The Humio Library

• Introducing Humio
• FAQ
  • Installation & Migration Questions
  • Networking Questions
  • Log Management & Ingest Questions
  • Alert Questions
• Reference
  • API
    • Action API
      • List Actions
      • Get Action by ID
      • Create Action
      • Update Action
      • Delete Action
      • Test Action
    • Alert API
      • List Alerts
      • Get Alert by ID
      • Create Alert
      • Update Alert
      • Delete Alert
    • API Authentication
    • Cluster Management API
      • Available Endpoints
      • List Cluster Members
      • Adding a Node
      • Modifying a Node in a Cluster
      • Deleting a Node
      • Applying Default Partition Settings
      • Querying & Assigning Storage Partitions
      • Assigning Default Storage Partitions to Nodes
      • Pruning Replicas when Reducing Replica Setting
      • Moving Existing Segments between Nodes
      • Digest Partitions
      • Managing Kafka Queue Settings
      • Adding an Ingest Listener Endpoint
      • Setup Grouping of Tags
      • Importing a Repository from Another Humio Instance (BETA)
      • Configure Auto-Sharding for High-Volume Datasources
      • Configure Sticky Auto-Sharding for High-Volume Datasources
        • Examples of sticky Autosharding settings
      • Status Endpoint
      • Missing Segments
      • Delete Missing Segments
      • Resurrect Deleted Segments
    • Delete Events API
    • GraphQL
      • API Explorer
        • Resources for Learning GraphQL
        • Examples
        • Both GraphQL and REST
    • Health Check API
      • Status API
        • Example
        • Health API
        • Example
      • Health API (JSON)
        • Example
    • Ingest API
      • Ingest Unstructured Data Using a Parser
      • Events
        • Examples
      • Ingest Structured Data
        • Tags
        • Events
        • Response
        • Example
      • Ingest Raw data
        • Response
        • Example
    • Lookup API
      • Example: Using curl to Upload a File to a Repository
      • Example: Using curl to Upload a Shared File Available in All Repositories
      • Example Contents for a CSV File
      • Example: contents for a file in JSON format using an object as root of the file.
      • Example: contents for a file in JSON format using an array as root of the file.
    • Parser API
      • List Parsers
        • Request
        • Response
      • Create or Update Parser
        • Request
        • Response
      • Parser Types
        • JSON Parsers
        • RegExp Parsers
      • Delete Parser
        • Request
        • Response
    • Search API
      • Request
      • Time Specification
        • Absolute Time
        • Relative Time
        • Response
        • Examples
        • Live Query Streaming All Events
        • Aggregate Query Returning Standard JSON
      • Query Jobs
        • Create
        • Request
        • Response
        • Example
      • Poll
        • Request
        • Response
        • Example
      • Delete
        • Request
        • Response
        • Example
    • REST and GraphQL
  • Command Line Interface
    • Installation
    • Open Source
  • Configuration
    • Basic Configuration
      • Docker Tip
    • Email Configuration
      • User Invitation
      • SMTP
        • SMTP_HOST
        • SMTP_PORT
        • SMTP_SENDER_ADDRESS
        • SMTP_USERNAME
        • SMTP_PASSWORD
        • SMTP_USE_STARTTLS
      • Configure Postmark
    • IP Filter
      • Default ACL
    • JVM Configuration
      • JVM Versions
      • Java version 11
      • Java version 12
      • Java version 13
      • Additional Possibilities
      • Java Memory Options
      • Garbage Collection
        • Shenandoah GC
        • The Z Garbage Collector (ZGC)
      • Verify Physical Memory available for Filesystem Page Cache
      • Java File Encoding & Character Set
      • Character Sets & Character Encoding
      • Transparent Huge Pages (THP) on Linux Systems
      • Docker or Containerized Execution
      • NUMA Multi-Socket Systems
      • Strategy 1: Run One JVM per NUMA Node
