LogScale sends its own internal logs to the humio repository. LogScale logs are also written to files by default. You can configure logging to standard.out, as well. This guide describes these logging options. For specific information about logging LogScale to LogScale, see Log LogScale to LogScale.

LogScale internal logs are divided into five kinds: logs, activity, metrics, requests, and nonsensitive. These logs use a tag, #kind, and each #kind is logged to its own file. Querying using the tag improves speed for many searches.

LogScale logging types are listed below with the names of their respective log files in parentheses:

LogScale automatically rotates each log when it reaches 50 megabytes in size. LogScale retains up to five files of each log.

All of the logs in the preceding list are available for search in the humio repository. When searching LogScale logs, you can use these tags: #type, #kind, and #vhost. All logs have #type=humio. They have a #kind tag for each type.

Log events will also have a vhost tag. Each node in a LogScale cluster has a node number. The #vhost value indicates which node in the LogScale cluster wrote the log event. Below are a few standard searches using the above tags:

#type=humio  //will find all events from all hosts of all kinds
#type=humio #kind=metrics //search all metrics across all hosts in the cluster
#type=humio #kind=metrics #vhost=1 //find all metrics for the node number one