Repositories & Views
Repositories in LogScale is where you store server logs and metrics. Repositories are organized collections of data with associated storage, enabling you to search and monitor your data in a much more comprehensive way. Often, there will be one physical repository per project or system, each with its own set of users, parsers, saved queries, and dashboards. However, this may vary based on the data volume, user permissions, and other factors.
The following diagram provides an overview of the configuration flow to ingest data using LogScale:
Figure 19. Flow
Views in LogScale allow you to group together the specific events from one or more repository. Additionally, views can be used to limit access to data by some users: this is useful because in a repository you can't hide or restrict users to specific data.
Creating & Configuring Repositories and Views
To start working with LogScale, you'll need to create and configure repositories to manage your data. With views, you can also provide alternative representations of server data — either to limit the access to specific users, to filter out events, or to enable searching multiple repositories. For details on how to do that, see Create Repository or View and Repository and View Settings.
Enriching Event Text via Files
Although it may not be a common method, you can add text to events for search purposes using a CSV file. See the Lookup Files section for more information on this.
Deleting Repositories & Views
To save space or to eliminate no longer needed data, you can delete a repository and related views. For details on how to do this, see Delete Repositories & Views.
If you're new to LogScale, you may want to look at the LogScale Training section of the LogScale Library. Start by reading the Falcon LogScale Beginner Introduction. You might also read through the LogScale Overview pages — and bookmark it as you may want to refer back to it until you're comfortable with the various concepts of LogScale.