Falcon LogScale Documentation

💡

Getting Started

Begin your LogScale journey with tutorials, quickstarts, and foundational concepts

LogScale Introduction
conceptbeginner
Learn how to get started using LogScale
LogScale Overview
conceptbeginner
Introduction to log management and LogScale's core capabilities
What is LogScale
Learn how LogScale ingests, stores, and queries your log data
LogScale Product Tutorial with Demo Data
tutorialbeginner
A hands-on walkthrough using sample data, no setup required
LogScale Video Series
videobeginner
Short videos covering core concepts and common tasks
LogScale Internal Architecture
conceptadvanced
How LogScale works internally — from data ingestion to query processing
LogScale Web Interface
referencebeginner
A tour of the UI — search bar, widgets, and navigation
Terminology Reference
referencebeginner
Definitions for LogScale-specific terms you will see throughout the docs

📖

Data Management, Queries and Dashboards

Master the LogScale interface, query language, and core terminology

CrowdStrike Query Language (CQL)
Learn how to write queries and access data
Manage Repositories and Views
taskintermediate
Organize data in repositories and control access with views
Parse Data
taskadvanced
Extract fields from unstructured logs during ingestion
Search Data
taskintermediate
Use the search interface to explore and filter your events
Examples Library
exampleintermediate
Our examples library contains detaile query examples and step-by-step descriptions of what the query is doing and how the query achieves the original goal.
Write Queries
taskintermediate
An introduction to building CQL queries step by step
Query Language Syntax
conceptintermediate
The grammar and structure of CQL — pipes, filters, and operators
Query Functions
referenceintermediate
The full suite of functions in LogScale that support the CrowdStrike Query Language
Getting Data Out
conceptintermediate
Learn the basics of getting data out of your LogScale instance
Data Visualization
conceptintermediate
Turn query results into charts, tables, and dashboards
CrowdStrike Query Language Grammar Subset
referenceintermediate
Formal grammar reference for the CrowdStrike Query Language
Triggers
conceptintermediate
Automate actions with continuous alerts or scheduled searches
Schedule PDF Reports
taskintermediate
Create and schedule shareable PDF reports
Scheduled Searches
Run a saved query automatically on a recurring schedule
Actions
taskintermediate
Configure automated responses: email, webhooks, Slack, and more

📥

Ingesting Data

Connect data sources, configure parsers, and stream logs into LogScale

LogScale Getting Data In
Learn about methods and tools for ingesting data into Falcon LogScale
Getting Data In Process
taskintermediate
Learn about the procesess involved in getting data into Falcon LogScale
Getting Data In
Understand the baics of Getting Data In to LogScale
Falcon LogScale Collector
taskintermediate
The native log shipper that collects and forwards logs to LogScale
Popular Ingest Methods
taskintermediate
Learn about different ingest solutions
Falcon LogScale Collector Releases
referenceadvanced
Release notes and version history for Falcon LogScale Collector
Parse Data
taskadvanced
Create and configure parsers for incoming log data
Fleet and Group Management
taskintermediate
Centrally monitor and configure multiple Collector instances
CrowdStrike Parsing Standard 1.2
The schema standard for normalising fields across data sources
Manage Data Ingest
taskintermediate
Configure and control data ingestion

🏢

Managing LogScale Cloud

Configure organizations, manage users, and control access in your cloud environment

LogScale Cloud
Administration and monitoring guide for Cloud deployments
Instance Administration
conceptintermediate
Monitor usage, manage data lifecycle, and track system health
Understand Organizations
conceptintermediate
How organizations, users, and permissions are structured in Cloud
Organization Settings
Configure account-wide preferences for your Cloud organisation
Configure Security
taskadvanced
Set up authentication, access controls, and security policies
Limits and Standards
referenceintermediate
Operating parameters and system limits for LogScale
Archive Data
conceptadvanced
Move older data to long-term, lower-cost storage
LogScale URLs and Endpoints
referenceintermediate
The base URLs and endpoints for your Cloud environment

