InfluxDB 3 Enterprise configuration options

InfluxDB 3 Enterprise lets you customize your configuration by using influxdb3 command options or by setting environment variables.

Configure your server

Pass configuration options using either command options or environment variables. Command options take precedence over environment variables.

Global vs serve-specific options

Some options are global (specified before the command) while others are serve-specific (specified after serve):

• Global options: Apply to the influxdb3 CLI itself (for example, --num-io-threads)
• Serve options: Apply only to the serve command (for example, --node-id, --object-store, --verbose)

Example command with global and serve-specific options

Example environment variables

export INFLUXDB3_NODE_IDENTIFIER_PREFIX=my-node
export INFLUXDB3_OBJECT_STORE=file
export INFLUXDB3_DB_DIR=~/.influxdb3
export LOG_FILTER=info

influxdb3 serve

Global configuration options

The following options apply to the influxdb3 CLI globally and must be specified before any subcommand (for example, serve):

num-io-threads

Sets the number of threads allocated to the IO runtime thread pool. IO threads handle HTTP request serving, line protocol parsing, and file operations.

# Set IO threads (global option before serve)
influxdb3 --num-io-threads=8 serve --node-id=node0 --object-store=file

Server configuration options

• General

• Security

• AWS

• Google Cloud Service

• Microsoft Azure

• Object Storage

• Logs

• Traces

• DataFusion

• HTTP

• Memory

• Write-Ahead Log (WAL)

• Compaction

• Caching

• Processing Engine

• Resource Limits

• Data Lifecycle Management

• Telemetry

• TCP Listeners

General

• data-dir

• node-id

• object-store

• query-file-limit

data-dir

For the file object store, defines the location InfluxDB 3 Enterprise uses to store files locally. Required when using the file object store.

node-id

Specifies the node identifier used as a prefix in all object store file paths. This should be unique for any hosts sharing the same object store configuration–for example, the same bucket.

object-store

Specifies which object storage to use to store Parquet files. This option supports the following values:

• memory: Effectively no object persistence
• memory-throttled: Like memory but with latency and throughput that somewhat resembles a cloud object store
• file: Stores objects in the local filesystem (must also set --data-dir)
• s3: Amazon S3 (must also set --bucket, --aws-access-key-id, --aws-secret-access-key, and possibly --aws-default-region)
• google: Google Cloud Storage (must also set --bucket and --google-service-account)
• azure: Microsoft Azure blob storage (must also set --bucket, --azure-storage-account, and --azure-storage-access-key)

Security

• tls-key
• tls-cert
• tls-minimum-versions
• without-auth
• disable-authz
• admin-token-recovery-http-bind
• admin-token-file

tls-key

The path to a key file for TLS to be enabled.

tls-cert

The path to a cert file for TLS to be enabled.

tls-minimum-version

The minimum version for TLS. Valid values are tls-1.2 or tls-1.3. Default is tls-1.2.

without-auth

Disables authentication for all server actions (CLI commands and API requests). The server processes all requests without requiring tokens or authentication.

disable-authz

Optionally disable authz by passing in a comma separated list of resources. Valid values are health, ping, and metrics.

admin-token-recovery-http-bind

Enables an admin token recovery HTTP server on a separate port. This server allows regenerating lost admin tokens without existing authentication. The server automatically shuts down after a successful token regeneration.

Default: 127.0.0.1:8182 (when enabled)

Example usage

# Start server with recovery endpoint
influxdb3 serve --admin-token-recovery-http-bind

# In another terminal, regenerate the admin token
influxdb3 create token --admin --regenerate --host http://127.0.0.1:8182

admin-token-file

Specifies an offline admin token file to use if no tokens exist when the server starts. Once started, you can interact with the server using the provided token. Offline admin tokens are designed to help with automated deployments.

