Skip to content
LogoLogScale DocumentationFull Library Knowledge Base Release Notes Integrations Training API GraphQL API Contacting Support
help

  • Falcon LogScale Self-Hosted 1.107.0-1.112.0

    • Self-Hosted Overview
    • Installing LogScale
      • System Requirements
      • Installing Using Containers
        • Container Deployment Using humio-core
          • Deploying a Kafka Cluster using Containers
          • Deploying a LogScale Cluster using Containers
        • Container Deployment Using humio (Testing Only)
        • LogScale Kubernetes Reference Architecture
          • Humio Operator Overview
          • Cluster topology
          • Kubernetes Deployment Requirements
          • Deploying Prerequisites
          • Basic Architecture Configuration
          • Advanced Architecture Configuration
          • Kubernetes Deployment Limits
          • Deployment for High Availability
          • Disaster Recovery
          • Additional Considerations
          • Scaling a HumioCluster Up or Down
        • LogScale Deployment using Kubernetes
          • Install LogScale Operator on Kubernetes
          • AWS Cloud Reference Architecture
          • AWS Cloud Reference Deployment and Automation
          • Deploying LogScale with Operator on Google Cloud Platform (GCP)
            • Component Version Requirements
            • GCP Deployment Prerequisites
            • Deploy GCP Resources and LogScale
            • Accessing the Deployed GCP LogScale Instance
            • Testing GCP Deployment
            • GCP Deployment Cleanup
          • LogScale Operator Resource Management
          • Upgrading LogScale Operator on Kubernetes
      • Installing On Bare Metal or Cloud Instance
        • Preparing for Installation
        • Individual Node Configuration
        • Installing Java
        • Installing Native Kafka
        • Deploying Kafka using Amazon MSK
        • Installing LogScale
        • LogScale Launcher Script
      • Installing Load Balancers
        • Apache Reverse Proxy
        • Caddy Reverse Proxy
        • Nginx Reverse Proxy
        • HAProxy Reverse Proxy
          • Configuring HAProxy as a Service
      • Deploying Auxiliary Services
        • PDF Render Service
          • Deploying Single PDF Render Services
          • Deploying Multiple PDF Render Services
          • PDF Render Server Configuration Options
          • Adding PDF Render to LogScale Configuration
          • Monitoring Auxiliary PDF Service
    • Self-Hosted Admin.
      • Data Retention
      • LogScale Internal Logging
      • Log LogScale to LogScale
      • Query Administration
        • Query Monitor
          • Query Stats
          • Query Details
          • Query Clients
          • Block & Kill
        • Blocking Queries
          • Remove or Unblock
          • Add a Query
          • Blocked Signs
        • Query Quotas
      • Measure & Manage Usage
        • What's Measured
          • Measurement Repositories
        • Measure Data Ingest
        • Optimize Ingestion
          • Best Practices to Optimize Data Ingestion
        • Monitor Usage
        • License Installation
      • Dynamic Configuration
    • Organization Essentials
      • Organization Settings
      • Organization Query Monitor
        • Query Stats
        • Query Details
        • Query Clients
        • Block & Kill
      • Blocking Queries
        • Add Query to Blocklist
        • Blocked Query Indications
    • Configuring Security
      • Tokens in LogScale
      • IP Filters
        • IP Filter Rules
        • Managing IP Filters
        • Creating an IP Filter
        • Editing an IP Filter
      • Security Policies
        • Dashboard Security Policies
        • API Token Security Policies
          • Behavior When Changing Token Security Policies
          • Personal API Token Security Policy
          • Repository and View API Tokens Security Policy
          • Organization API Tokens Security Policies
          • System Tokens Security Policies
        • Actions Security Policies
        • Changing Actions Security Policies
          • Email Action Security Policy
          • OpsGenie Action Security Policy
          • PagerDuty Action Security Policy
          • Slack Action Security Policy
          • Upload file Action Security Policy
          • LogScale repository Action Security Policy
          • VictorOps Action Security Policy
          • Custom webhook actions Action Security Policy
      • API Tokens
        • Using API Tokens
          • Using an Expired API Token
          • Using an IP Filtered API Token
        • Repository and View API Tokens
          • Viewing Repository Tokens
          • Creating Repository API Tokens
          • Managing Repository API Tokens
        • Organization API Tokens
          • Viewing Organization API Tokens
          • Creating Organization API Tokens
          • Managing Organization API Tokens
        • System API Tokens
          • Viewing System Tokens
          • Creating System API Tokens
          • Managing System Tokens
      • Session Management
      • Configure Session Cookies
      • Audit Logging
    • Authentication & Identity Providers
      • Configure Identity Provider
      • SAML Authentication
        • Active Dir. Federation Svc.