      • Strategy 2: Run One JVM per System with a NUMA-aware Garbage Collector
      • NUMA-aware Garbage Collectors in the JVM
      • Additional Assistance
    • Kafka Configuration
      • Topic Management
      • Other Properties
      • Retention Settings
      • Broker Settings
      • Sample Kafka Configuration
      • Sample Zookeeper Configuration
    • MaxMind
    • HTTP Proxy
      • Disable Use of Proxy
    • Akka Configuration
    • TLS
      • Encrypting Humio
        • Client Authentication
        • Server Name Indication (SNI)
        • Example
        • Explicit Zookeeper & Kafka Settings
    • Long Retention
    • IOC Configuration
  • Environment Variables
    • Descriptions of Environment Variables
  • Query Functions
    • Aggregate Functions
    • Comparison Functions
    • Events Functions
    • Formatting Functions
    • Join Functions
    • Math Functions
    • Network Functions
    • Parsing Functions
    • Statistics Functions
    • String Functions
    • Time Functions
    • Widget Functions
  • Query Language
    • Filters
      • Free-Text Filters
      • Field Filters
      • Regex Filters
    • Operators
      • Comparison Operators on Numbers
      • Tag Filters
      • Logical Operators
      • Negating the Result of Filter Functions
    • Adding Fields
      • Regex Field Extraction
      • as Parameters
      • Eval Syntax
      • Assignment Operator
        • Field Operator
    • Conditional
      • Case Statements
        • Example
        • Catch-All Clause
      • Match Statements
        • Example
        • Setting a Field’s Default Value
    • Joins
      • Inner Joins
      • Left Joins
      • Syntax
      • Joining Two Repositories
      • Limitations of Live Joins
      • Best Practices for Join Queries
    • Functions
      • Composite Function Calls
      • User Functions
      • Links
      • Repeating Queries
        • Enabling Repeating Queries
    • Time Syntax
      • Rate Unit Conversion
        • Source-Unit is a Sum or Count
        • Source-Unit is Already a Rate
        • Expressing Rates & Units
      • Relative Time Syntax
        • Examples
        • Regular Expression
    • Query Structure
  • Appendix
    • Limits
      • General Limits
      • Humio Cloud Limits
    • Humio Metrics
      • JMX
      • Prometheus
      • Humio Debug Logs
      • Metric Types
      • Node Level Metrics
      • Object Level Metrics
    • Usage
      • Measurements
        • Ingested Data
        • Stored Data
        • Scanned Data
        • User Seats
      • humio-organization-usage View
      • humio-measurements Repository
      • humio-usage Repository
        • LogId
      • Usage Dashboard
    • Software Libraries
      • Erlang / Elixir
      • JS / Browser
      • NodeJS
      • Python API Client
• Knowledge Base
  • Recent KB Articles
  • Troubleshooting Articles
  • Best Practice Articles
  • How-To Articles
  • Questions
• Training
  • Getting Started
    • Humio Made Simple
      • Humio Cloud
      • Opening Console
      • Layout of the Interactive Tutorial
      • Starting the Interactive Tutorial
      • Searching the Sandbox
      • Other Elements in the Tutorial
      • Learning More
    • Humio with Your Data
      • Configure a Dashboard
        • Conclusion
      • Prepare the Humio Cloud
        • Create a Repository
        • Generate Ingest Tokens
      • Search a Repository
      • Configure Log Shippers
        • Log Shippers
        • Vector for HTTP Logs
        • rsyslog for Server Metrics
        • Check Data Sources on Cloud
    • Deploying Humio
    • Trying Humio First
  • Intro to Humio Video Series
  • Concepts
    • Repositories
      • Views
        • The Sandbox Repository
      • Special Repositories
        • The humio-audit Repository
        • The humio-metrics Repository
        • The humio-activity Repository
        • The humio Repository
    • Sandbox
      • Use-Cases
        • Self-Hosted
        • Humio Cloud
      • Interactive Tutorial Storage
    • Views
      • Searching Multiple Repositories
      • Filtering
      • Example Use-Cases
      • One repository per Service
