secret Access Key.
  -common.storage.cos.service-instance-id string
    	COS service instance id to use.
  -common.storage.cos.trusted-profile-id string
    	ID of the trusted profile.
  -common.storage.cos.trusted-profile-name string
    	Name of the trusted profile.
  -common.storage.filesystem.chunk-directory string
    	Directory to store chunks in.
  -common.storage.filesystem.rules-directory string
    	Directory to store rules in.
  -common.storage.gcs.bucketname string
    	Name of GCS bucket. Please refer to https://cloud.google.com/docs/authentication/production for more information about how to configure authentication.
  -common.storage.gcs.chunk-buffer-size int
    	The size of the buffer that GCS client for each PUT request. 0 to disable buffering.
  -common.storage.gcs.enable-http2
    	Enable HTTP2 connections. (default true)
  -common.storage.gcs.enable-opencensus
    	Enable OpenCensus (OC) instrumentation for all requests. (default true)
  -common.storage.gcs.enable-retries
    	Enable automatic retries of failed idempotent requests. (default true)
  -common.storage.gcs.endpoint string
    	Custom GCS endpoint URL.
  -common.storage.gcs.request-timeout duration
    	The duration after which the requests to GCS should be timed out.
  -common.storage.gcs.service-account value
    	Service account key content in JSON format, refer to https://cloud.google.com/iam/docs/creating-managing-service-account-keys for creation.
  -common.storage.hedge-max-per-second int
    	The maximum of hedge requests allowed per seconds. (default 5)
  -common.storage.hedge-requests-at duration
    	If set to a non-zero value a second request will be issued at the provided duration. Default is 0 (disabled)
  -common.storage.hedge-requests-up-to int
    	The maximum of hedge requests allowed. (default 2)
  -common.storage.object-store.azure.account-key value
    	Azure storage account key. If unset, Azure managed identities will be used for authentication instead.
  -common.storage.object-store.azure.account-name string
    	Azure storage account name
  -common.storage.object-store.azure.chunk-delimiter string
    	Delimiter used to replace ':' in chunk IDs when storing chunks (default "-")
  -common.storage.object-store.azure.connection-string connection-string
    	If connection-string is set, the value of `endpoint-suffix` will not be used. Use this method over `account-key` if you need to authenticate via a SAS token. Or if you use the Azurite emulator.
  -common.storage.object-store.azure.container-name string
    	Azure storage container name
  -common.storage.object-store.azure.endpoint-suffix string
    	Azure storage endpoint suffix without schema. The account name will be prefixed to this value to create the FQDN. If set to empty string, default endpoint suffix is used.
  -common.storage.object-store.azure.max-retries int
    	Number of retries for recoverable errors (default 20)
  -common.storage.object-store.azure.user-assigned-id string
    	User assigned managed identity. If empty, then System assigned identity is used.
  -common.storage.object-store.bos.access-key string
    	Baidu Cloud Engine (BCE) Access Key ID.
  -common.storage.object-store.bos.bucket string
    	Name of BOS bucket.
  -common.storage.object-store.bos.endpoint string
    	BOS endpoint to connect to.
  -common.storage.object-store.bos.secret-key value
    	Baidu Cloud Engine (BCE) Secret Access Key.
  -common.storage.object-store.filesystem.dir string
    	Local filesystem storage directory.
  -common.storage.object-store.gcs.bucket-name string
    	GCS bucket name
  -common.storage.object-store.gcs.chunk-buffer-size int
    	The maximum size of the buffer that GCS client for a single PUT request. 0 to disable buffering.
  -common.storage.object-store.gcs.max-retries int
    	The maximum number of retries for idempotent operations. Overrides the default gcs storage client behavior if this value is greater than 0. Set this to 1 to disable retries. (default 10)
  -common.storage.object-store.gcs.service-account value
    	JSON either from a Google Developers Console client_credentials.json file, or a Google Developers service account key. Needs to be valid JSON, not a filesystem path.
  -common.storage.object-store.oss.access-key-id string
    	alibabacloud Access Key ID
  -common.storage.object-store.oss.access-key-secret value
    	alibabacloud Secret Access Key
  -common.storage.object-store.oss.bucketname string
    	Name of OSS bucket.
  -common.storage.object-store.oss.endpoint string
    	Endpoint to connect to.
  -common.storage.object-store.s3.access-key-id string
    	S3 access key ID
  -common.storage.object-store.s3.bucket-lookup-type value
    	Bucket lookup style type, used to access bucket in S3-compatible service. Default is auto. Supported values are: auto, path, virtual-hosted.
  -common.storage.object-store.s3.bucket-name string
    	S3 bucket name
  -common.storage.object-store.s3.dualstack-enabled
    	When enabled, direct all AWS S3 requests to the dual-stack IPv4/IPv6 endpoint for the configured region. (default true)
  -common.storage.object-store.s3.endpoint string
    	The S3 bucket endpoint. It could be an AWS S3 endpoint listed at https://docs.aws.amazon.com/general/latest/gr/s3.html or the address of an S3-compatible service in hostname:port format.
  -common.storage.object-store.s3.expect-continue-timeout duration
    	The time to wait for a server's first response headers after fully writing the request headers if the request has an Expect header. 0 to send the request body immediately. (default 1s)
  -common.storage.object-store.s3.http.idle-conn-timeout duration
    	The time an idle connection will remain idle before closing. (default 1m30s)
  -common.storage.object-store.s3.http.insecure-skip-verify
    	If the client connects via HTTPS and this option is enabled, the client will accept any certificate and hostname.
  -common.storage.object-store.s3.http.response-header-timeout duration
    	The amount of time the client will wait for a servers response headers. (default 2m0s)
  -common.storage.object-store.s3.http.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -common.storage.object-store.s3.http.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -common.storage.object-store.s3.http.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -common.storage.object-store.s3.http.tls-server-name string
    	Override the expected name on the server certificate.
  -common.storage.object-store.s3.insecure
    	If enabled, use http:// for the S3 endpoint instead of https://. This could be useful in local dev/test environments while using an S3-compatible backend storage, like Minio.
  -common.storage.object-store.s3.list-objects-version string
    	Use a specific version of the S3 list object API. Supported values are v1 or v2. Default is unset.
  -common.storage.object-store.s3.max-connections-per-host int
    	Maximum number of connections per host. 0 means no limit.
  -common.storage.object-store.s3.max-idle-connections int
    	Maximum number of idle (keep-alive) connections across all hosts. 0 means no limit. (default 100)
  -common.storage.object-store.s3.max-idle-connections-per-host int
    	Maximum number of idle (keep-alive) connections to keep per-host. If 0, a built-in default value is used. (default 100)
  -common.storage.object-store.s3.max-retries int
    	The maximum number of retries for S3 requests that are retryable. Default is 10, set this to 1 to disable retries. (default 10)
  -common.storage.object-store.s3.native-aws-auth-enabled
    	If enabled, it will use the default authentication methods of the AWS SDK for go based on known environment variables and known AWS config files.
  -common.storage.object-store.s3.part-size uint
    	The minimum file size in bytes used for multipart uploads. If 0, the value is optimally computed for each object.
  -common.storage.object-store.s3.region string
    	S3 region. If unset, the client will issue a S3 GetBucketLocation API call to autodetect it.
  -common.storage.object-store.s3.secret-access-key value
    	S3 secret access key
  -common.storage.object-store.s3.send-content-md5
    	If enabled, a Content-MD5 header is sent with S3 Put Object requests. Consumes more resources to compute the MD5, but may improve compatibility with object storage services that do not support checksums.
  -common.storage.object-store.s3.session-token value
    	S3 session token
  -common.storage.object-store.s3.sse.kms-encryption-context string
    	KMS Encryption Context used for object encryption. It expects JSON formatted string.
  -common.storage.object-store.s3.sse.kms-key-id string
    	KMS Key ID used to encrypt objects in S3
  -common.storage.object-store.s3.sse.type string
    	Enable AWS Server Side Encryption. Supported values: SSE-KMS, SSE-S3.
  -common.storage.object-store.s3.storage-class string
    	The S3 storage class to use, not set by default. Details can be found at https://aws.amazon.com/s3/storage-classes/. Supported values are: STANDARD, REDUCED_REDUNDANCY, GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, OUTPOSTS, GLACIER_IR, SNOW, EXPRESS_ONEZONE, FSX_OPENZFS, FSX_ONTAP
  -common.storage.object-store.s3.sts-endpoint string
    	Accessing S3 resources using temporary, secure credentials provided by AWS Security Token Service.
  -common.storage.object-store.s3.tls-handshake-timeout duration
    	Maximum time to wait for a TLS handshake. 0 means no limit. (default 10s)
  -common.storage.object-store.s3.trace.enabled
    	When enabled, low-level S3 HTTP operation information is logged at the debug level.
