Creating a Repository or View

Security Requirements and Controls

After you log in to LogScale, the opening screen will show you the complete list of available repositories and views under the Repository and Views tab:

Screen shot of the LogScale Repositories and Views page showing a list of available repositories

Figure 20. Available Repositories


Note

Organization owners and users need to have the necessary organization level permissions to be able to create a new repository or view.

To create a new repository or view:

  1. Click the Repository and Views tab

  2. Click + Add new and select one of the icons:

    Selecting a Repository or View

    Figure 21. Selecting a Repository or View


    The Multi-cluster view option is available from LogScale version 1.124, see LogScale Multi-Cluster Search for more information.

  3. Fill in the forms for creating a repository or a view (fields marked with an asterisk are required and must be filled in).

    For a new repository:

    • Name

    • Description

    • Data Retention where you can specify ingest, storage and time limits for your new repository. Read more at Data Retention.

    New Repository Form

    Figure 22. New Repository Form


    For a new view:

    • Name

    • Description

    • Repository is the repository from which the view will be drawn or generated. Select one the available repository from the drop-down list.

      When you choose a repository and enter a filter, another row is displayed for adding another repository and event filter. This allows you to pull data from multiple repositories.

    • Event filter: use this field to set a filter query for how you want data filtered, for example you can limit the search to a subset of data. The filter query is applied as a prefix to searches in the associated repository, read Query Filters for more information on the filter operators' syntax that can be used when creating a view. Filtering Query Functions cannot be entered in the Event filter field.

      To retrieve all the events in a repository, use the * wildcard.

    New View Form

    Figure 23. New View Form


You can't use views to view details from other views — only from repositories. Therefore, you can't link multiple views.

For configuring repositories or views and ingest data to LogScale to be stored in a repository, see Repository and View Settings.