Configuration Reference

The Falcon LogScale Collector is configured via a .yaml file, either manually with a local file, or in a centralized way via the Config Editor.

The file is nested and the indention of the file is essential to the correct function of the Falcon LogScale Collector. The first level of the file is as follows. Note that the parameters fleetManagement and datadirectory cannot be used in remote configurations.

ParameterTypeRequiredDefault ValueDescription
apilocalapioptional[a] {} Defines configuration settings for the local API interface, enabling communication and control through API requests. (added in 1.10)
dataDirectorystringoptional[a]   Defines the where the Falcon LogScale Collector will create its files, for more information, see dataDirectory.
flagsflagsoptional[a] {} Optional configuration flags which allow additional behaviors like communication over HTTP. For more information, see Optional Flags(flags).
fleetManagementfleetmanagementoptional[a] mode: none This block defines how the LogScale Collector is managed by Fleet Management. This block specifies the management by Fleet Management. For more information, see Fleet Management (fleetManagement)
logLevellogleveloptional[a]   Defines the logging level threshold. Higher levels include all messages from lower levels, allowing control over verbosity of logs.
   Values
   debugLog debug and above
   disabledLogging is disabled
   errorLog error and above
   fatalOnly track fatal errors
   infoTrack info level entries and above.
   panicTrack panic level entries
   traceLog all (highest verbosity)
   warnLog warnings and above
settingssettingsoptional[a] {} Specifies global settings which apply to all sources.
sinkssinkoptional[a] {}

Defines where the data will be sent and specifications on the Queue (queue), memory, compression, proxy configuration

You can define multiple sinks for each configuration file. See Sinks (sinks) for more information.

The LogScale ingest APIs currently transport data over HTTP to the same ports that are used for the web interface for LogScale, no special ports need to be configured. By default the data is compressed and requires HTTPS, although these can be configured.

sourcessourceoptional[a] {} This element allows you to define one or more data sources and a configuration for each data source including a sink for each source. There can only be one sources block per config file. For more information and examples for different source types, see Configuration Examples.

[a] Optional parameters use their default value unless explicitly set.