  -common.storage.object-store.storage-prefix string
    	Prefix for all objects stored in the backend storage. For simplicity, it may only contain digits, English alphabet letters and dashes.
  -common.storage.object-store.swift.application-credential-id string
    	OpenStack Swift application credential id
  -common.storage.object-store.swift.application-credential-name string
    	OpenStack Swift application credential name
  -common.storage.object-store.swift.application-credential-secret value
    	OpenStack Swift application credential secret
  -common.storage.object-store.swift.auth-url string
    	OpenStack Swift authentication URL
  -common.storage.object-store.swift.auth-version int
    	OpenStack Swift authentication API version. 0 to autodetect.
  -common.storage.object-store.swift.connect-timeout duration
    	Time after which a connection attempt is aborted. (default 10s)
  -common.storage.object-store.swift.container-name string
    	Name of the OpenStack Swift container to put chunks in.
  -common.storage.object-store.swift.domain-id string
    	OpenStack Swift user's domain ID.
  -common.storage.object-store.swift.domain-name string
    	OpenStack Swift user's domain name.
  -common.storage.object-store.swift.expect-continue-timeout duration
    	The time to wait for a server's first response headers after fully writing the request headers if the request has an Expect header. 0 to send the request body immediately. (default 1s)
  -common.storage.object-store.swift.http.idle-conn-timeout duration
    	The time an idle connection will remain idle before closing. (default 1m30s)
  -common.storage.object-store.swift.http.insecure-skip-verify
    	If the client connects via HTTPS and this option is enabled, the client will accept any certificate and hostname.
  -common.storage.object-store.swift.http.response-header-timeout duration
    	The amount of time the client will wait for a servers response headers. (default 2m0s)
  -common.storage.object-store.swift.http.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -common.storage.object-store.swift.http.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -common.storage.object-store.swift.http.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -common.storage.object-store.swift.http.tls-server-name string
    	Override the expected name on the server certificate.
  -common.storage.object-store.swift.max-connections-per-host int
    	Maximum number of connections per host. 0 means no limit.
  -common.storage.object-store.swift.max-idle-connections int
    	Maximum number of idle (keep-alive) connections across all hosts. 0 means no limit. (default 100)
  -common.storage.object-store.swift.max-idle-connections-per-host int
    	Maximum number of idle (keep-alive) connections to keep per-host. If 0, a built-in default value is used. (default 100)
  -common.storage.object-store.swift.max-retries int
    	Max retries on requests error. (default 3)
  -common.storage.object-store.swift.password value
    	OpenStack Swift API key.
  -common.storage.object-store.swift.project-domain-id string
    	ID of the OpenStack Swift project's domain (v3 auth only), only needed if it differs the from user domain.
  -common.storage.object-store.swift.project-domain-name string
    	Name of the OpenStack Swift project's domain (v3 auth only), only needed if it differs from the user domain.
  -common.storage.object-store.swift.project-id string
    	OpenStack Swift project ID (v2,v3 auth only).
  -common.storage.object-store.swift.project-name string
    	OpenStack Swift project name (v2,v3 auth only).
  -common.storage.object-store.swift.region-name string
    	OpenStack Swift Region to use (v2,v3 auth only).
  -common.storage.object-store.swift.request-timeout duration
    	Time after which an idle request is aborted. The timeout watchdog is reset each time some data is received, so the timeout triggers after X time no data is received on a request. (default 5s)
  -common.storage.object-store.swift.tls-handshake-timeout duration
    	Maximum time to wait for a TLS handshake. 0 means no limit. (default 10s)
  -common.storage.object-store.swift.user-domain-id string
    	OpenStack Swift user's domain ID.
  -common.storage.object-store.swift.user-domain-name string
    	OpenStack Swift user's domain name.
  -common.storage.object-store.swift.user-id string
    	OpenStack Swift user ID.
  -common.storage.object-store.swift.username string
    	OpenStack Swift username.
  -common.storage.oss.access-key-id string
    	alibabacloud Access Key ID
  -common.storage.oss.bucketname string
    	Name of OSS bucket.
  -common.storage.oss.conn-timeout-sec int
    	Connection timeout in seconds (default 30)
  -common.storage.oss.endpoint string
    	oss Endpoint to connect to.
  -common.storage.oss.read-write-timeout-sec int
    	Read/Write timeout in seconds (default 60)
  -common.storage.oss.secret-access-key value
    	alibabacloud Secret Access Key
  -common.storage.ring.consul.acl-token value
    	ACL Token used to interact with Consul.
  -common.storage.ring.consul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -common.storage.ring.consul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -common.storage.ring.consul.consistent-reads
    	Enable consistent reads to Consul.
  -common.storage.ring.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -common.storage.ring.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -common.storage.ring.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -common.storage.ring.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -common.storage.ring.etcd.endpoints value
    	The etcd endpoints to connect to.
  -common.storage.ring.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -common.storage.ring.etcd.password value
    	Etcd password.
  -common.storage.ring.etcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -common.storage.ring.etcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -common.storage.ring.etcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -common.storage.ring.etcd.tls-enabled
    	Enable TLS.
  -common.storage.ring.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -common.storage.ring.etcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -common.storage.ring.etcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -common.storage.ring.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -common.storage.ring.etcd.username string
    	Etcd username.
  -common.storage.ring.heartbeat-period duration
    	Period at which to heartbeat to the ring. (default 15s)
  -common.storage.ring.heartbeat-timeout duration
    	The heartbeat timeout after which compactors are considered unhealthy within the ring. 0 = never (timeout disabled). (default 1m0s)
  -common.storage.ring.instance-addr string
    	IP address to advertise in the ring.
  -common.storage.ring.instance-availability-zone string
    	The availability zone where this instance is running. Required if zone-awareness is enabled.
  -common.storage.ring.instance-enable-ipv6
    	Enable using a IPv6 instance address.
  -common.storage.ring.instance-id string
    	Instance ID to register in the ring. (default "localhost")
  -common.storage.ring.instance-interface-names value
    	Name of network interface to read address from. (default [eth0 en0])
  -common.storage.ring.instance-port int
    	Port to advertise in the ring (defaults to server.grpc-listen-port).
  -common.storage.ring.multi.mirror-enabled
    	Mirror writes to the secondary store.
  -common.storage.ring.multi.mirror-timeout duration
    	Timeout for storing a value to the secondary store. (default 2s)
  -common.storage.ring.multi.primary string
    	Primary backend storage used by multi-client.
  -common.storage.ring.multi.secondary string
    	Secondary backend storage used by multi-client.
  -common.storage.ring.num-tokens int
    	Number of tokens to own in the ring. (default 128)
  -common.storage.ring.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -common.storage.ring.replication-factor int
    	Factor for data replication. (default 3)
  -common.storage.ring.store string
    	Backend storage to use for the ring. Supported values are: consul, etcd, inmemory, memberlist, multi. (default "consul")
  -common.storage.ring.tokens-file-path string
    	File path where tokens are stored. If empty, tokens are not stored at shutdown and restored at startup.
  -common.storage.ring.zone-awareness-enabled
    	True to enable zone-awareness and replicate blocks across different availability zones.
  -common.storage.s3.access-key-id string
    	AWS Access Key ID
  -common.storage.s3.buckets string
    	Comma separated list of bucket names to evenly distribute chunks over. Overrides any buckets specified in s3.url flag
  -common.storage.s3.chunk-delimiter string
    	Delimiter used to replace the default delimiter ':' in chunk IDs when storing chunks. This is mainly intended when you run a MinIO instance on a Windows machine. You should not change this value inflight.
  -common.storage.s3.disable-dualstack
    	Disable forcing S3 dualstack endpoint usage.
  -common.storage.s3.endpoint string
    	S3 Endpoint to connect to.
  -common.storage.s3.force-path-style true
    	Set this to true to force the request to use path-style addressing.
  -common.storage.s3.http.ca-file string
    	Path to the trusted CA file that signed the SSL certificate of the S3 endpoint.
  -common.storage.s3.http.idle-conn-timeout duration
    	The maximum amount of time an idle connection will be held open. (default 1m30s)
  -common.storage.s3.http.insecure-skip-verify
    	Set to true to skip verifying the certificate chain and hostname.
  -common.storage.s3.http.response-header-timeout duration
    	If non-zero, specifies the amount of time to wait for a server's response headers after fully writing the request.
  -common.storage.s3.http.timeout duration
    	Timeout specifies a time limit for requests made by s3 Client.
  -common.storage.s3.insecure
    	Disable https on s3 connection.
  -common.storage.s3.max-backoff duration
    	Maximum backoff time when s3 get Object (default 3s)
  -common.storage.s3.max-retries int
    	Maximum number of times to retry for s3 GetObject or ObjectExists (default 5)
  -common.storage.s3.min-backoff duration
    	Minimum backoff time when s3 get Object (default 100ms)
  -common.storage.s3.region string
    	AWS region to use.