        • Restricting Access to Repository Subsets
    • Data Sources
      • Data Sources of a Repository
      • Deleting a Data Source
      • Advanced Topics
    • Ingest Flow
      • Parse, Digest, Store
        • The Parse Phase
        • The Digest Phase
        • Constructing Segment Files
        • Real-Time Query Results
        • The Store Phase
      • Detailed Flow Diagram
    • Events
      • Field Types
        • Metadata Fields
        • Tag Fields
        • User Fields
        • Field @rawstring
        • Field @timestamp
        • Field @ingesttimestamp
        • Field #repo
        • Field Field #type
    • Queries
      • Transformation Queries
      • Aggregation Queries
    • Live Queries
    • Dashboards
      • Create a Dashboard
      • Edit a Dashboard
      • Sharing a dashboard in Read-Only Mode
      • Exporting, Copying, Importing
    • Architecture of Humio
      • Internal Components
        • Global – The metadata database
        • HTTP API
        • Digest Engine
        • Segment File Merger
        • Segment Mover
        • Bucket Storage
        • Cluster Coordination Component
        • Search Engine
      • HA Implementation Architecture of Humio
        • Without Bucket Storage
        • Using Bucket Storage
        • Ingest
        • Digest and Search
          • Digest and Search using Bucket Storage
          • Digest and Search without Bucket Storage
    • Cluster Nodes
      • Node Roles
        • Ingest Node
        • HTTP API Node
        • Digest Node
        • Storage Node
        • Node Role Feature Matrix
        • Node Role Examples
        • Single Node
        • Symmetric Cluster
        • Cluster with Frontend or Backend Nodes
        • Dedicated Ingest Nodes
        • Node Identity
    • Humio Repository
    • Data from Servers
    • Querying & Monitoring Data
    • Deeper Foundational Concepts
  • Other Tutorials
    • Ingesting Application Logs
      • Filebeat Configuration
    • Migrating from Elastic Stack
      • Setting up Humio
      • Beats
    • Log Management
      • Log Sources
      • Sending Logs
      • Parsing Incoming Data
      • Searching
    • User Permissions
      • Creating a User
      • Assigning Permissions
      • Groups
        • Group Synchronization
        • Assigning Permissions to Groups
      • Roles
        • Role Permissions
        • Setting up Roles in a File
      • Coming from an earlier version
  • Use Cases
    • SentinelOne Audit Events
      • Configuration
      • Configure Vector
      • Setup Notifications
        • Enable Syslog Integration in SentinelOne
        • Results and Troubleshooting
    • Collecting AWS S3 Logs with Humio & FluentD
      • Why FluentD
      • Pre-Requisites
      • Configure AWS
      • Create SQS Queue
        • Configure SQS Permissions for S3 Events
        • Setup S3 Events to SQS
        • Create User Account for FluentD
        • Configure AWS CloudTrail to Send Logs to S3
      • Create a CloudTrail Parser in Humio
      • Configure FluentD Input
      • Configure FluentD Output
    • Comparing Averages over Search Intervals
    • Advanced Log Routing with Fluent Bit
    • Integrating Humio with Grafana
      • Panels
        • Time Series Graphs
        • Bar Gauges
        • Tables
        • Single Stats
        • Worldmap
      • Query Variables
      • Annotations
    • A Better Parser with Kubernetes & Humio
    • Webhooks Shell Scripts
      • Target Setup
        • Installing Webhook
      • Setup on Humio
• Notices
  • Security Disclosures
    • 2019 November 04
    • 2019 April 04
    • 2019 March 25
    • 2017 May 14
  • Third-Party Licenses
    • Docker Images
    • Java/Scala Dependencies
    • Elm/JS Dependencies
    • Other Resources
• Releases
  • Humio 1.30.0
  • Humio 1.29.4
  • Humio 1.29.3
  • Humio 1.29.2
  • Humio 1.29.1
  • Humio 1.29.0
  • Humio 1.28.0
  • Humio 1.27.1
  • Humio 1.27.0
  • Humio 1.26.3
  • Humio 1.26.2
  • Humio 1.26.1
  • Humio 1.26.0
  • Humio 1.25.3
  • Humio 1.25.2
  • Humio 1.25.1
  • Humio 1.25.0
  • Humio 1.24.4
  • Humio 1.24.3
  • Humio 1.24.2