Offline admin tokens are defined in a JSON-formatted file. Use the following command to generate an offline admin token file:

influxdb3 create token --admin \
  --name "example-admin-token" \
  --expiry 1d \
  --offline \
  --output-file 
./path/to/admin-token.json

{
  "token": "apiv3_0XXXX-xxxXxXxxxXX_OxxxX...",
  "name": "example-admin-token",
  "expiry_millis": 1756400061529
}

Example usage

# Generate an admin token offline
influxdb3 create token \
  --admin \
  --name "example-admin-token" \
  --expiry 1d \
  --offline \
  --output-file 
./path/to/admin-token.json

# Start InfluxDB 3 Enterprise using the generated token
influxdb3 serve --admin-token-file 
./path/to/admin-token.json

AWS

• aws-access-key-id
• aws-secret-access-key
• aws-default-region
• aws-endpoint
• aws-session-token
• aws-allow-http
• aws-skip-signature
• aws-credentials-file

aws-access-key-id

When using Amazon S3 as the object store, set this to an access key that has permission to read from and write to the specified S3 bucket.

aws-secret-access-key

When using Amazon S3 as the object store, set this to the secret access key that goes with the specified access key ID.

aws-default-region

When using Amazon S3 as the object store, set this to the region that goes with the specified bucket if different from the fallback value.

Default: us-east-1

aws-endpoint

When using an Amazon S3 compatibility storage service, set this to the endpoint.

aws-session-token

When using Amazon S3 as an object store, set this to the session token. This is handy when using a federated login or SSO and fetching credentials via the UI.

aws-allow-http

Allows unencrypted HTTP connections to AWS.

aws-skip-signature

If enabled, S3 object stores do not fetch credentials and do not sign requests.

aws-credentials-file

Specifies the path to your S3 credentials file. When using a credentials file, settings in the file override the corresponding CLI flags.

S3 credential files are JSON-formatted and should contain the following:

{
  "aws_access_key_id": "
AWS_ACCESS_KEY_ID
",
  "aws_secret_access_key": "
AWS_SECRET_ACCESS_KEY
",
  "aws_session_token": "
AWS_SESSION_TOKEN
",
  "expiry": "
UNIX_SECONDS_TIMESTAMP
"
}

The aws_session_token and expiry fields are optional. The file is automatically checked for updates at the expiry time or at 1-hour intervals.

If the object store returns an “Unauthenticated” error, InfluxDB will attempt to update its in-memory credentials from this file and then retry the object store request.

Google Cloud Service

• google-service-account

google-service-account

When using Google Cloud Storage as the object store, set this to the path to the JSON file that contains the Google credentials.

Microsoft Azure

• azure-storage-account
• azure-storage-access-key
• azure-endpoint
• azure-allow-http

azure-storage-account

When using Microsoft Azure as the object store, set this to the name you see when navigating to All Services > Storage accounts > [name].

azure-storage-access-key

When using Microsoft Azure as the object store, set this to one of the Key values in the Storage account’s Settings > Access keys.

azure-endpoint

When using Microsoft Azure as the object store, set this to the Azure Blob Storage endpoint.

azure-allow-http

When using Microsoft Azure as the object store, allow unencrypted HTTP requests to Azure Blob Storage.

Default: false

Object Storage

• bucket
• object-store-connection-limit
• object-store-http2-only
• object-store-http2-max-frame-size
• object-store-max-retries
• object-store-retry-timeout
• object-store-cache-endpoint

bucket

Sets the name of the object storage bucket to use. Must also set --object-store to a cloud object storage for this option to take effect.

object-store-connection-limit

When using a network-based object store, limits the number of connections to this value.

Default: 16

object-store-http2-only

Forces HTTP/2 connections to network-based object stores.

object-store-http2-max-frame-size

Sets the maximum frame size (in bytes/octets) for HTTP/2 connections.

object-store-max-retries

Defines the maximum number of times to retry a request.

object-store-retry-timeout

Specifies the maximum length of time from the initial request after which no further retries are be attempted.

object-store-cache-endpoint

Sets the endpoint of an S3-compatible, HTTP/2-enabled object store cache.

