> ## Documentation Index
> Fetch the complete documentation index at: https://stellar-relay.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Configure alert and case streams, destinations, and case options.

The relay treats alert and case forwarding as two independently configured streams. Each stream has its own interval and destination.

## Alert stream

| Option                | Purpose                      | Example       |
| --------------------- | ---------------------------- | ------------- |
| `--alert-interval`    | Alert fetch interval         | `60`          |
| `--alert-syslog-ip`   | Alert destination IP address | `10.10.10.20` |
| `--alert-syslog-port` | Alert destination TCP port   | `5201`        |

A valid alert stream requires all three options.

```bash theme={null}
--alert-interval 60 \
--alert-syslog-ip 10.10.10.20 \
--alert-syslog-port 5201
```

## Case stream

| Option                     | Purpose                                    | Example       |
| -------------------------- | ------------------------------------------ | ------------- |
| `--case-interval`          | Case fetch interval                        | `3600`        |
| `--case-syslog-ip`         | Case destination IP address                | `10.10.10.20` |
| `--case-syslog-port`       | Case destination TCP port                  | `5142`        |
| `--case-include-summary`   | Include case summary data                  | enabled       |
| `--no-case-format-summary` | Disable additional case-summary formatting | enabled       |
| `--case-fetch-timeout`     | Case fetch timeout                         | `90`          |

A valid case stream requires the interval, destination IP, and destination port.

```bash theme={null}
--case-interval 3600 \
--case-syslog-ip 10.10.10.20 \
--case-syslog-port 5142 \
--case-include-summary \
--no-case-format-summary \
--case-fetch-timeout 90
```

## Stream state rules

<Steps>
  <Step title="No options for a stream">
    If every option for a stream is omitted, that stream is disabled.
  </Step>

  <Step title="Partial configuration">
    If configuration for a stream is started but a required option is missing, that stream is an error.
  </Step>

  <Step title="Complete configuration">
    When all required options are present, the stream can run. Alert and case streams can both be enabled in the same process.
  </Step>
</Steps>

## Separate destinations

Alert and case streams have separate IP and port options, so they can be sent to independent listeners.

```text theme={null}
Alerts -> 10.10.10.20:5201
Cases  -> 10.10.10.30:5142
```

They can also use the same downstream SIEM/SOC receiver when one listener handles both record types.

## Debug mode

Use `--debug` only while troubleshooting.

<Info>
  Although the destination option names contain `syslog`, the documented payload format is newline-delimited JSON (NDJSON) over TCP. Configure the receiving parser accordingly.
</Info>