  -common.storage.s3.secret-access-key value
    	AWS Secret Access Key
  -common.storage.s3.session-token value
    	AWS Session Token
  -common.storage.s3.signature-version string
    	The signature version to use for authenticating against S3. Supported values are: v4. (default "v4")
  -common.storage.s3.sse.kms-encryption-context string
    	KMS Encryption Context used for object encryption. It expects JSON formatted string.
  -common.storage.s3.sse.kms-key-id string
    	KMS Key ID used to encrypt objects in S3
  -common.storage.s3.sse.type string
    	Enable AWS Server Side Encryption. Supported values: SSE-KMS, SSE-S3.
  -common.storage.s3.storage-class string
    	The S3 storage class which objects will use. Supported values are: GLACIER, DEEP_ARCHIVE, GLACIER_IR, INTELLIGENT_TIERING, ONEZONE_IA, OUTPOSTS, REDUCED_REDUNDANCY, STANDARD, STANDARD_IA. (default "STANDARD")
  -common.storage.s3.url value
    	S3 endpoint URL with escaped Key and Secret encoded. If only region is specified as a host, proper endpoint will be deduced. Use inmemory:///<bucket-name> to use a mock in-memory implementation.
  -common.storage.swift.auth-url string
    	OpenStack Swift authentication URL
  -common.storage.swift.auth-version int
    	OpenStack Swift authentication API version. 0 to autodetect.
  -common.storage.swift.connect-timeout duration
    	Time after which a connection attempt is aborted. (default 10s)
  -common.storage.swift.container-name string
    	Name of the OpenStack Swift container to put chunks in.
  -common.storage.swift.domain-id string
    	OpenStack Swift user's domain ID.
  -common.storage.swift.domain-name string
    	OpenStack Swift user's domain name.
  -common.storage.swift.http.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -common.storage.swift.internal
    	Set this to true to use the internal OpenStack Swift endpoint URL
  -common.storage.swift.max-retries int
    	Max retries on requests error. (default 3)
  -common.storage.swift.password value
    	OpenStack Swift API key.
  -common.storage.swift.project-domain-id string
    	ID of the OpenStack Swift project's domain (v3 auth only), only needed if it differs the from user domain.
  -common.storage.swift.project-domain-name string
    	Name of the OpenStack Swift project's domain (v3 auth only), only needed if it differs from the user domain.
  -common.storage.swift.project-id string
    	OpenStack Swift project ID (v2,v3 auth only).
  -common.storage.swift.project-name string
    	OpenStack Swift project name (v2,v3 auth only).
  -common.storage.swift.region-name string
    	OpenStack Swift Region to use (v2,v3 auth only).
  -common.storage.swift.request-timeout duration
    	Time after which an idle request is aborted. The timeout watchdog is reset each time some data is received, so the timeout triggers after X time no data is received on a request. (default 5s)
  -common.storage.swift.user-domain-id string
    	OpenStack Swift user's domain ID.
  -common.storage.swift.user-domain-name string
    	OpenStack Swift user's domain name.
  -common.storage.swift.user-id string
    	OpenStack Swift user ID.
  -common.storage.swift.username string
    	OpenStack Swift username.
  -compactor.allow-deletes value
    	Deprecated. Instead, see compactor.deletion-mode which is another per tenant configuration
  -compactor.apply-retention-interval duration
    	Interval at which to apply/enforce retention. 0 means run at same interval as compaction. If non-zero, it should always be a multiple of compaction interval.
  -compactor.client.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -compactor.client.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -compactor.client.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -compactor.client.tls-enabled
    	Enable TLS in the HTTP client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to HTTP server will be used.
  -compactor.client.tls-insecure-skip-verify
    	Skip validating server certificate.
  -compactor.client.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -compactor.client.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -compactor.client.tls-server-name string
    	Override the expected name on the server certificate.
  -compactor.compaction-interval duration
    	Interval at which to re-run the compaction operation. (default 10m0s)
  -compactor.delete-batch-size int
    	The max number of delete requests to run per compaction cycle. (default 70)
  -compactor.delete-max-interval duration
    	Constrain the size of any single delete request with line filters. When a delete request > delete_max_interval is input, the request is sharded into smaller requests of no more than delete_max_interval (default 24h0m0s)
  -compactor.delete-request-cancel-period duration
    	Allow cancellation of delete request until duration after they are created. Data would be deleted only after delete requests have been older than this duration. Ideally this should be set to at least 24h. (default 24h0m0s)
  -compactor.delete-request-store string
    	Store used for managing delete requests.
  -compactor.delete-request-store.backup-db-type string
    	Type of DB to use as backup for storing delete requests. Backup DB should ideally be used while migrating from one DB type to another. Supported type(s): boltdb
  -compactor.delete-request-store.db-type string
    	Type of DB to use for storing delete requests. Supported types: boltdb, sqlite (default "boltdb")
  -compactor.delete-request-store.key-prefix string
    	Path prefix for storing delete requests. (default "index/")
  -compactor.deletion-marker-object-store-prefix string
    	Object storage path prefix for storing deletion markers. The prefix must end with a forward slash(/). Leave empty to continue to store deletion markers on the local disk.
  -compactor.deletion-mode string
    	Deletion mode. Can be one of 'disabled', 'filter-only', or 'filter-and-delete'. When set to 'filter-only' or 'filter-and-delete', and if retention_enabled is true, then the log entry deletion API endpoints are available. (default "filter-and-delete")
  -compactor.grpc-client.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -compactor.grpc-client.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -compactor.grpc-client.backoff-on-ratelimits
    	Enable backoff and retry when we hit rate limits.
  -compactor.grpc-client.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -compactor.grpc-client.cluster-validation.label string
    	Primary cluster validation label.
  -compactor.grpc-client.connect-backoff-base-delay duration
    	Initial backoff delay after first connection failure. Only relevant if ConnectTimeout > 0. (default 1s)
  -compactor.grpc-client.connect-backoff-max-delay duration
    	Maximum backoff delay when establishing a connection. Only relevant if ConnectTimeout > 0. (default 5s)
  -compactor.grpc-client.connect-timeout duration
    	The maximum amount of time to establish a connection. A value of 0 means default gRPC client connect timeout and backoff. (default 5s)
  -compactor.grpc-client.grpc-client-rate-limit float
    	Rate limit for gRPC client; 0 means disabled.
  -compactor.grpc-client.grpc-client-rate-limit-burst int
    	Rate limit burst for gRPC client.
  -compactor.grpc-client.grpc-compression string
    	Use compression when sending messages. Supported values are: 'gzip', 'snappy' and '' (disable compression)
  -compactor.grpc-client.grpc-max-recv-msg-size int
    	gRPC client max receive message size (bytes). (default 104857600)
  -compactor.grpc-client.grpc-max-send-msg-size int
    	gRPC client max send message size (bytes). (default 104857600)
  -compactor.grpc-client.initial-connection-window-size value
    	Initial connection window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -compactor.grpc-client.initial-stream-window-size value
    	Initial stream window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -compactor.grpc-client.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -compactor.grpc-client.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -compactor.grpc-client.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -compactor.grpc-client.tls-enabled
    	Enable TLS in the gRPC client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to gRPC server will be used.
  -compactor.grpc-client.tls-insecure-skip-verify
    	Skip validating server certificate.
  -compactor.grpc-client.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -compactor.grpc-client.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -compactor.grpc-client.tls-server-name string
    	Override the expected name on the server certificate.
  -compactor.horizontal-scaling-mode string
    	Experimental: Configuration to turn on and run horizontally scalable compactor. Supported modes - [disabled]: Keeps the horizontal scaling mode disabled. Locally runs all the functions of the compactor.[main]: Runs all functions of the compactor. Distributes work to workers where possible.[worker]: Runs the compactor in worker mode, only working on jobs built by the main compactor. (default "disabled")
  -compactor.jobs.deletion.chunk-processing-concurrency int
    	Maximum number of chunks to process concurrently in each worker. (default 3)
  -compactor.jobs.deletion.deletion-manifest-store-prefix string
    	Object storage path prefix for storing deletion manifests. (default "__deletion_manifest__/")
  -compactor.jobs.deletion.max-retries int
    	Maximum number of times to retry a failed or timed out job. (default 3)
  -compactor.jobs.deletion.timeout duration
    	Maximum time to wait for a job before considering it failed and retrying. (default 15m0s)
  -compactor.max-compaction-parallelism int
    	Maximum number of tables to compact in parallel. While increasing this value, please make sure compactor has enough disk space allocated to be able to store and compact as many tables. (default 1)
  -compactor.retention-backoff-config.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -compactor.retention-backoff-config.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -compactor.retention-backoff-config.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -compactor.retention-delete-delay duration
    	Delay after which chunks will be fully deleted during retention. (default 2h0m0s)
  -compactor.retention-delete-worker-count int
    	The total amount of worker to use to delete chunks. (default 150)
  -compactor.retention-enabled
    	Activate custom (per-stream,per-tenant) retention.