        • Azure Active Dir.
        • Duo Security
        • Okta
        • PingFederate
      • OpenID Connect
      • LDAP Authentication
      • OAuth Protocol
        • Authenticating with BitBucket Sign-In
        • Authenticating with GitHub Sign-In
        • Authenticating with Google Sign-In
        • OAuth with Auth0
        • Set the Callback URL
      • Proxy Authentication
      • Single User
      • Root Access
      • Emergency Access
    • Users & permissions
      • Permission Levels
      • Manage Users
        • Edit a User
        • Remove a User
      • Manage Groups
        • Group Roles
        • Group Memberships
        • Group Synchronization
      • Manage Roles
      • Default Role Permissions
      • Repository & View Permissions
      • Organization Admin. Permissions
      • Cluster Management Permissions
      • Supported Functionality
      • Functionality Requirements
      • Setting up Roles in a File
    • Cluster Management
      • Health Checks
      • Auxiliary Nodes
      • Adding & Removing Nodes
      • Node Identifiers
      • Digest Rules
      • Buckets & Archive Storage
        • Bucket Storage
          • Amazon Bucket Storage
            • Other Options
            • Export to S3 Bucket with Amazon
          • Google Bucket
          • MinIO
          • S3 Archiving
          • Secondary Storage
      • Switching Kafka
      • Updating LogScale
      • Replacing Hardware in a Cluster
    • Configuration Settings
      • Basic Configuration
      • Email Configuration
        • SMTP Server Configuration
        • Configure Postmark
      • Feature Flags
      • HTTP Proxy Client
      • IOC Configuration
      • IP Filter
      • JVM Configuration
      • MaxMind Configuration
        • Configuration when behind a Proxy
      • TLS
      • Kafka Configuration
        • Kafka Usage
      • Long-Retention Tuning
      • Launch Stack
    • Ingesting Data
      • Log Shippers
      • Backfilling Data
      • Disabling Ingestion
      • Event Forwarding
        • Event Forwarders
        • Event Forwarding Rules
      • Ingesting FDR Data
        • Cluster Configuration
        • Adjust Polling Nodes
        • Visibility Timeout
        • Ingest FDR Data
          • Troubleshooting FDR Ingest
        • Error Handling
      • Ingest Listeners
      • Ingest Tokens
    • LogScale Configuration Parameters
      • ACTION_LINK_BASE_URL
      • ALERT_DESPITE_WARNINGS
      • ALERT_DISCLAIMER
      • ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
      • ALLOW_CHANGE_REPO_ON_EVENTS
      • ALLOW_XML_DOCTYPE_DECL
      • AUDITLOG_SENSITIVE_RETENTION_DAYS
      • AUTH_ALLOW_SIGNUP
      • AUTH_BY_PROXY_HEADER_NAME
      • AUTHENTICATION_METHOD
      • AUTO_CREATE_USER_ON_SUCCESSFUL_LOGIN
      • AUTO_UPDATE_GROUP_MEMBERSHIPS_ON_SUCCESSFUL_LOGIN
