Looking at the osquery and rocksdb source, it seems that

allow_ingest_behind

should default to

false

, so I'm not sure where it's being set to true, or if that's configurable somehow