  -compactor.retention-table-timeout duration
    	The maximum amount of time to spend running retention and deletion on any given table in the index.
  -compactor.ring.consul.acl-token value
    	ACL Token used to interact with Consul.
  -compactor.ring.consul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -compactor.ring.consul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -compactor.ring.consul.consistent-reads
    	Enable consistent reads to Consul.
  -compactor.ring.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -compactor.ring.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -compactor.ring.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -compactor.ring.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -compactor.ring.etcd.endpoints value
    	The etcd endpoints to connect to.
  -compactor.ring.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -compactor.ring.etcd.password value
    	Etcd password.
  -compactor.ring.etcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -compactor.ring.etcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -compactor.ring.etcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -compactor.ring.etcd.tls-enabled
    	Enable TLS.
  -compactor.ring.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -compactor.ring.etcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -compactor.ring.etcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -compactor.ring.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -compactor.ring.etcd.username string
    	Etcd username.
  -compactor.ring.heartbeat-period duration
    	Period at which to heartbeat to the ring. (default 15s)
  -compactor.ring.heartbeat-timeout duration
    	The heartbeat timeout after which compactors are considered unhealthy within the ring. 0 = never (timeout disabled). (default 1m0s)
  -compactor.ring.instance-addr string
    	IP address to advertise in the ring.
  -compactor.ring.instance-availability-zone string
    	The availability zone where this instance is running. Required if zone-awareness is enabled.
  -compactor.ring.instance-enable-ipv6
    	Enable using a IPv6 instance address.
  -compactor.ring.instance-id string
    	Instance ID to register in the ring. (default "localhost")
  -compactor.ring.instance-interface-names value
    	Name of network interface to read address from. (default [eth0 en0])
  -compactor.ring.instance-port int
    	Port to advertise in the ring (defaults to server.grpc-listen-port).
  -compactor.ring.multi.mirror-enabled
    	Mirror writes to the secondary store.
  -compactor.ring.multi.mirror-timeout duration
    	Timeout for storing a value to the secondary store. (default 2s)
  -compactor.ring.multi.primary string
    	Primary backend storage used by multi-client.
  -compactor.ring.multi.secondary string
    	Secondary backend storage used by multi-client.
  -compactor.ring.num-tokens int
    	IGNORED: Num tokens is fixed to 1 (default 1)
  -compactor.ring.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -compactor.ring.replication-factor int
    	IGNORED: Replication factor is fixed to 1 (default 1)
  -compactor.ring.store string
    	Backend storage to use for the ring. Supported values are: consul, etcd, inmemory, memberlist, multi. (default "consul")
  -compactor.ring.tokens-file-path string
    	File path where tokens are stored. If empty, tokens are not stored at shutdown and restored at startup.
  -compactor.ring.zone-awareness-enabled
    	True to enable zone-awareness and replicate blocks across different availability zones.
  -compactor.run-once
    	Run the compactor one time to cleanup and compact index files only (no retention applied)
  -compactor.skip-latest-n-tables int
    	Do not compact N latest tables. Together with -compactor.run-once and -compactor.tables-to-compact, this is useful when clearing compactor backlogs.
  -compactor.tables-to-compact int
    	Number of tables that compactor will try to compact. Newer tables are chosen when this is less than the number of tables available.
  -compactor.upload-parallelism int
    	Number of upload/remove operations to execute in parallel when finalizing a compaction. NOTE: This setting is per compaction operation, which can be executed in parallel. The upper bound on the number of concurrent uploads is upload_parallelism * max_compaction_parallelism. (default 10)
  -compactor.worker.num-sub-workers int
    	Number of sub-workers to run for concurrent processing of jobs. (default 4)
  -compactor.working-directory string
    	Directory where files can be downloaded for compaction. (default "/var/loki/compactor")
  -config.ballast-bytes int
    	The amount of virtual memory in bytes to reserve as ballast in order to optimize garbage collection. Larger ballasts result in fewer garbage collection passes, reducing CPU overhead at the cost of heap size. The ballast will not consume physical memory, because it is never read from. It will, however, distort metrics, because it is counted as live memory.
  -config.expand-env
    	Expands ${var} in config according to the values of the environment variables.
  -config.file string
    	configuration file to load, can be a comma separated list of paths, first existing file will be used (default "config.yaml,config/config.yaml")
  -consul.acl-token value
    	ACL Token used to interact with Consul.
  -consul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -consul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -consul.consistent-reads
    	Enable consistent reads to Consul.
  -consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -cos.access-key-id string
    	COS HMAC Access Key ID.
  -cos.api-key value
    	IAM API key to access COS.
  -cos.auth-endpoint string
    	IAM Auth Endpoint for authentication. (default "https://iam.cloud.ibm.com/identity/token")
  -cos.buckets string
    	Comma separated list of bucket names to evenly distribute chunks over.
  -cos.cr-token-file-path string
    	Compute resource token file path.
  -cos.endpoint string
    	COS Endpoint to connect to.
  -cos.force-path-style true
    	Set this to true to force the request to use path-style addressing.
  -cos.http.idle-conn-timeout duration
    	The maximum amount of time an idle connection will be held open. (default 1m30s)
  -cos.http.response-header-timeout duration
    	If non-zero, specifies the amount of time to wait for a server's response headers after fully writing the request.
  -cos.max-backoff duration
    	Maximum backoff time when cos get Object. (default 3s)
  -cos.max-retries int
    	Maximum number of times to retry when cos get Object. (default 5)
  -cos.min-backoff duration
    	Minimum backoff time when cos get Object. (default 100ms)
  -cos.region string
    	COS region to use.
  -cos.secret-access-key value
    	COS HMAC Secret Access Key.
  -cos.service-instance-id string
    	COS service instance id to use.
  -cos.trusted-profile-id string
    	ID of the trusted profile.
  -cos.trusted-profile-name string
    	Name of the trusted profile.
  -dataobj-consumer.availability-zone string
    	The availability zone where this instance is running.
  -dataobj-consumer.buffer-size value
    	The size of logs to buffer in memory before adding into columnar builders, used to reduce CPU load of sorting. (default 16MiB)
  -dataobj-consumer.consul.acl-token value
    	ACL Token used to interact with Consul.
  -dataobj-consumer.consul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -dataobj-consumer.consul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -dataobj-consumer.consul.consistent-reads
    	Enable consistent reads to Consul.
  -dataobj-consumer.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -dataobj-consumer.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -dataobj-consumer.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -dataobj-consumer.dataobj-sort-order stream-asc
    	The desired sort order of the logs section. Can either be stream-asc (order by streamID ascending and timestamp descending) or `timestamp-desc` (order by timestamp descending and streamID ascending). (default "stream-asc")
  -dataobj-consumer.distributor.excluded-zones value
    	Comma-separated list of zones to exclude from the ring. Instances in excluded zones will be filtered out from the ring.
  -dataobj-consumer.distributor.replication-factor int
    	The number of ingesters to write to and read from. (default 3)
  -dataobj-consumer.distributor.zone-awareness-enabled
    	True to enable the zone-awareness and replicate ingested samples across different availability zones.
  -dataobj-consumer.enable-inet6
    	Enable IPv6 support. Required to make use of IP addresses from IPv6 interfaces.
  -dataobj-consumer.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -dataobj-consumer.etcd.endpoints value
    	The etcd endpoints to connect to.
  -dataobj-consumer.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -dataobj-consumer.etcd.password value
    	Etcd password.
  -dataobj-consumer.etcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -dataobj-consumer.etcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -dataobj-consumer.etcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -dataobj-consumer.etcd.tls-enabled
    	Enable TLS.
  -dataobj-consumer.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -dataobj-consumer.etcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -dataobj-consumer.etcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -dataobj-consumer.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -dataobj-consumer.etcd.username string
    	Etcd username.
  -dataobj-consumer.final-sleep duration
    	Duration to sleep for before exiting, to ensure metrics are scraped.
  -dataobj-consumer.heartbeat-period duration
    	Period at which to heartbeat to consul. (default 5s)
  -dataobj-consumer.heartbeat-timeout duration
    	Heartbeat timeout after which instance is assumed to be unhealthy. (default 1m0s)
  -dataobj-consumer.idle-flush-timeout duration
    	The maximum amount of time to wait in seconds before flushing an object that is no longer receiving new writes. (default 1h0m0s)
  -dataobj-consumer.join-after duration
    	Period to wait for a claim from another member; will join automatically after this.