      • AUTO_UPDATE_IP_LOCATION_DB
      • AUTO_UPDATE_MAXMIND
      • AUTOSHARDING_CHECKINTERVAL_MS
      • AUTOSHARDING_MAX
      • AUTOSHARDING_TRIGGER_DELAY_MS
      • AWS_ACCESS_KEY_ID
      • AWS_SECRET_ACCESS_KEY
      • BACKUP_DIR
      • BACKUP_KEY
      • BACKUP_NAME
      • BITBUCKET_OAUTH_CLIENT_ID
      • BITBUCKET_OAUTH_CLIENT_SECRET
      • BOOTSTRAP_HOST_ID
      • BOOTSTRAP_HOST_UUID_COOKIE
      • BOOTSTRAP_ROOT_TOKEN_HASHED
      • BUCKET_STORAGE_SSE_COMPATIBLE
      • BUCKET_STORAGE_IGNORE_ETAG_AFTER_UPLOAD
      • BUCKET_STORAGE_IGNORE_ETAG_UPLOAD
      • BUCKET_STORAGE_MULTIPLE_ENDPOINTS
      • CACHE_STORAGE_DIRECTORY
      • CACHE_STORAGE_PERCENTAGE
      • COMPRESSION_TYPE
      • COOKIE_DOMAIN
      • COOKIE_PATH
      • COOKIE_SAMESITE
      • COOKIE_SECURE
      • CORES
      • CORS_ALLOWED_ORIGINS
      • CREATE_HUMIO_SEARCH_ALL
      • DAYS_BEFORE_TOMBSTONE_DELETION
      • DEFAULT_GROUPS
      • DEFAULT_ALLOW_REBALANCE_EXISTING_SEGMENTS
      • DEFAULT_ALLOW_UPDATE_DESIRED_DIGESTERS
      • DEFAULT_DIGEST_REPLICATION_FACTOR
      • DEFAULT_PARTITION_COUNT
      • DEFAULT_SEGMENT_REPLICATION_FACTOR
      • DELETE_BACKUP_AFTER_MILLIS
      • DELETE_ON_INGEST_QUEUE
      • DIGEST_EXECUTOR_CORES
      • DIGEST_REPLICATION_FACTOR
      • DIRECTORY
      • DISABLE_BUCKET_CLEANING_TMP_FILES
      • DUMP_THREADS_SECONDS
      • ELASTIC_PORT
      • EMAIL_ACTION_DISCLAIMER
      • EMERGENCY_USERS
      • ENABLE_ALERTS
      • ENABLE_BEARER_TOKEN_AUTHORIZATION
      • ENABLE_EVENT_FORWARDING
      • ENABLE_FDR_POLLING_ON_NODE
      • ENABLE_FILTER_ALERTS
      • ENABLE_INGEST_FEED
      • ENABLE_PERSONAL_API_TOKENS
      • ENABLE_QUERY_LOAD_BALANCING
      • ENABLE_SANDBOXES
      • ENABLE_SCHEDULED_SEARCHES
      • ENABLEINTERNALLOGGER
      • ENFORCE_AUDITABLE
      • EXTERNAL_URL
      • EXTRA_KAFKA_CONFIGS_FILE
      • FDR_VISIBILITY_TIMEOUT
      • FDR_USE_PROXY
      • FILTER_ALERTS_MAX_CATCH_UP_LIMIT
      • FILTER_ALERT_MAX_EMAIL_TRIGGER_LIMIT
      • FILTER_ALERT_MAX_NON_EMAIL_TRIGGER_LIMIT
      • FILTER_ALERTS_MAX_WAIT_FOR_MISSING_DATA
      • FLUSH_BLOCK_SECONDS
      • FORWARDING_BREAKER_EXP_BACKOFF_FACTOR
      • FORWARDING_BREAKER_FAILURES
      • FORWARDING_BREAKER_MAX_RESET
      • FORWARDING_BREAKER_RESET
      • FORWARDING_BREAKER_TIMEOUT
      • FORWARDING_MAX_CONCURRENCY
      • GC_KILL_THRESHOLD_MILLIS
      • GCP_STORAGE_BUCKET
      • GCP_STORAGE_CONCURRENCY
      • GCP_STORAGE_ENCRYPTION_KEY
      • GCP_STORAGE_OBJECT_KEY_PREFIX
      • GCP_STORAGE_USE_HTTP_PROXY
      • GCP_EXPORT_WORKLOAD_IDENTITY
      • GCP_STORAGE_WORKLOAD_IDENTITY
      • GITHUB_OAUTH_CLIENT_ID
      • GITHUB_OAUTH_CLIENT_SECRET
      • GLOBAL_THROTTLE_PERCENTAGE
      • GLOB_ALLOW_LIST_EMAIL_ACTIONS
      • GLOB_MATCH_LIMIT
      • GOOGLE_OAUTH_CLIENT_ID
