{"id":49178706,"url":"https://github.com/arkime/arkime-testdb","last_synced_at":"2026-05-03T19:05:30.837Z","repository":{"id":352925437,"uuid":"1216984698","full_name":"arkime/arkime-testdb","owner":"arkime","description":"Single-node Elasticsearch 7.10-compatible storage server for Arkime dev/test use (Rust, redb)","archived":false,"fork":false,"pushed_at":"2026-05-02T23:22:16.000Z","size":373,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-03T01:23:20.804Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/arkime.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-21T12:34:15.000Z","updated_at":"2026-05-02T23:22:19.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/arkime/arkime-testdb","commit_stats":null,"previous_names":["arkime/arkime-testdb"],"tags_count":23,"template":false,"template_full_name":null,"purl":"pkg:github/arkime/arkime-testdb","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime-testdb","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime-testdb/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime-testdb/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime-testdb/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/arkime","download_url":"https://codeload.github.com/arkime/arkime-testdb/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arkime%2Farkime-testdb/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32581058,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-03T06:36:36.687Z","status":"ssl_error","status_checked_at":"2026-05-03T06:36:09.306Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-23T00:03:13.959Z","updated_at":"2026-05-03T19:05:30.832Z","avatar_url":"https://github.com/arkime.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# arkime-testdb\n\nA tiny, single-node, Elasticsearch 7.10-compatible HTTP server designed to back\n[Arkime](https://github.com/arkime/arkime) for **development and CI** use.\n\nWritten in Rust on top of [redb](https://github.com/cberner/redb) with\n[roaring bitmaps](https://github.com/RoaringBitmap/roaring-rs) for inverted\nindices. Disk footprint is the primary optimization target, performance second,\nmemory third.\n\n\u003e ⚠️ **Not a production Elasticsearch/OpenSearch replacement.** This is a\n\u003e minimum-viable ES 7.10 surface scoped to what Arkime's viewer, capture,\n\u003e cont3xt, wiseService, db.pl, and the regression test suite actually exercise.\n\u003e There is no replication, no cluster, no shard rebalancing, and large swaths\n\u003e of the real ES API are missing or stubbed.\n\n## Goals\n\n1. **Disk space** — tiny on-disk footprint. The full Arkime test corpus lands\n   in ~20\u0026nbsp;MB across two redb files (`sessions.redb`, `other.redb`).\n2. **Performance** — the full `tests.pl --viewer` suite (~5,100 tests) runs\n   in ~160\u0026nbsp;s on a laptop.\n3. **Memory** — modest RSS; no JVM.\n\n## Status\n\nRuns the full Arkime regression test suite (`tests/tests.pl --viewer`) green.\nThe `db.pl` `init`/`upgrade`/`info`/`expire`/`optimize` commands all work.\nViewer, capture, cont3xt, and wiseService all talk to it happily.\n\n## Build \u0026 run\n\n```sh\ncargo build --release\n./target/release/arkimedb serve --data-dir ./data --port 9200\n```\n\nThen point Arkime at `http://localhost:9200` as you would Elasticsearch.\n\n### Prebuilt binaries\n\nDownload from [Releases](https://github.com/arkime/arkime-testdb/releases).\nLinux amd64/arm64 and macOS arm64 are published.\n\nOn macOS the downloaded binary is quarantined by Gatekeeper. Strip the\nquarantine attribute before first run:\n\n```sh\nxattr -d com.apple.quarantine arkimedb-macos-arm64\nchmod +x arkimedb-macos-arm64\n./arkimedb-macos-arm64 serve --data-dir ./data --port 9200\n```\n\n### Useful flags\n\n| Flag | Description |\n| --- | --- |\n| `--data-dir \u003cpath\u003e` | Where redb files live (default `./data`). |\n| `--port \u003cn\u003e` | HTTP port (default `9200`). |\n| `--debug` | Log every request: `[debug] \u003cts\u003e \u003cpeer\u003e METHOD /url -\u003e STATUS \u003cbytes\u003eB (ms)`. Also via `ARKIMEDB_DEBUG=1`. |\n\n## What's implemented\n\nEnough of ES 7.10 to make Arkime happy. Roughly:\n\n- **Index ops** — create/delete/exists, aliases, settings, mappings, refresh\n  (no-op by default; eventual durability).\n- **Document ops** — get, index, update, delete, bulk, mget.\n- **Search** — `_search`, `_count`, `_msearch`, scroll, PIT, `fields`\n  projection, `_source` filtering.\n- **Query DSL subset** — `bool`, `term`/`terms`, `match`, `range`,\n  `query_string` / Lucene `q=`, `exists`, `prefix`, `wildcard`, `regexp`, CIDR.\n- **Aggregations** — `terms`, `date_histogram`, `cardinality`, `stats`, nested.\n- **Cluster/cat** — `/_cluster/health`, `/_nodes[/stats]`, `/_cat/*`,\n  `/_ilm/policy`, `/_plugins/_ism/policies` (stubs for ILM/ISM).\n- **Version** — reports `7.10.10` so Arkime's version gate is satisfied.\n\nSee `ES_DUP.md` for a detailed requirements/compatibility rundown and\nperformance notes collected while building this.\n\n## Storage layout\n\nAll non-session indices share a single `other.redb` file; all session\nindices share `sessions.redb`. This dramatically cuts disk usage compared to\none file per index when you have many tiny indices (which Arkime does).\n\n## License\n\n[Apache License 2.0](./LICENSE). Same as Arkime.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farkime%2Farkime-testdb","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farkime%2Farkime-testdb","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farkime%2Farkime-testdb/lists"}