  -dataobj-consumer.lifecycler.ID string
    	ID to register in the ring. (default "localhost")
  -dataobj-consumer.lifecycler.addr string
    	IP address to advertise in the ring.
  -dataobj-consumer.lifecycler.interface value
    	Name of network interface to read address from. (default [eth0 en0])
  -dataobj-consumer.lifecycler.port int
    	port to advertise in consul (defaults to server.grpc-listen-port).
  -dataobj-consumer.max-builder-age duration
    	The maximum amount of time to accumulate data in a builder before flushing it. Defaults to 1 hour. (default 1h0m0s)
  -dataobj-consumer.max-page-rows int
    	The maximum row count for pages to use for the data object builder. A value of 0 means no limit.
  -dataobj-consumer.min-ready-duration duration
    	Minimum duration to wait after the internal readiness checks have passed but before succeeding the readiness endpoint. This is used to slowdown deployment controllers (eg. Kubernetes) after an instance is ready and before they proceed with a rolling update, to give the rest of the cluster instances enough time to receive ring updates. (default 15s)
  -dataobj-consumer.multi.mirror-enabled
    	Mirror writes to the secondary store.
  -dataobj-consumer.multi.mirror-timeout duration
    	Timeout for storing a value to the secondary store. (default 2s)
  -dataobj-consumer.multi.primary string
    	Primary backend storage used by multi-client.
  -dataobj-consumer.multi.secondary string
    	Secondary backend storage used by multi-client.
  -dataobj-consumer.num-tokens int
    	Number of tokens for each ingester. (default 128)
  -dataobj-consumer.observe-period duration
    	Observe tokens after generating to resolve collisions. Useful when using gossiping ring.
  -dataobj-consumer.partition-ring.consul.acl-token value
    	ACL Token used to interact with Consul.
  -dataobj-consumer.partition-ring.consul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -dataobj-consumer.partition-ring.consul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -dataobj-consumer.partition-ring.consul.consistent-reads
    	Enable consistent reads to Consul.
  -dataobj-consumer.partition-ring.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -dataobj-consumer.partition-ring.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -dataobj-consumer.partition-ring.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -dataobj-consumer.partition-ring.delete-inactive-partition-after duration
    	How long to wait before an INACTIVE partition is eligible for deletion. The partition is deleted only if it has been in INACTIVE state for at least the configured duration and it has no owners registered. A value of 0 disables partitions deletion. (default 13h0m0s)
  -dataobj-consumer.partition-ring.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -dataobj-consumer.partition-ring.etcd.endpoints value
    	The etcd endpoints to connect to.
  -dataobj-consumer.partition-ring.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -dataobj-consumer.partition-ring.etcd.password value
    	Etcd password.
  -dataobj-consumer.partition-ring.etcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -dataobj-consumer.partition-ring.etcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -dataobj-consumer.partition-ring.etcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -dataobj-consumer.partition-ring.etcd.tls-enabled
    	Enable TLS.
  -dataobj-consumer.partition-ring.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -dataobj-consumer.partition-ring.etcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -dataobj-consumer.partition-ring.etcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -dataobj-consumer.partition-ring.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -dataobj-consumer.partition-ring.etcd.username string
    	Etcd username.
  -dataobj-consumer.partition-ring.min-partition-owners-count int
    	Minimum number of owners to wait before a PENDING partition gets switched to ACTIVE. (default 1)
  -dataobj-consumer.partition-ring.min-partition-owners-duration duration
    	How long the minimum number of owners are enforced before a PENDING partition gets switched to ACTIVE. (default 10s)
  -dataobj-consumer.partition-ring.multi.mirror-enabled
    	Mirror writes to the secondary store.
  -dataobj-consumer.partition-ring.multi.mirror-timeout duration
    	Timeout for storing a value to the secondary store. (default 2s)
  -dataobj-consumer.partition-ring.multi.primary string
    	Primary backend storage used by multi-client.
  -dataobj-consumer.partition-ring.multi.secondary string
    	Secondary backend storage used by multi-client.
  -dataobj-consumer.partition-ring.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -dataobj-consumer.partition-ring.shuffle-shard-cache-size int
    	Experimental: The size of the cache used for shuffle sharding. If zero or negative, an unbounded cache is used. If positive, an LRU cache with the specified size is used.
  -dataobj-consumer.partition-ring.store string
    	Backend storage to use for the ring. Supported values are: consul, etcd, inmemory, memberlist, multi. (default "memberlist")
  -dataobj-consumer.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -dataobj-consumer.readiness-check-ring-health
    	When enabled the readiness probe succeeds only after all instances are ACTIVE and healthy in the ring, otherwise only the instance itself is checked. This option should be disabled if in your cluster multiple instances can be rolled out simultaneously, otherwise rolling updates may be slowed down. (default true)
  -dataobj-consumer.ring.heartbeat-timeout duration
    	The heartbeat timeout after which ingesters are skipped for reads/writes. (default 1m0s)
  -dataobj-consumer.section-stripe-merge-limit int
    	The maximum number of dataobj section stripes to merge into a section at once. Must be greater than 1. (default 2)
  -dataobj-consumer.sha-prefix-size int
    	The size of the SHA prefix to use for generating object storage keys for data objects. (default 2)
  -dataobj-consumer.store string
    	Backend storage to use for the ring. Supported values are: consul, etcd, inmemory, memberlist, multi. (default "consul")
  -dataobj-consumer.target-builder-memory-limit value
    	The target maximum size of the encoded object and all of its encoded sections (after compression), to limit memory usage of a builder. (default 1GiB)
  -dataobj-consumer.target-page-size value
    	The target maximum amount of uncompressed data to hold in data pages (for columnar sections). Uncompressed size is used for consistent I/O and planning. (default 2MiB)
  -dataobj-consumer.target-section-size value
    	The target maximum amount of uncompressed data to hold in sections, for sections that support being limited by size. Uncompressed size is used for consistent I/O and planning. (default 128MiB)
  -dataobj-consumer.tokens-file-path string
    	File path where tokens are stored. If empty, tokens are not stored at shutdown and restored at startup.
  -dataobj-consumer.topic string
    	The name of the Kafka topic.
  -dataobj-consumer.unregister-on-shutdown
    	Unregister from the ring upon clean shutdown. It can be useful to disable for rolling restarts with consistent naming in conjunction with -distributor.extend-writes=false. (default true)
  -dataobj-index-builder.buffer-size value
    	The size of logs to buffer in memory before adding into columnar builders, used to reduce CPU load of sorting. (default 2MiB)
  -dataobj-index-builder.events-per-index int
    	Experimental: The number of events to batch before building an index (default 32)
  -dataobj-index-builder.flush-interval duration
    	Experimental: How often to check for stale partitions to flush (default 1m0s)
  -dataobj-index-builder.max-idle-time duration
    	Experimental: Maximum time to wait before flushing buffered events (default 30m0s)
  -dataobj-index-builder.max-page-rows int
    	The maximum row count for pages to use for the data object builder. A value of 0 means no limit.
  -dataobj-index-builder.section-stripe-merge-limit int
    	The maximum number of dataobj section stripes to merge into a section at once. Must be greater than 1. (default 2)
  -dataobj-index-builder.target-builder-memory-limit value
    	The target maximum size of the encoded object and all of its encoded sections (after compression), to limit memory usage of a builder. (default 64MiB)
  -dataobj-index-builder.target-page-size value
    	The target maximum amount of uncompressed data to hold in data pages (for columnar sections). Uncompressed size is used for consistent I/O and planning. (default 128KiB)
  -dataobj-index-builder.target-section-size value
    	The target maximum amount of uncompressed data to hold in sections, for sections that support being limited by size. Uncompressed size is used for consistent I/O and planning. (default 16MiB)
  -dataobj-metastore.index-storage-prefix string
    	Experimental: A prefix to use for storing indexes in object storage. Used for testing only. (default "index/v0")
  -dataobj-metastore.partition-ratio int
    	Experimental: The ratio of log partitions to metastore partitions. For example, a value of 10 means there is 1 metastore partition for every 10 log partitions. (default 10)
  -dataobj-storage-bucket-prefix string
    	The prefix to use for the storage bucket. (default "dataobj/")
  -dataobj.enabled
    	Enable data objects.
  -distributor.client-cleanup-period duration
    	How frequently to clean up clients for ingesters that have gone away. (default 15s)
  -distributor.dataobj-tee.debug-metrics-enabled
    	Enables optional debug metrics.
  -distributor.dataobj-tee.enabled
    	Enable data object tee.
  -distributor.dataobj-tee.max-buffered-bytes int
    	Maximum number of bytes to buffer. (default 104857600)
  -distributor.dataobj-tee.per-partition-rate-bytes int
    	The per-tenant partition rate (bytes/sec). (default 1048576)
  -distributor.dataobj-tee.rate-batch-window duration
    	Duration to accumulate rate updates before sending to limits frontend. Set to 0 to disable batching.