      • GOOGLE_OAUTH_CLIENT_SECRET
      • HTTP_PROXY_ALLOW_ACTIONS_NOT_USE
      • HTTP_PROXY_ALLOW_NOTIFIERS_NOT_USE
      • HTTP_PROXY_HOST
      • HTTP_PROXY_PASSWORD
      • HTTP_PROXY_PORT
      • HTTP_PROXY_USERNAME
      • HUMIO_HTTP_BIND
      • HUMIO_JVM_ARGS
      • HUMIO_KAFKA_TOPIC_PREFIX
      • HUMIO_LOG4J_CONFIGURATION
      • HUMIO_PORT
      • HUMIO_SOCKET_BIND
      • IDLE_POLL_TIME_BEFORE_DASHBOARD_QUERY_IS_CANCELLED_MINUTES
      • INGEST_FEED_POLL_PERIOD
      • INGEST_FEED_AWS_ROLE_ARN
      • INGEST_FEED_AWS_REGION
      • INGEST_FEED_AWS_ACCESS_KEY_ID
      • INGEST_FEED_SECRET_ACCESS_KEY
      • INGEST_FEED_AWS_CREDENTIALS_PROVIDER_USE_PROXY
      • INGEST_FEED_AWS_DOWNLOAD_MAX_OBJECT_SIZE_DEFAULT
      • INGEST_FEED_AWS_PROCESSING_DOWNLOAD_BUFFER_SIZE_DEFAULT
      • INGEST_FEED_AWS_PROCESSING_EVENT_BUFFER_SIZE_DEFAULT
      • INGEST_FEED_AWS_PROCESSING_EVENTS_PER_BATCH_DEFAULT
      • INGEST_FEED_GOVERNOR_INGEST_DELAY_LOW_DEFAULT
      • INGEST_FEED_GOVERNOR_INGEST_DELAY_HIGH_DEFAULT
      • INGEST_FEED_GOVERNOR_INITIAL_RATE_PER_CORE
      • INGEST_FEED_GOVERNOR_GAIN_PER_CORE_DEFAULT
      • INGEST_QUEUE_REPLICATION_FACTOR
      • INITIAL_FEATURE_FLAGS
      • INITIAL_DISABLED_NODE_TASK
      • IOC_CROWDSTRIKE_API_CLIENT_ID
      • IOC_CROWDSTRIKE_API_CLIENT_SECRET
      • IOC_CROWDSTRIKE_API_URL
      • IOC_UPDATE_SERVER_URL
      • IOC_USE_HTTP_PROXY
      • OIDC_USE_HTTP_PROXY
      • IP_FILTER_ACTIONS
      • IP_FILTER_NOTIFIERS
      • IP_FILTER_RDNS_SERVER
      • IP_FILTER_RDNS
      • JWKS_REFRESH_INTERVAL
      • KAFKA_CLIENT_RACK
      • KAFKA_CLIENT_RACK_ENV_VAR
      • KAFKA_MANAGED_BY_HUMIO
      • KAFKA_SERVERS
      • LDAP_AUTH_PRINCIPAL
      • LDAP_AUTH_PRINCIPALS_REGEX
      • LDAP_AUTH_PROVIDER_CERT
      • LDAP_AUTH_PROVIDER_URL
      • LDAP_DOMAIN_NAME
      • LDAP_GROUP_BASE_DN
      • LDAP_GROUP_FILTER
      • LDAP_GROUP_SEARCH_BIND_FOR_LOOKUP
      • LDAP_GROUPNAME_ATTRIBUTE
      • LDAP_SEARCH_BASE_DN
      • LDAP_SEARCH_DOMAIN_NAME
      • LDAP_SEARCH_FILTER
      • LDAP_USERNAME_ATTRIBUTE
      • LDAP_VERBOSE_LOGGING
      • LIVEQUERY_CANCEL_COST_PERCENTAGE
      • LIVEQUERY_CANCEL_TRIGGER_DELAY_MS
      • LOCAL_STORAGE_MIN_AGE_DAYS
      • LOCAL_STORAGE_PERCENTAGE
      • LOCAL_STORAGE_PREFILL_PERCENTAGE
      • MAX_BUCKET_POINTS
      • MAX_CHARS_TO_FIND_TIMESTAMP
      • MAX_CONCURRENT_EXPORTS_PER_VIEW
      • MAX_DISTINCT_TAG_VALUES
      • MAX_EVENT_FIELD_COUNT
      • MAX_EVENT_FIELD_COUNT_IN_PARSER
      • MAX_EVENT_SIZE
      • MAX_FILEUPLOAD_SIZE
      • MAX_GRAPHQL_QUERY_DEPTH
      • MAX_HOURS_SEGMENT_OPEN
      • MAX_INGEST_DELAY_SECONDS
      • MAX_INGEST_REQUEST_SIZE
      • MAX_INTERNAL_STATESIZE
      • MAX_JITREX_BACKTRACK
      • MAX_JOIN_LIMIT
      • MAX_NUMBER_OF_GLOBALDATA_DUMPS_TO_KEEP
      • MAX_SERIES_LIMIT
      • MAX_SERIES_MEMLIMIT