Logs

• log-filter
• log-destination
• log-format
• query-log-size

log-filter

Sets the filter directive for logs. Use this option to control the verbosity of server logs globally or for specific components.

Log levels

The following log levels are available (from least to most verbose):

Basic usage

To set the log level globally, pass one of the log levels:

influxdb3 serve --log-filter debug

Targeted filtering

Globally enabling debug or trace produces a high volume of log output. For more targeted debugging, you can set different log levels for specific components using the format <global_level>,<component>=<level>.

Debug write buffer operations

influxdb3 serve --log-filter info,influxdb3_write_buffer=debug

Trace WAL operations

influxdb3 serve --log-filter info,influxdb3_wal=trace

Multiple targeted filters

influxdb3 serve --log-filter info,influxdb3_write_buffer=debug,influxdb3_wal=debug

Common component names

The following are common component names you can use for targeted filtering:

log-destination

Specifies the destination for logs.

This option supports the following values:

• stdout (default)
• stderr

Default: stdout

log-format

Defines the message format for logs.

This option supports the following values:

• full (default)

Default: full

query-log-size

Defines the size of the query log. Up to this many queries remain in the log before older queries are evicted to make room for new ones.

Default: 1000

Traces

• traces-exporter
• traces-exporter-jaeger-agent-host
• traces-exporter-jaeger-agent-port
• traces-exporter-jaeger-service-name
• traces-exporter-jaeger-trace-context-header-name
• traces-jaeger-debug-name
• traces-jaeger-tags
• traces-jaeger-max-msgs-per-second

traces-exporter

Sets the type of tracing exporter.

Default: none

traces-exporter-jaeger-agent-host

Specifies the Jaeger agent network hostname for tracing.

Default: 0.0.0.0

traces-exporter-jaeger-agent-port

Defines the Jaeger agent network port for tracing.

Default: 6831

traces-exporter-jaeger-service-name

Sets the Jaeger service name for tracing.

Default: iox-conductor

traces-exporter-jaeger-trace-context-header-name

Specifies the header name used for passing trace context.

Default: uber-trace-id

traces-jaeger-debug-name

Specifies the header name used for force sampling in tracing.

Default: jaeger-debug-id

traces-jaeger-tags

Defines a set of key=value pairs to annotate tracing spans with.

traces-jaeger-max-msgs-per-second

Specifies the maximum number of messages sent to a Jaeger service per second.

Default: 1000

DataFusion

• datafusion-num-threads
• datafusion-max-parquet-fanout
• datafusion-use-cached-parquet-loader
• datafusion-config

datafusion-num-threads

Sets the maximum number of DataFusion runtime threads to use.

datafusion-max-parquet-fanout

When multiple Parquet files are required in a sorted way (deduplication for example), specifies the maximum fanout.

Default: 1000

datafusion-use-cached-parquet-loader

Uses a cached Parquet loader when reading Parquet files from the object store.

datafusion-config

Provides custom configuration to DataFusion as a comma-separated list of key:value pairs.

HTTP

• max-http-request-size
• http-bind

max-http-request-size

Specifies the maximum size of HTTP requests.

Default: 10485760

http-bind

Defines the address on which InfluxDB serves HTTP API requests.

Default: 0.0.0.0:8181

Memory

• exec-mem-pool-bytes
• force-snapshot-mem-threshold

exec-mem-pool-bytes

Specifies the size of the memory pool used for query processing and data operations. This memory pool is used when InfluxDB 3 Enterprise processes queries and performs internal data management tasks. Can be given as absolute value in bytes or as a percentage of the total available memory–for example: 8000000000 or 10%.

force-snapshot-mem-threshold

Specifies the threshold for the internal memory buffer. Supports either a percentage (portion of available memory) or absolute value in MB–for example: 70% or 1000.