  -distributor.dataobj-tee.topic string
    	Topic for data object tee.
  -distributor.excluded-zones value
    	Comma-separated list of zones to exclude from the ring. Instances in excluded zones will be filtered out from the ring.
  -distributor.health-check-ingesters
    	Run a health check on each ingester client during periodic cleanup. (default true)
  -distributor.ingest-limits-dry-run-enabled
    	Enable dry-run mode where limits are checked the ingest-limits service, but not enforced. Defaults to false.
  -distributor.ingest-limits-enabled
    	Enable checking limits against the ingest-limits service. Defaults to false.
  -distributor.ingester-writes-enabled
    	Enable writes to Ingesters during Push requests. Defaults to true. (default true)
  -distributor.ingestion-burst-size-mb float
    	Per-user allowed ingestion burst size (in sample size). Units in MB. The burst size refers to the per-distributor local rate limiter even in the case of the 'global' strategy, and should be set at least to the maximum logs size expected in a single push request. (default 6)
  -distributor.ingestion-rate-limit-mb float
    	Per-user ingestion rate limit in sample size per second. Sample size includes size of the logs line and the size of structured metadata labels. Units in MB. (default 4)
  -distributor.ingestion-rate-limit-strategy string
    	Whether the ingestion rate limit should be applied individually to each distributor instance (local), or evenly shared across the cluster (global). The ingestion rate strategy cannot be overridden on a per-tenant basis.
    	- local: enforces the limit on a per distributor basis. The actual effective rate limit will be N times higher, where N is the number of distributor replicas.
    	- global: enforces the limit globally, configuring a per-distributor local rate limiter as 'ingestion_rate / N', where N is the number of distributor replicas (it's automatically adjusted if the number of replicas change). The global strategy requires the distributors to form their own ring, which is used to keep track of the current number of healthy distributor replicas. (default "global")
  -distributor.kafka-writes-enabled
    	Enable writes to Kafka during Push requests.
  -distributor.max-decompressed-size int
    	The maximum size of a decompressed message. Defaults to 50x max-recv-msg-size. (default 5242880000)
  -distributor.max-line-size distributor.max-line-size-truncate
    	Maximum line size on ingestion path. Example: 256kb. Any log line exceeding this limit will be discarded unless distributor.max-line-size-truncate is set, in which case it is truncated rather than discarded completely. There is no limit when set to 0. (default 256KB)
  -distributor.max-line-size-truncate
    	Whether to truncate lines that exceed max_line_size.
  -distributor.max-line-size-truncate-identifier string
    	Identifier that is added at the end of a truncated log line.
  -distributor.max-recv-msg-size int
    	The maximum size of a received message. (default 104857600)
  -distributor.otlp.default_resource_attributes_as_index_labels value
    	List of default otlp resource attributes to be picked as index labels (default [service.name service.namespace service.instance.id deployment.environment deployment.environment.name cloud.region cloud.availability_zone k8s.cluster.name k8s.namespace.name k8s.pod.name k8s.container.name container.name k8s.replicaset.name k8s.deployment.name k8s.statefulset.name k8s.daemonset.name k8s.cronjob.name k8s.job.name])
  -distributor.push-worker-count int
    	Number of workers to push batches to ingesters. (default 256)
  -distributor.rate-store.debug
    	If enabled, detailed logs and spans will be emitted.
  -distributor.rate-store.ingester-request-timeout duration
    	Timeout for communication between distributors and any given ingester when updating rates (default 500ms)
  -distributor.rate-store.max-request-parallelism int
    	The max number of concurrent requests to make to ingester stream apis (default 200)
  -distributor.rate-store.stream-rate-update-interval duration
    	The interval on which distributors will update current stream rates from ingesters (default 1s)
  -distributor.remote-timeout duration
    	Timeout for the health check. (default 1s)
  -distributor.replication-factor int
    	The number of ingesters to write to and read from. (default 3)
  -distributor.ring.consul.acl-token value
    	ACL Token used to interact with Consul.
  -distributor.ring.consul.cas-retry-delay duration
    	Maximum duration to wait before retrying a Compare And Swap (CAS) operation. (default 1s)
  -distributor.ring.consul.client-timeout duration
    	HTTP timeout when talking to Consul (default 20s)
  -distributor.ring.consul.consistent-reads
    	Enable consistent reads to Consul.
  -distributor.ring.consul.hostname string
    	Hostname and port of Consul. (default "localhost:8500")
  -distributor.ring.consul.watch-burst-size int
    	Burst size used in rate limit. Values less than 1 are treated as 1. (default 1)
  -distributor.ring.consul.watch-rate-limit float
    	Rate limit when watching key or prefix in Consul, in requests per second. 0 disables the rate limit. (default 1)
  -distributor.ring.etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -distributor.ring.etcd.endpoints value
    	The etcd endpoints to connect to.
  -distributor.ring.etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -distributor.ring.etcd.password value
    	Etcd password.
  -distributor.ring.etcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -distributor.ring.etcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -distributor.ring.etcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -distributor.ring.etcd.tls-enabled
    	Enable TLS.
  -distributor.ring.etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -distributor.ring.etcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -distributor.ring.etcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -distributor.ring.etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -distributor.ring.etcd.username string
    	Etcd username.
  -distributor.ring.heartbeat-period duration
    	Period at which to heartbeat to the ring. (default 5s)
  -distributor.ring.heartbeat-timeout duration
    	The heartbeat timeout after which distributors are considered unhealthy within the ring. 0 = never (timeout disabled). (default 1m0s)
  -distributor.ring.instance-addr string
    	IP address to advertise in the ring.
  -distributor.ring.instance-enable-ipv6
    	Enable using a IPv6 instance address.
  -distributor.ring.instance-id string
    	Instance ID to register in the ring. (default "localhost")
  -distributor.ring.instance-interface-names value
    	Name of network interface to read address from. (default [eth0 en0])
  -distributor.ring.instance-port int
    	Port to advertise in the ring (defaults to server.grpc-listen-port).
  -distributor.ring.multi.mirror-enabled
    	Mirror writes to the secondary store.
  -distributor.ring.multi.mirror-timeout duration
    	Timeout for storing a value to the secondary store. (default 2s)
  -distributor.ring.multi.primary string
    	Primary backend storage used by multi-client.
  -distributor.ring.multi.secondary string
    	Secondary backend storage used by multi-client.
  -distributor.ring.prefix string
    	The prefix for the keys in the store. Should end with a /. (default "collectors/")
  -distributor.ring.store string
    	Backend storage to use for the ring. Supported values are: consul, etcd, inmemory, memberlist, multi. (default "consul")
  -distributor.write-failures-logging.add-insights-label
    	Whether a insight=true key should be logged or not. Default: false.
  -distributor.write-failures-logging.rate value
    	Log volume allowed (per second). Default: 1KB. (default 1KB)
  -distributor.zone-awareness-enabled
    	True to enable the zone-awareness and replicate ingested samples across different availability zones.
  -dynamodb.api-limit float
    	DynamoDB table management requests per second limit. (default 2)
  -dynamodb.chunk-gang-size int
    	Number of chunks to group together to parallelise fetches (zero to disable) (default 10)
  -dynamodb.chunk.get-max-parallelism int
    	Max number of chunk-get operations to start in parallel (default 32)
  -dynamodb.kms-key-id string
    	KMS key used for encrypting DynamoDB items.  DynamoDB will use an Amazon owned KMS key if not provided.
  -dynamodb.max-backoff duration
    	Maximum backoff time (default 50s)
  -dynamodb.max-retries int
    	Maximum number of times to retry an operation (default 20)
  -dynamodb.min-backoff duration
    	Minimum backoff time (default 100ms)
  -dynamodb.throttle-limit float
    	DynamoDB rate cap to back off when throttled. (default 10)
  -dynamodb.url value
    	DynamoDB endpoint URL with escaped Key and Secret encoded. If only region is specified as a host, proper endpoint will be deduced. Use inmemory:///<table-name> to use a mock in-memory implementation.
  -etcd.dial-timeout duration
    	The dial timeout for the etcd connection. (default 10s)
  -etcd.endpoints value
    	The etcd endpoints to connect to.
  -etcd.max-retries int
    	The maximum number of retries to do for failed ops. (default 10)
  -etcd.password value
    	Etcd password.
  -etcd.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -etcd.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -etcd.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -etcd.tls-enabled
    	Enable TLS.
  -etcd.tls-insecure-skip-verify
    	Skip validating server certificate.
  -etcd.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -etcd.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -etcd.tls-server-name string
    	Override the expected name on the server certificate.
  -etcd.username string
    	Etcd username.