  • Humio 1.24.1
  • Humio 1.24.0
  • Humio 1.23.1
  • Humio 1.23.0
  • Humio 1.22.1
  • Humio 1.22.0
  • Humio 1.21.1
  • Humio 1.21.0
  • Humio 1.20.4
  • Humio 1.20.3
  • Humio 1.20.2
  • Humio 1.20.1
  • Humio 1.20.0
  • Humio 1.19.2
  • Humio 1.19.1
  • Humio 1.19.0
  • Humio 1.18.4
  • Humio 1.18.3
  • Humio 1.18.2
  • Humio 1.18.1
  • Humio 1.18.0
  • Humio 1.17.0
  • Humio 1.16.4
  • Humio 1.16.3
  • Humio 1.16.2
  • Humio 1.16.1
  • Humio 1.16.0
  • Humio 1.15.2
  • Humio 1.15.1
  • Humio 1.15.0
  • Humio 1.14.6
  • Humio 1.14.5
  • Humio 1.14.4
  • Humio 1.14.3
  • Humio 1.14.2
  • Humio 1.14.1
  • Humio 1.14.0
  • Humio 1.13.5
  • Humio 1.13.4
  • Humio 1.13.3
  • Humio 1.13.2
  • Humio 1.13.1
  • Humio 1.13.0
  • Humio 1.12.7
  • Humio 1.12.6
  • Humio 1.12.5
  • Humio 1.12.4
  • Humio 1.12.3
  • Humio 1.12.2
  • Humio 1.12.1
  • Humio 1.12.0
  • Humio 1.11.1
  • Humio 1.11.0
  • Humio 1.10.9
  • Humio 1.10.8
  • Humio 1.10.7
  • Humio 1.10.6
  • Humio 1.10.5
  • Humio 1.10.4
  • Humio 1.10.3
  • Humio 1.10.2
  • Humio 1.10.1
  • Humio 1.10.0
  • Humio 1.9.3
  • Humio 1.9.2
  • Humio 1.9.1
  • Humio 1.9.0
  • Humio 1.8.9
  • Humio 1.8.8
  • Humio 1.8.7
  • Humio 1.8.6
  • Humio 1.8.5
  • Humio 1.8.4
  • Humio 1.8.3
  • Humio 1.8.2
  • Humio 1.8.1
  • Humio 1.8.0
  • Humio 1.7.4
  • Humio 1.7.3
  • Humio 1.7.2
  • Humio 1.7.1
  • Humio 1.7.0
  • Humio 1.6.11
  • Humio 1.6.10
  • Humio 1.6.9
  • Humio 1.6.8
  • Humio 1.6.7
  • Humio 1.6.6
  • Humio 1.6.5
  • Humio 1.6.4
  • Humio 1.6.3
  • Humio 1.6.2
  • Humio 1.6.1
  • Humio 1.6.0
  • Humio 1.5.23
  • Humio 1.5.22
  • Humio 1.5.21
  • Humio 1.5.20
  • Humio 1.5.19
  • Humio 1.5.18
  • Humio 1.5.17
  • Humio 1.5.16
  • Humio 1.5.15
  • Humio 1.5.14
  • Humio 1.5.13
  • Humio 1.5.12
  • Humio 1.5.11
  • Humio 1.5.10
  • Humio 1.5.9
  • Humio 1.5.8
  • Humio 1.5.7
  • Humio 1.5.6
  • Humio 1.5.5
  • Humio 1.5.4
  • Humio 1.5.3
  • Humio 1.5.2
  • Humio 1.5.1
  • Humio 1.5.0
  • Humio 1.4.9
  • Humio 1.4.8
  • Humio 1.4.7
  • Humio 1.4.6
  • Humio 1.4.5
  • Humio 1.4.4
  • Humio 1.4.3
  • Humio 1.4.2
  • Humio 1.4.1
  • Humio 1.4.0
  • Humio 1.3.2
  • Humio 1.3.0
  • Humio 1.3.0
  • Humio 1.2.12
  • Humio 1.2.11
  • Humio 1.2.10
  • Humio 1.2.9
  • Humio 1.2.8
  • Humio 1.2.7
  • Humio 1.2.6
  • Humio 1.2.5
  • Humio 1.2.4
  • Humio 1.2.3
  • Humio 1.2.2
  • Humio 1.2.1
  • Humio 1.2.0
  • Humio 1.1.37
  • Humio 1.1.36
  • Humio 1.1.35
  • Humio 1.1.34
  • Humio 1.1.33
  • Humio 1.1.32
  • Humio 1.1.31
  • Humio 1.1.30
  • Humio 1.1.29
  • Humio 1.1.28
  • Humio 1.1.27
  • Humio 1.1.26
  • Humio 1.1.25
  • Humio 1.1.24
  • Humio 1.1.23
  • Humio 1.1.22
  • Humio 1.1.21
  • Humio 1.1.20
  • Humio 1.1.19
  • Humio 1.1.18
  • Humio 1.1.17
  • Humio 1.1.16
  • Humio 1.1.15
  • Humio 1.1.14
  • Humio 1.1.13
  • Humio 1.1.12
  • Humio 1.1.11
  • Humio 1.1.10
  • Humio 1.1.9
  • Humio 1.1.8
  • Humio 1.1.7
  • Humio 1.1.6
  • Humio 1.1.5
  • Humio 1.1.4
  • Humio 1.1.3
  • Humio 1.1.2
  • Humio 1.1.1
  • Humio 1.1.0
  • Humio 1.0.69
  • Humio 1.0.68
  • Humio 1.0.67
  • Humio 1.0.66
  • Humio 1.0.65
  • Humio 1.0.64
  • Humio 1.0.63
  • Humio 1.0.62
  • Humio 1.0.61
  • Humio 1.0.60
  • Humio 1.0.59
  • Humio 1.0.58
  • Humio 1.0.57
  • Humio 1.0.56
  • Humio 1.0.55
  • Humio 1.0.54
  • Humio 1.0.53
  • Humio 1.0.52
  • Humio 1.0.51
  • Humio 1.0.50
  • Humio 1.0.49
  • Humio 1.0.48
  • Humio 1.0.47
  • Humio 1.0.46
  • Humio 1.0.45
  • Humio 1.0.44
  • Humio 1.0.43
  • Humio 1.0.42
  • Humio 1.0.41
  • Humio 1.0.40
  • Humio 1.0.39
  • Humio 1.0.38
  • Humio 1.0.37
  • Humio 1.0.36
  • Humio 1.0.35
  • Humio 1.0.34
  • Humio 1.0.33
  • Humio 1.0.32
  • Humio 1.0.31
  • Humio 1.0.30
  • Humio 1.0.29
  • Humio 1.0.28
  • Humio 1.0.27
  • Humio 1.0.26
  • Humio 1.0.25
  • Humio 1.0.24
  • Humio 1.0.23
  • Humio 1.0.22
  • Humio 1.0.21
  • Humio 1.0.20
  • Humio 1.0.19
  • Humio 1.0.18
  • Humio 1.0.17
  • Humio 1.0.16
  • Humio 1.0.15
  • Humio 1.0.14
  • Humio 1.0.13
  • Humio 1.0.12
  • Humio 1.0.11
  • Humio 1.0.10
  • Humio 1.0.9
  • Humio 1.0.8
  • Humio 1.0.7
  • Humio 1.0.6