      • MAXMIND_ACCOUNT_ID
      • MAXMIND_BASE_URL
      • MAXMIND_EDITION_ID
      • MAXMIND_IP_LOCATION_EDITION_ID
      • MAXMIND_LICENSE_KEY
      • MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING
      • NODE_ROLES
      • OIDC_AUDIENCE
      • OIDC_AUTHORIZATION_ENDPOINT
      • OIDC_CACHE_USERINFO_MS
      • OIDC_GROUPS_CLAIM
      • OIDC_JWKS_URI
      • OIDC_OAUTH_CLIENT_ID
      • OIDC_OAUTH_CLIENT_SECRET
      • OIDC_PROVIDER
      • OIDC_SCOPES
      • OIDC_SERVICE_NAME
      • OIDC_TOKEN_ENDPOINT_AUTH_METHOD
      • OIDC_TOKEN_ENDPOINT
      • OIDC_USERINFO_ENDPOINT
      • OIDC_USERNAME_CLAIM
      • ONLY_CREATE_USER_IF_SYNCED_GROUPS_HAVE_ACCESS
      • PERMISSION_MODEL_MODE
      • POSTMARK_FROM
      • POSTMARK_SERVER_SECRET
      • PRIMARY_STORAGE_MAX_FILL_PERCENTAGE
      • PRIMARY_STORAGE_PERCENTAGE
      • PROMETHEUS_METRICS_PORT
      • PUBLIC_URL
      • QUERY_CACHE_MIN_COST
      • QUERY_COORDINATOR
      • QUERY_EXECUTOR_CORES
      • RDNS_DEFAULT_SERVER
      • READ_GROUP_PERMISSIONS_FROM_FILE
      • S3_ARCHIVING_ACCESSKEY
      • S3_ARCHIVING_ENDPOINT_BASE
      • S3_ARCHIVING_SECRETKEY
      • S3_ARCHIVING_USE_HTTP_PROXY
      • S3_ARCHIVING_WORKERCOUNT
      • S3_EXPORT_USE_HTTP_PROXY
      • S3_RECOVER_FROM_KMS_KEY_ARN
      • S3_STORAGE_ACCESSKEY
      • S3_STORAGE_BUCKET
      • S3_STORAGE_CONCURRENCY
      • S3_STORAGE_DOWNLOAD_CONCURRENCY
      • S3_STORAGE_ENCRYPTION_KEY
      • S3_STORAGE_ENDPOINT_BASE
      • S3_STORAGE_KMS_KEY_ARN
      • S3_STORAGE_2_KMS_KEY_ARN
      • S3_STORAGE_PREFERRED_COPY_SOURCE
      • S3_STORAGE_OBJECT_KEY_PREFIX
      • S3_STORAGE_REGION
      • S3_STORAGE_SECRETKEY
      • S3_STORAGE_UPLOAD_CONCURRENCY
      • S3_STORAGE_USE_HTTP_PROXY
      • SAML_DEBUG
      • SAML_GROUP_MEMBERSHIP_ATTRIBUTE
      • SAML_IDP_CERTIFICATE
      • SAML_IDP_ENTITY_ID
      • SAML_IDP_SIGN_ON_URL
      • SAML_USER_ATTRIBUTE
      • SANGRIA_LOG_SLOW_MILLIS
      • SCHEDULED_SEARCH_BACKFILL_LIMIT
      • SCHEDULED_SEARCH_DESPITE_WARNINGS
      • SECONDARY_DATA_DIRECTORY
      • SECONDARY_STORAGE_MAX_FILL_PERCENTAGE
      • SEND_USER_INVITES
      • SHARED_DASHBOARDS_ENABLED
      • SHUTDOWN_ABORT_FLUSH_TIMEOUT_MILLIS
      • SINGLE_USER_PASSWORD
      • SINGLE_USER_USERNAME
      • SMTP_HOST
      • SMTP_PASSWORD
      • SMTP_PORT
      • SMTP_SENDER_ADDRESS
      • SMTP_USE_STARTTLS
      • SMTP_USERNAME
      • STATIC_IMAGE_CONTENT_URL
      • STORAGE_REPLICATION_FACTOR
      • STREAMING_QUERY_KEEPALIVE_NEWLINES_ON_NODES
      • STREAMING_QUERY_KEEPALIVE_NEWLINES
      • STREAMING_QUERY_KEEPALIVE_TIMEOUT
      • TAG_HASHING_BUCKETS
      • TCP_INGEST_MAX_TIMEOUT_SECONDS
      • THREAD_SIZE_LOGGING_INTERVAL_SECONDS
      • TLS_CIPHER_SUITES
      • TLS_CLIENT_ALIAS
      • TLS_CLIENT_AUTH
      • TLS_DEFAULT_ALIAS