Write-Ahead Log (WAL)

• wal-flush-interval
• wal-snapshot-size
• wal-max-write-buffer-size
• snapshotted-wal-files-to-keep
• wal-replay-fail-on-error
• wal-replay-concurrency-limit

wal-flush-interval

Specifies the interval to flush buffered data to a WAL file. Writes that wait for WAL confirmation take up to this interval to complete. Use s for seconds or ms for milliseconds. For local disks, 100 ms is recommended.

Default: 1s

wal-snapshot-size

Defines the number of WAL files to attempt to remove in a snapshot. This, multiplied by the interval, determines how often snapshots are taken.

Default: 600

wal-max-write-buffer-size

Specifies the maximum number of write requests that can be buffered before a flush must be executed and succeed.

Default: 100000

snapshotted-wal-files-to-keep

Specifies the number of snapshotted WAL files to retain in the object store. Flushing the WAL files does not clear the WAL files immediately; they are deleted when the number of snapshotted WAL files exceeds this number.

Default: 300

wal-replay-fail-on-error

Determines whether WAL replay should fail when encountering errors.

Default: false

wal-replay-concurrency-limit

Concurrency limit during WAL replay. Setting this number too high can lead to OOM. The default is dynamically determined.

Default: max(num_cpus, 10)

Compaction

• gen1-duration

gen1-duration

Specifies the duration that Parquet files are arranged into. Data timestamps land each row into a file of this duration. Supported durations are 1m, 5m, and 10m. These files are known as “generation 1” files.

Default: 10m

Caching

• preemptive-cache-age

• parquet-mem-cache-size

• parquet-mem-cache-prune-percentage

• parquet-mem-cache-prune-interval

• parquet-mem-cache-query-path-duration

• disable-parquet-mem-cache

• table-index-cache-max-entries

• table-index-cache-concurrency-limit

• last-cache-eviction-interval

• distinct-cache-eviction-interval

preemptive-cache-age

Specifies the interval to prefetch into the Parquet cache during compaction.

Default: 3d

parquet-mem-cache-size

Specifies the size of the in-memory Parquet cache. Accepts values in megabytes (as an integer) or as a percentage of total available memory (for example, 20%, 4096).

Default: 20%

parquet-mem-cache-prune-percentage

Specifies the percentage of entries to prune during a prune operation on the in-memory Parquet cache.

Default: 0.1

parquet-mem-cache-prune-interval

Sets the interval to check if the in-memory Parquet cache needs to be pruned.

Default: 1s

parquet-mem-cache-query-path-duration

the time window for caching recent Parquet files in memory. Default is 5h.

Only files containing data with a timestamp between now and now - duration are cached when accessed during queries–for example, with the default 5h setting:

• Current time: 2024-06-10 15:00:00
• Cache window: Last 5 hours (2024-06-10 10:00:00 to now)

If a query requests data from 2024-06-09 (old) and 2024-06-10 14:00 (recent):

• Cached: Parquet files with data from 2024-06-10 14:00 (within 5-hour window)
• Not cached: Parquet files with data from 2024-06-09 (outside 5-hour window)

disable-parquet-mem-cache

Disables the in-memory Parquet cache. By default, the cache is enabled.

table-index-cache-max-entries

Specifies the maximum number of entries in the table index cache.

Default: 1000

table-index-cache-concurrency-limit

Limits the concurrency level for table index cache operations.

Default: 8

last-cache-eviction-interval

Specifies the interval to evict expired entries from the Last-N-Value cache, expressed as a human-readable duration–for example: 20s, 1m, 1h.

Default: 10s

distinct-cache-eviction-interval

Specifies the interval to evict expired entries from the distinct value cache, expressed as a human-readable duration–for example: 20s, 1m, 1h.

Default: 10s

query-file-limit

Limits the number of Parquet files a query can access. If a query attempts to read more than this limit, InfluxDB 3 Enterprise returns an error.

