The Settings tab, specifically the General section where you may enter repository information in the Basic Information page. This description, along with the name of the repository, will appear on the Repositories and views tab when you first log into the LogScale Interface.

Figure 24. Basic Settings

Below is a list of each part of the Basic Information panel, with descriptions of each:

The Data retention settings' page allows to configure when LogScale will delete events from the repository. Old data will be removed automatically when any of the configured limits is reached.

The following fields can be configured:

The Field aliasing settings' page lists all the schemas configured for any field aliasing being applied. For more information, see Field Aliasing.

Repository access can be configured on a per-user basis by adding a user and setting their role for each repository.

Figure 25. User Permissions

Select a repository from the Repositories and Views page and click Settings on the menu.

To add a user to this repository, click Permissions under Access Control.

Click the +Add button to add users and then you will be prompted to set their role.

For more information on user management, see Configuring Security.

Select a repository from the Repositories and Views page → Settings →Connections to access the Connections page.

This setting is only visible when you create a view as it defines which repositories the view gets its data from.

You can use it to join results from multiple repositories or you can limit results to a single service, for instance:

#service=webserver

and

#host=web01

or implement access restrictions, for instance:

department=finance

and

confidential=false

Click + New connection on the top-right to create a connection.

Figure 26. Create a New Connection

The filter query that you specify in the Event filter box is applied as a prefix to searches in the associated repository. This is what allows you to limit results to a subset of data or a particular service.

On LogScale Self-hosted, this setting is also used in Multi-Cluster Search, see Viewing an Existing Multi-Cluster View Settings for more information.

This page allows you to add new repository tokens, which are used for granting API access to all functions that relate to a specific repository. For more information, see Repository and View API Tokens.

On this page you can manage the ingest tokens and assigned parsers, for more information on generating, editing and deleting tokens and assigning parsers to tokens see Ingest Tokens.

Figure 27. Ingest Tokens

This page allows you to add and manage ingest feeds, which are used for ingesting data from AWS Cloud to LogScale. For more information, see Ingest Data from AWS S3.

Use a Falcon Data Replicator (FDR) feed to ingest data from Falcon into your Falcon LogScale repository. You need to create an FDR feed in Falcon before doing anything on this page. For more information, see Ingesting FDR Data into a Repository.

The Block Ingestion page enables you to temporarily block ingestion for a short period of time, after which it will be re-enabled. This can be useful in a variety of situations where the level of ingestion and activity are causing performance or reporting problems.

For more information, see Disabling Ingestion.

Figure 28. Block Ingest

LogScale stores data in segments organized by the data sources and tags in the ingested data. These datasources are generated by a combination of the tags (#field fields) in the data. For more information on data sources and tags during ingest, see Tag Fields and Datasources. Datasources are created automatically, but can be delete if a data source is old and no longer needed and you want to save the space.

Datasources can be tagged. You can create your own tags and assign them to events. See the Event Tags documentation page for more information on tags.

Figure 29. Data Sources

This page is for managing tag groupings. When a field is tagged, each of its distinct values also create distinct data sources. If a tag has many distinct values, this means it can create a large number of data sources, which can negatively affect performance of a cluster. To counter this, tag values can be divided between a fixed number of groups, and those groups used to create data sources instead. For more information, see Setup Grouping of Tags.

This page is for managing ingest listeners. For more information, see Ingest Listeners.

The Danger Zone panel is so named because the actions that can be taken here involve the deletion of data and actions that cannot be reversed. Some actions don't include deleting data, but can cause problems with the functioning of LogScale, leading to major disruption of service — and can be difficult to resolve. As a result, you should be very cautious when making changes here.

Figure 30. Danger Zone

The Danger Zone provides access to two areas of the repository settings which have the potential to modify or alter data:

The Packages area allows you to install packages, verify the packages which are installed and create a custom package, see the dedicated Packages documentation for more information.