  -experimental.querier.recent-metadata-query-window split_recent_metadata_queries_by_interval
    	Experimental. Metadata query window inside which split_recent_metadata_queries_by_interval gets applied, portion of the metadata request that falls in this window is split using `split_recent_metadata_queries_by_interval`. The value 0 disables using a different split interval for recent metadata queries.

    	This is added to improve cacheability of recent metadata queries. Query split interval also determines the interval used in cache key. The default split interval of 24h is useful for caching long queries, each cache key holding 1 day's results. But metadata queries are often shorter than 24h, to cache them effectively we need a smaller split interval. `recent_metadata_query_window` along with `split_recent_metadata_queries_by_interval` help configure a shorter split interval for recent metadata queries.
  -experimental.querier.split-recent-metadata-queries-by-interval recent_metadata_query_window
    	Experimental. Split interval to use for the portion of metadata request that falls within recent_metadata_query_window. Rest of the request which is outside the window still uses `split_metadata_queries_by_interval`. If set to 0, the entire request defaults to using a split interval of `split_metadata_queries_by_interval.`. (default 1h)
  -frontend.background.write-back-buffer int
    	How many key batches to buffer for background write-back. Default is large to prefer size based limiting. (default 500000)
  -frontend.background.write-back-concurrency int
    	At what concurrency to write back to cache. (default 1)
  -frontend.background.write-back-size-limit value
    	Size limit in bytes for background write-back. (default 500MB)
  -frontend.compression string
    	Use compression in cache. The default is an empty value '', which disables compression. Supported values are: 'snappy' and ''.
  -frontend.default-validity duration
    	The default validity of entries for caches unless overridden. (default 1h0m0s)
  -frontend.downstream-url string
    	URL of downstream Loki.
  -frontend.embedded-cache.enabled
    	Whether embedded cache is enabled.
  -frontend.embedded-cache.max-size-items int
    	Maximum number of entries in the cache.
  -frontend.embedded-cache.max-size-mb int
    	Maximum memory size of the cache in MB. (default 100)
  -frontend.embedded-cache.ttl duration
    	The time to live for items in the cache before they get purged. (default 1h0m0s)
  -frontend.encoding string
    	Defines the encoding for requests to and responses from the scheduler and querier. Can be 'json' or 'protobuf' (defaults to 'json'). (default "json")
  -frontend.graceful-shutdown-timeout duration
    	Time to wait for inflight requests to finish before forcefully shutting down. This needs to be aligned with the query timeout and the graceful termination period of the process orchestrator. (default 5m0s)
  -frontend.grpc-client-config.backoff-max-period duration
    	Maximum delay when backing off. (default 10s)
  -frontend.grpc-client-config.backoff-min-period duration
    	Minimum delay when backing off. (default 100ms)
  -frontend.grpc-client-config.backoff-on-ratelimits
    	Enable backoff and retry when we hit rate limits.
  -frontend.grpc-client-config.backoff-retries int
    	Number of times to backoff and retry before failing. (default 10)
  -frontend.grpc-client-config.cluster-validation.label string
    	Primary cluster validation label.
  -frontend.grpc-client-config.connect-backoff-base-delay duration
    	Initial backoff delay after first connection failure. Only relevant if ConnectTimeout > 0. (default 1s)
  -frontend.grpc-client-config.connect-backoff-max-delay duration
    	Maximum backoff delay when establishing a connection. Only relevant if ConnectTimeout > 0. (default 5s)
  -frontend.grpc-client-config.connect-timeout duration
    	The maximum amount of time to establish a connection. A value of 0 means default gRPC client connect timeout and backoff. (default 5s)
  -frontend.grpc-client-config.grpc-client-rate-limit float
    	Rate limit for gRPC client; 0 means disabled.
  -frontend.grpc-client-config.grpc-client-rate-limit-burst int
    	Rate limit burst for gRPC client.
  -frontend.grpc-client-config.grpc-compression string
    	Use compression when sending messages. Supported values are: 'gzip', 'snappy' and '' (disable compression)
  -frontend.grpc-client-config.grpc-max-recv-msg-size int
    	gRPC client max receive message size (bytes). (default 104857600)
  -frontend.grpc-client-config.grpc-max-send-msg-size int
    	gRPC client max send message size (bytes). (default 104857600)
  -frontend.grpc-client-config.initial-connection-window-size value
    	Initial connection window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -frontend.grpc-client-config.initial-stream-window-size value
    	Initial stream window size. Values less than the default are not supported and are ignored. Setting this to a value other than the default disables the BDP estimator. (default 63KiB1023B)
  -frontend.grpc-client-config.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -frontend.grpc-client-config.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -frontend.grpc-client-config.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -frontend.grpc-client-config.tls-enabled
    	Enable TLS in the gRPC client. This flag needs to be enabled when any other TLS flag is set. If set to false, insecure connection to gRPC server will be used.
  -frontend.grpc-client-config.tls-insecure-skip-verify
    	Skip validating server certificate.
  -frontend.grpc-client-config.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -frontend.grpc-client-config.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -frontend.grpc-client-config.tls-server-name string
    	Override the expected name on the server certificate.
  -frontend.index-stats-results-cache.background.write-back-buffer int
    	How many key batches to buffer for background write-back. Default is large to prefer size based limiting. (default 500000)
  -frontend.index-stats-results-cache.background.write-back-concurrency int
    	At what concurrency to write back to cache. (default 1)
  -frontend.index-stats-results-cache.background.write-back-size-limit value
    	Size limit in bytes for background write-back. (default 500MB)
  -frontend.index-stats-results-cache.compression string
    	Use compression in cache. The default is an empty value '', which disables compression. Supported values are: 'snappy' and ''.
  -frontend.index-stats-results-cache.default-validity duration
    	The default validity of entries for caches unless overridden. (default 1h0m0s)
  -frontend.index-stats-results-cache.embedded-cache.enabled
    	Whether embedded cache is enabled.
  -frontend.index-stats-results-cache.embedded-cache.max-size-items int
    	Maximum number of entries in the cache.
  -frontend.index-stats-results-cache.embedded-cache.max-size-mb int
    	Maximum memory size of the cache in MB. (default 100)
  -frontend.index-stats-results-cache.embedded-cache.ttl duration
    	The time to live for items in the cache before they get purged. (default 1h0m0s)
  -frontend.index-stats-results-cache.memcached.addresses string
    	Comma separated addresses list in DNS Service Discovery format: https://grafana.com/docs/mimir/latest/configure/about-dns-service-discovery/#supported-discovery-modes
  -frontend.index-stats-results-cache.memcached.batchsize int
    	How many keys to fetch in each batch. (default 4)
  -frontend.index-stats-results-cache.memcached.circuit-breaker-consecutive-failures uint
    	Trip circuit-breaker after this number of consecutive dial failures (if zero then circuit-breaker is disabled). (default 10)
  -frontend.index-stats-results-cache.memcached.circuit-breaker-interval duration
    	Reset circuit-breaker counts after this long (if zero then never reset). (default 10s)
  -frontend.index-stats-results-cache.memcached.circuit-breaker-timeout duration
    	Duration circuit-breaker remains open after tripping (if zero then 60 seconds is used). (default 10s)
  -frontend.index-stats-results-cache.memcached.consistent-hash
    	Use consistent hashing to distribute to memcache servers. (default true)
  -frontend.index-stats-results-cache.memcached.expiration duration
    	How long keys stay in the memcache.
  -frontend.index-stats-results-cache.memcached.hostname string
    	Hostname for memcached service to use. If empty and if addresses is unset, no memcached will be used.
  -frontend.index-stats-results-cache.memcached.max-idle-conns int
    	Maximum number of idle connections in pool. (default 16)
  -frontend.index-stats-results-cache.memcached.max-item-size int
    	The maximum size of an item stored in memcached. Bigger items are not stored. If set to 0, no maximum size is enforced.
  -frontend.index-stats-results-cache.memcached.parallelism int
    	Maximum active requests to memcache. (default 5)
  -frontend.index-stats-results-cache.memcached.service string
    	SRV service used to discover memcache servers. (default "memcached")
  -frontend.index-stats-results-cache.memcached.timeout duration
    	Maximum time to wait before giving up on memcached requests. (default 100ms)
  -frontend.index-stats-results-cache.memcached.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -frontend.index-stats-results-cache.memcached.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -frontend.index-stats-results-cache.memcached.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -frontend.index-stats-results-cache.memcached.tls-enabled
    	Enable connecting to Memcached with TLS.
  -frontend.index-stats-results-cache.memcached.tls-insecure-skip-verify
    	Skip validating server certificate.
  -frontend.index-stats-results-cache.memcached.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -frontend.index-stats-results-cache.memcached.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -frontend.index-stats-results-cache.memcached.tls-server-name string
    	Override the expected name on the server certificate.