Processing Engine

• plugin-dir
• plugin-repo
• virtual-env-location
• package-manager

plugin-dir

Specifies the local directory that contains Python plugins and their test files.

plugin-repo

Specifies the base URL of the remote repository used when referencing plugins with the gh: prefix. When you create a trigger with a plugin filename starting with gh:, InfluxDB fetches the plugin code from this repository URL.

The URL construction automatically handles trailing slashes—both formats work identically:

• https://example.com/plugins/ (with trailing slash)
• https://example.com/plugins (without trailing slash)

Default: The official InfluxDB 3 plugins repository at https://raw.githubusercontent.com/influxdata/influxdb3_plugins/main/

Example usage

# Use a custom organization repository
influxdb3 serve \
  --plugin-dir ~/.plugins \
  --plugin-repo "https://raw.githubusercontent.com/myorg/influxdb-plugins/main/"

# Use an internal mirror
influxdb3 serve \
  --plugin-dir ~/.plugins \
  --plugin-repo "https://internal.company.com/influxdb-plugins/"

# Set via environment variable
export INFLUXDB3_PLUGIN_REPO="https://custom-repo.example.com/plugins/"
influxdb3 serve --plugin-dir ~/.plugins

virtual-env-location

Specifies the location of the Python virtual environment that the processing engine uses.

package-manager

Specifies the Python package manager that the Processing Engine uses to install plugin dependencies.

This option supports the following values:

• discover (default): Automatically detect and use available package manager (uv or pip)
• pip: Use pip package manager exclusively
• uv: Use uv package manager exclusively
• disabled: Disable automatic package installation (all dependencies must be pre-installed)

Default: discover

Security mode (disabled)

When set to disabled, InfluxDB 3 Enterprise blocks all package installation attempts for security and compliance requirements. The Processing Engine and plugins continue to function normally, but package installation requests (via CLI or API) return a 403 Forbidden error.

This mode is designed for:

• Enterprise security requirements: Prevent arbitrary package installation
• Compliance environments: Control exactly which packages are available
• Air-gapped deployments: Pre-install all dependencies before deployment
• Multi-tenant scenarios: Prevent tenants from installing potentially malicious packages

Example:

# Start InfluxDB 3 with disabled package manager
influxdb3 serve \
  --node-id node0 \
  --object-store file \
  --data-dir ~/.influxdb3 \
  --plugin-dir ~/.plugins \
  --package-manager disabled

For more information about plugins and package management, see Processing Engine plugins.

Resource Limits

• datafusion-num-threads
• num-io-threads - See Global configuration options | |

datafusion-num-threads

Sets the number of threads allocated to the DataFusion runtime thread pool. DataFusion threads handle:

• Query execution and processing
• Data aggregation and transformation
• Snapshot creation (sort/dedupe operations)
• Parquet file generation

Data Lifecycle Management

• gen1-lookback-duration
• retention-check-interval
• delete-grace-period
• hard-delete-default-duration

gen1-lookback-duration

Specifies how far back to look when creating generation 1 Parquet files.

Default: 24h

retention-check-interval

The interval at which retention policies are checked and enforced. Enter as a human-readable time–for example: 30m or 1h.

Default: 30m

delete-grace-period

Specifies the grace period before permanently deleting data.

Default: 24h

hard-delete-default-duration

Sets the default duration for hard deletion of data.

Default: 90d

Telemetry

• disable-telemetry-upload
• telemetry-endpoint

disable-telemetry-upload

Disables the upload of telemetry data to InfluxData.

Default: false

telemetry-endpoint

Specifies the endpoint for telemetry data uploads.

TCP Listeners

• tcp-listener-file-path
• admin-token-recovery-tcp-listener-file-path

tcp-listener-file-path

Specifies the file path for the TCP listener configuration.

admin-token-recovery-tcp-listener-file-path

Specifies the TCP listener file path for admin token recovery operations.