🏢

Managing LogScale Self-Hosted

Configure organizations, manage users, and control access in your self-hosted deployments

LogScale Self-Hosted
Administration and configuration guide for self-hosted deployments
Instance Administration
conceptintermediate
Monitor users, manage retention, and oversee licensing
Organization Settings
Configure organization owners, permissions, and settings
Configure Security
taskadvanced
Set up authentication, access controls, and security policies
Cluster Management
conceptadvanced
Monitor cluster health, replication, and node availability
Limits and Standards
referenceintermediate
Operating parameters and system limits for LogScale
Archive Data
conceptadvanced
Set up long-term archiving to S3 or Google Cloud Storage
Configuration Variables
referenceintermediate
Reference for all available cluster configuration settings
Health Checks
taskadvanced
Verify your self-hosted cluster is running correctly
LogScale URLs and Endpoints
referenceintermediate
API endpoints and URLs for your LogScale instance

🚀

Deploying LogScale

Plan, install, and configure LogScale for your infrastructure needs

LogScale Self-Hosted Deployment
taskintermediate
Step-by-step instructions for a new self-hosted install
Planning to install LogScale
taskintermediate
Sizing, prerequisites, and decisions to make before deploying
Humio Operator
Deploy and manage LogScale on Kubernetes
Reference Architectures
referenceadvanced
Build a LogScale cluster quickly using a reference architecture for a supported cloud platform.
Updating LogScale
taskintermediate
How to safely upgrade a self-hosted cluster to a new version
Authentication and identity providers
conceptintermediate
Configure SSO and identity providers for user authentication
Configuration Settings
taskintermediate
Available settings for tuning a self-hosted deployment

🔌

APIs, Integrating, & CLI

Integrate LogScale with REST APIs, CLI tools, and third-party services automation

Application Programming Interfaces (APIs)
conceptintermediate
Overview of all the ways to interact with LogScale programmatically
Ingest API
referenceintermediate
Send data into LogScale programmatically over HTTP
Search API
referenceintermediate
Run CQL queries programmatically and retrieve results over HTTP
Package Marketplace
referenceintermediate
Browse and install pre-built dashboards, parsers, and saved searches
Package Management
taskintermediate
Build, publish, and manage your own reusable packages
Third-Party Log Shippers
taskintermediate
Send data into LogScale from external shipping tools
Command-Line Interface (humioctl)
taskintermediate
Manage LogScale from your terminal with the humioctl CLI
Log Formats
taskintermediate
Supported log formats and how LogScale parses them
Other Integrations
taskintermediate
Connect LogScale with other tools in your stack

⚡

GraphQL API

Programmatically manage LogScale resources with the GraphQL API

GraphQL API
conceptintermediate
Basic information for using the GraphQL API with LogScale
GraphQL Queries
Reference for every available GraphQL query
GraphQL Mutations
Reference for every available GraphQL mutation
GraphQL Datatypes
All data types available in the GraphQL schema

📦

LogScale Internal Repo Reference

Reference for LogScale's built-in repositories and their schema definitions

LogScale System Repository Schema Guide
conceptadvanced
Reference for LogScale's built-in repositories and their schema definitions
The humio Repository
referenceadvanced
Schema for LogScale's main internal system repository
The humio-activity repository
referenceadvanced
Schema for the internal user activity log repository
The humio-audit repository
referenceadvanced
Schema for the internal audit log repository
The humio-fleet Repository
referenceadvanced
Schema for fleet management and log shipper metadata
The humio-measurements Repository
referenceadvanced
Schema for detailed per-event ingest measurements and data volume tracking
The humio-metrics Repository
referenceadvanced
Schema for the internal platform metrics repository
The humio-usage Repository
referenceadvanced
Schema for hourly aggregated usage metrics and storage tracking
The humio-trigger-execution-info Repository
referenceadvanced
Schema for triggers and automations within LogScale

🆕

New & Updated Content

New Pages

Loading new pages...

Updated Content

Loading recently updated pages...