The Humio Library contains a range of different documents and content formats to provide information on installing, using and managing Humio software.

• If you are new to Humio, you can read the Getting Started section for a primer

• For background videos and to learn the Humio basics of Humio terminology and technology Training section

• If you are a Cloud user, use the Cloud section

• To install Humio, use Installing Humio

• For Release Notes and details of the current and historic changes for all releases, see Release Notes

• For guidance on the User Interface

• To manage your existing Humio installation see Administration

• For information on integrations and methods of working with other tools and Humio see Integration List

• Help on the Humio Package system Packages

Different sections of the library cover different aspects of the product usage. The core Documentation is available according to release version. The link below will take you to the current release documentation. For older releases and preview releases, use the version links at the bottom of this page.

The Knowledge Base, Training, Reference, FAQ and Notices sections are common to all versions of Humio. You can also search the entire library using the box at the top-right.

Documentation

Guidance on installing, configuring, using, and managing your Humio installation

Knowledge Base

Troubleshooting and Best Practices Articles within the Knowledge Base

Training

Getting started guides, Training videos, foundational concepts, and example use cases

Reference

Query Language and Functions, APIs, Variables and Special Configuration

FAQ

Frequently Asked Questions, including common queries and tips on using Humio software

Notices

Security Disclosures, Humio and Third-party License information

Browse by Version

The sections above apply to the Stable version of Humio software. Functionality available within Cloud and Preview releases are also available separately. Documentation for previous versions is also available.

For the release notes for any version, see stable/notices/releases.

Cloud

Stable (1.30)

Preview (1.31)

Previous Releases