# Processing Traps

### Processor Configuration Options

#### EF\_PROCESSOR\_POOL\_SIZE[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_pool_size) <a href="#ef_processor_pool_size" id="ef_processor_pool_size"></a>

Specifies the number of 'processors' to start. In other words, how many logical threads of execution to run at once when processing input. For NetObserv Flow, you will need at least one (1) processor for every 2000 records/second. Increasing the number of processors will allow the collector to better handle a high volume of high latency enrichment tasks such as DNS lookups for IP addresses. We see diminishing returns for a processor pool size of greater than 32.

{% hint style="info" %}
While increasing the number of processors can be beneficial, there are diminishing returns at higher processor counts. This is especially true when the number of processors exceeds the number of available CPU threads (real cores + SMT threads) or vCPUs. If you require more than 64 processors, and are using a Standard or Premium License, it may be more beneficial to use multiple collector instances.
{% endhint %}

The minimum value is `2`. If you configure this to be '1', it will change to '2'.

If you configure it to '0', it will use the default value, as explained below (the same as not setting it at all).

* Default
  * `4 * the number of 'units' supported`
    * for NetObserv Flow, a 'unit' equals `flows per second supported / 4000`
    * for NetObserv SNMP, a 'unit' equals `hosts supported / 40`
    * for NetObserv SNMP Trap, a 'unit' equals `hosts supported / 40`

{% hint style="info" %}
Your license (if you are using one) will support a certain amount of flows per second (for NetObserv Flow) and/or hosts per second (for NetObserv SNMP and NetObserv SNMP Trap). However, you can manually configure any instance of NetObserv to use *less* than the maximum supported by the license. This helps support horizontal scaling. If you do that, the default value will base its calculation off of the manually configured limit.
{% endhint %}

#### EF\_PROCESSOR\_TRANSLATE\_KEEP\_IDS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_translate_keep_ids) <a href="#ef_processor_translate_keep_ids" id="ef_processor_translate_keep_ids"></a>

Specifies which identifier values will be included in the final dataset.

* Valid Values
  * `none` - All identifiers are removed from the final dataset.
  * `default` - Most identifiers are removed from the final dataset. However, some identifiers which are required for common use-cases (e.g. raw protocol port values) are included.
  * `all` - All identifiers are included in the final dataset.
* Default
  * `default`

#### EF\_PROCESSOR\_DURATION\_PRECISION[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_duration_precision) <a href="#ef_processor_duration_precision" id="ef_processor_duration_precision"></a>

The desired precision of duration-related values. Values received at a different precision than specified will be converted to the desired precision.

* Valid Values
  * `sec` - seconds
  * `ds` - deciseconds
  * `cs` - centiseconds
  * `ms` - milliseconds
  * `us` - microseconds
  * `ns` - nanoseconds
* Default
  * `ms`

{% hint style="info" %}
For most data sources this should milliseconds (`ms`)
{% endhint %}

#### EF\_PROCESSOR\_TIMESTAMP\_PRECISION[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_timestamp_precision) <a href="#ef_processor_timestamp_precision" id="ef_processor_timestamp_precision"></a>

The desired precision of timestamp values. Values received at a different precision than specified will be converted to the desired precision.

* Valid Values
  * `sec` - seconds
  * `ds` - deciseconds
  * `cs` - centiseconds
  * `ms` - milliseconds
  * `us` - microseconds
  * `ns` - nanoseconds
* Default
  * `ms`

{% hint style="info" %}
For most data stores, e.g. Elasticsearch, this should milliseconds (`ms`)
{% endhint %}

#### EF\_PROCESSOR\_PERCENT\_NORM[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_percent_norm) <a href="#ef_processor_percent_norm" id="ef_processor_percent_norm"></a>

The desired representation of percentages. Values received with a different representation than specified will be converted to the desired representation.

* Valid Values
  * `1` - values will be based on a scale of 0-1.
  * `100` - values will be based on a scale of 0-100.
* Default
  * `100`

#### EF\_PROCESSOR\_KEEP\_CPU\_TICKS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_keep_cpu_ticks) <a href="#ef_processor_keep_cpu_ticks" id="ef_processor_keep_cpu_ticks"></a>

For telemetry sources which provide CPU usage as timeticks, utilization percentages will be calculated. If this setting is set `false` the timetick values will be removed from the final dataset. If `true` they will be kept, in addition to the utilization values.

* Valid Values
  * `true`, `false`
* Default
  * `false`

#### EF\_PROCESSOR\_DROP\_FIELDS[​](https://www.elastiflow.com/docs/config_ref/common/processor#ef_processor_drop_fields) <a href="#ef_processor_drop_fields" id="ef_processor_drop_fields"></a>

This setting allows for a comma-separated list of fields that are to be removed from all records. The fields are dropped after all enrichment and *PRIOR* to the records being sent to the enabled outputs.

{% hint style="info" %}
The conversion from the default CODEX schema to alternate schemas, e.g. Elastic's ECS or Splunk's CIM, happens within the respective outputs. As fields are dropped *PRIOR* to the outputs, CODEX field names must be used to configure this option.
{% endhint %}

* Valid Values
  * any CODEX-schema field names, comma-separated
* Example
  * `flow.export.sysuptime,flow.export.version.ver,flow.start.sysuptime,flow.end.sysuptime,flow.seq_num`
* Default
  * `''`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.elastiflow.com/trapcoll/configuration/processing-traps.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.