      • TLS_HOSTNAME_VERIFICATION_FILTER
      • TLS_KEY_PASSWORD
      • TLS_KEYSTORE_TYPE
      • TLS_PROTOCOLS
      • TLS_SERVER
      • TLS_TRUSTSTORE_LOCATION
      • TLS_TRUSTSTORE_PASSWORD
      • TLS_TRUSTSTORE_TYPE
      • TOP_K_MAX_MAP_SIZE_HISTORICAL
      • TOP_K_MAX_MAP_SIZE_LIVE
      • UI_AUTH_FLOW
      • USING_EPHEMERAL_DISKS
      • VALUE_DEDUP_LEVEL
      • VERBOSE_AUTH
      • WARN_ON_INGEST_DELAY_MILLIS
      • ZONE
      • ZOOKEEPER_PREFIX_FOR_NODE_UUID
      • ZOOKEEPER_SESSIONTIMEOUT_FOR_NODE_UUID
      • ZOOKEEPER_URL_FOR_NODE_UUID
      • ZOOKEEPER_URL
      • MAX_SECS_WAIT_FOR_SYNC_WHEN_CHANGING_DIGEST_LEADER
    • LogScale URLs & Endpoints
    • Limits & Standards

  • Data Analysis 1.107.0-1.112.0

    • Data Analysis Overview
    • LogScale User Interface
      • Managing Your Account
    • Repositories & Views
      • Create Repository or View
      • Repository and View Settings
      • Falcon LTR Repositories
      • Lookup Files
      • Delete Repositories & Views
    • Parsing Data
      • Built-in Parsers
      • Creating a Parser
      • Ingest Tokens
      • Multiple Repositories
      • Parser Errors
      • Removing Fields
      • Event Tags
      • Parsing Timestamps
    • Searching Data
      • Query Editor
      • Event Fields
      • Display Fields
      • Select & Filter
      • Adding & Removing Fields
      • Inspect Events
      • Show in Context
      • Format Columns
      • Column Properties
      • Field Data Types
      • Field Interactions
      • Different Visuals
      • Highlight Filter Match
      • Change Time Interval
      • Set Time Zone
      • Save Searches
      • Export Data
      • Event Display Methods
      • Search Status
      • Event List Interactions
    • Writing Queries
      • Basic Query Principles
      • Managing Queries
      • Common Queries
      • Writing Better Queries
      • Query Readability & Better Usage
      • Example Queries
    • Dashboards & Widgets
      • Create Dashboards and Widgets
      • Manage Widgets
      • Manage Dashboards
      • Edit Dashboards
      • Organize Information on Dashboards
      • Manage Dashboard Parameters
      • Manage Dashboard Interactions
      • Export Dashboards as PDF
        • PDF Export Options
      • Widgets
        • Bar Chart Widget
        • Event List Widget
        • Gauge Widget
        • Heat Map Widget
        • Note Widget
        • Pie Chart Widget
        • Sankey Diagram Widget
        • Scatter Chart Widget
        • Single Value Widget
        • Table Widget
        • Time Chart Widget
        • World Map Widget
        • Embedding iFrame Widgets
    • Automation
      • Alerts
        • Filter Alerts
        • Standard Alerts
        • Alert Activities
        • Creating Alerts
        • Managing Alerts
        • Editing an Alert