  -frontend.index-stats-results-cache.memcached.update-interval duration
    	Period with which to poll DNS for memcache servers. (default 1m0s)
  -frontend.index-stats-results-cache.redis.db int
    	Database index.
  -frontend.index-stats-results-cache.redis.endpoint string
    	Redis Server or Cluster configuration endpoint to use for caching. A comma-separated list of endpoints for Redis Cluster or Redis Sentinel. If empty, no redis will be used.
  -frontend.index-stats-results-cache.redis.expiration duration
    	How long keys stay in the redis.
  -frontend.index-stats-results-cache.redis.idle-timeout duration
    	Close connections after remaining idle for this duration. If the value is zero, then idle connections are not closed.
  -frontend.index-stats-results-cache.redis.master-name string
    	Redis Sentinel master name. An empty string for Redis Server or Redis Cluster.
  -frontend.index-stats-results-cache.redis.max-connection-age duration
    	Close connections older than this duration. If the value is zero, then the pool does not close connections based on age.
  -frontend.index-stats-results-cache.redis.password value
    	Password to use when connecting to redis.
  -frontend.index-stats-results-cache.redis.pool-size int
    	Maximum number of connections in the pool.
  -frontend.index-stats-results-cache.redis.route-randomly
    	By default, the Redis client only reads from the master node. Enabling this option can lower pressure on the master node by randomly routing read-only commands to the master and any available replicas.
  -frontend.index-stats-results-cache.redis.timeout duration
    	Maximum time to wait before giving up on redis requests. (default 500ms)
  -frontend.index-stats-results-cache.redis.tls-enabled
    	Enable connecting to redis with TLS.
  -frontend.index-stats-results-cache.redis.tls-insecure-skip-verify
    	Skip validating server certificate.
  -frontend.index-stats-results-cache.redis.username string
    	Username to use when connecting to redis.
  -frontend.instance-addr string
    	IP address to advertise to querier (via scheduler) (resolved via interfaces by default).
  -frontend.instance-enable-ipv6
    	Enable using a IPv6 instance address (default false).
  -frontend.instance-interface-names value
    	Name of network interface to read address from. This address is sent to query-scheduler and querier, which uses it to send the query response back to query-frontend. (default [eth0 en0])
  -frontend.instance-port int
    	Port to advertise to querier (via scheduler) (defaults to server.grpc-listen-port).
  -frontend.instant-metric-results-cache.background.write-back-buffer int
    	How many key batches to buffer for background write-back. Default is large to prefer size based limiting. (default 500000)
  -frontend.instant-metric-results-cache.background.write-back-concurrency int
    	At what concurrency to write back to cache. (default 1)
  -frontend.instant-metric-results-cache.background.write-back-size-limit value
    	Size limit in bytes for background write-back. (default 500MB)
  -frontend.instant-metric-results-cache.compression string
    	Use compression in cache. The default is an empty value '', which disables compression. Supported values are: 'snappy' and ''.
  -frontend.instant-metric-results-cache.default-validity duration
    	The default validity of entries for caches unless overridden. (default 1h0m0s)
  -frontend.instant-metric-results-cache.embedded-cache.enabled
    	Whether embedded cache is enabled.
  -frontend.instant-metric-results-cache.embedded-cache.max-size-items int
    	Maximum number of entries in the cache.
  -frontend.instant-metric-results-cache.embedded-cache.max-size-mb int
    	Maximum memory size of the cache in MB. (default 100)
  -frontend.instant-metric-results-cache.embedded-cache.ttl duration
    	The time to live for items in the cache before they get purged. (default 1h0m0s)
  -frontend.instant-metric-results-cache.memcached.addresses string
    	Comma separated addresses list in DNS Service Discovery format: https://grafana.com/docs/mimir/latest/configure/about-dns-service-discovery/#supported-discovery-modes
  -frontend.instant-metric-results-cache.memcached.batchsize int
    	How many keys to fetch in each batch. (default 4)
  -frontend.instant-metric-results-cache.memcached.circuit-breaker-consecutive-failures uint
    	Trip circuit-breaker after this number of consecutive dial failures (if zero then circuit-breaker is disabled). (default 10)
  -frontend.instant-metric-results-cache.memcached.circuit-breaker-interval duration
    	Reset circuit-breaker counts after this long (if zero then never reset). (default 10s)
  -frontend.instant-metric-results-cache.memcached.circuit-breaker-timeout duration
    	Duration circuit-breaker remains open after tripping (if zero then 60 seconds is used). (default 10s)
  -frontend.instant-metric-results-cache.memcached.consistent-hash
    	Use consistent hashing to distribute to memcache servers. (default true)
  -frontend.instant-metric-results-cache.memcached.expiration duration
    	How long keys stay in the memcache.
  -frontend.instant-metric-results-cache.memcached.hostname string
    	Hostname for memcached service to use. If empty and if addresses is unset, no memcached will be used.
  -frontend.instant-metric-results-cache.memcached.max-idle-conns int
    	Maximum number of idle connections in pool. (default 16)
  -frontend.instant-metric-results-cache.memcached.max-item-size int
    	The maximum size of an item stored in memcached. Bigger items are not stored. If set to 0, no maximum size is enforced.
  -frontend.instant-metric-results-cache.memcached.parallelism int
    	Maximum active requests to memcache. (default 5)
  -frontend.instant-metric-results-cache.memcached.service string
    	SRV service used to discover memcache servers. (default "memcached")
  -frontend.instant-metric-results-cache.memcached.timeout duration
    	Maximum time to wait before giving up on memcached requests. (default 100ms)
  -frontend.instant-metric-results-cache.memcached.tls-ca-path string
    	Path to the CA certificates to validate server certificate against. If not set, the host's root CA certificates are used.
  -frontend.instant-metric-results-cache.memcached.tls-cert-path string
    	Path to the client certificate, which will be used for authenticating with the server. Also requires the key path to be configured.
  -frontend.instant-metric-results-cache.memcached.tls-cipher-suites string
    	Override the default cipher suite list (separated by commas).
  -frontend.instant-metric-results-cache.memcached.tls-enabled
    	Enable connecting to Memcached with TLS.
  -frontend.instant-metric-results-cache.memcached.tls-insecure-skip-verify
    	Skip validating server certificate.
  -frontend.instant-metric-results-cache.memcached.tls-key-path string
    	Path to the key for the client certificate. Also requires the client certificate to be configured.
  -frontend.instant-metric-results-cache.memcached.tls-min-version string
    	Override the default minimum TLS version. Allowed values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13
  -frontend.instant-metric-results-cache.memcached.tls-server-name string
    	Override the expected name on the server certificate.
  -frontend.instant-metric-results-cache.memcached.update-interval duration
    	Period with which to poll DNS for memcache servers. (default 1m0s)
  -frontend.instant-metric-results-cache.redis.db int
    	Database index.
  -frontend.instant-metric-results-cache.redis.endpoint string
    	Redis Server or Cluster configuration endpoint to use for caching. A comma-separated list of endpoints for Redis Cluster or Redis Sentinel. If empty, no redis will be used.
  -frontend.instant-metric-results-cache.redis.expiration duration
    	How long keys stay in the redis.
  -frontend.instant-metric-results-cache.redis.idle-timeout duration
    	Close connections after remaining idle for this duration. If the value is zero, then idle connections are not closed.
  -frontend.instant-metric-results-cache.redis.master-name string
    	Redis Sentinel master name. An empty string for Redis Server or Redis Cluster.
  -frontend.instant-metric-results-cache.redis.max-connection-age duration
    	Close connections older than this duration. If the value is zero, then the pool does not close connections based on age.
  -frontend.instant-metric-results-cache.redis.password value
    	Password to use when connecting to redis.
  -frontend.instant-metric-results-cache.redis.pool-size int
    	Maximum number of connections in the pool.
  -frontend.instant-metric-results-cache.redis.route-randomly
    	By default, the Redis client only reads from the master node. Enabling this option can lower pressure on the master node by randomly routing read-only commands to the master and any available replicas.
  -frontend.instant-metric-results-cache.redis.timeout duration
    	Maximum time to wait before giving up on redis requests. (default 500ms)
  -frontend.instant-metric-results-cache.redis.tls-enabled
    	Enable connecting to redis with TLS.
  -frontend.instant-metric-results-cache.redis.tls-insecure-skip-verify
    	Skip validating server certificate.
  -frontend.instant-metric-results-cache.redis.username string
    	Username to use when connecting to redis.
  -frontend.label-results-cache.background.write-back-buffer int
    	How many key batches to buffer for background write-back. Default is large to prefer size based limiting. (default 500000)
  -frontend.label-results-cache.background.write-back-concurrency int
    	At what concurrency to write back to cache. (default 1)
  -frontend.label-results-cache.background.write-back-size-limit value
[truncated]