Ingest Feeds

Security Requirements and Controls

Ingest feeds allow Falcon LogScale to ingest data from AWS S3 buckets and Azure.

The ingest feeds page lists all of the ingest feeds you have configured. From this page you can monitor and manage AWS and Azure ingest feeds and perform activities likes, adding new feeds, enabling or disabling existing feeds, and editing feeds.

Monitor Ingest Feeds

Errors during ingest will be shown within the Ingest feeds page.

To display the Ingest feeds page and monitor ingest feeds:

  1. Go to Repositories and views page and select a relevant repository in which you want to ingest the data.

  2. Click Settings, under Ingest on the side menu click Ingest feeds.

The Ingest feeds page shows the individual feeds, their configuration and current status:

  • Name

    Name of the ingest feed given during configuration.

  • Preprocessing

    A description of any preprocessing performed on the data before it is provided to the parser.

  • Parser

    The configured parser for this ingest feed.

  • Last activity

    The time of the last ingest activity for this feed.

  • Status

    The current status of the feed, including whether there is an error or if the feed has been disabled.

    Transient errors during ingest should automatically be cleared. You can click on the status message to get more information.

To edit, delete or enable/disable an existing feed, click the ⋮ icon next to each feed configuration. To create a new feed, click the + New Ingest feed button.