        • Setting Alert Throttle Period
        • Sending Aggregate Results to Actions
        • Monitoring Alerts
        • Diagnosing Alerts
          • Errors when Using Live join() Functions
          • Monitor Alerts with humio-activity Repository
            • Alert Raw Event Example
      • Scheduled Searches
        • Creating a Scheduled Search
        • Spacing Out Searches
        • Scheduled Search Errors and Resolutions
      • Scheduled PDF Reports
        • Scheduled Reports Security
          • Creating a Scheduled PDF Role using the UI
        • Managing Scheduled Reports
        • Creating Scheduled Reports
        • Editing Scheduled Reports
        • Limitations
        • Scheduled Reports Errors and Resolutions
      • Cron Schedule Templates
      • Actions
        • Creating Actions
        • Managing Actions
        • Action Type: Email
        • Action Type: Falcon LogScale Repository
        • Action Type: OpsGenie
        • Action Type: PagerDuty
        • Action Type: Slack
        • Action Type: Upload File
        • Action Type: VictorOps (Splunk On-Call)
        • Action Type: Webhooks
        • Message Templates and Variables
      • Troubleshoot Alerts and Scheduled Searches
    • Query Language Syntax
      • Query Filters
      • Operators
      • Adding Fields
      • User Parameters/Variables
      • Conditional Expressions
      • Query Joins
      • Array Syntax
      • Function Syntax
      • Time Syntax
        • Supported Timezones
        • Relative Time Syntax
      • Regular Expression Syntax
        • Regular Expression Syntax Patterns
        • Unsupported Regular Expression Patterns
        • Regular Expression Flags
        • Differences from Other Regex Implementations
    • Query Functions
      • Function Types and Arguments
      • Aggregate Query Functions
      • Array Query Functions
      • Comparison Query Functions
      • Condition Query Functions
      • Event & Data Manipulation Query Functions
      • Filtering Query Functions
      • Formatting Query Functions
      • Geolocation Query Functions
      • Hash Query Functions
      • Join Query Functions
      • Math Query Functions
      • Network & Location Query Functions
      • Parsing Query Functions
      • Regular Expression Query Functions
      • Security Query Functions
      • Statistics Query Functions
      • String Query Functions
      • Time & Date Query Functions
      • Widget Query Functions
      • array:append()
      • array:contains()
      • array:eval()
      • array:filter()
      • array:intersection()
      • array:reduceAll()
      • array:reduceRow()
      • array:reduceColumn()
      • array:regex()
      • array:union()
      • asn()
      • avg()
      • base64Decode()
      • beta:param()
      • beta:repeating()
      • bitfield:extractFlags()
      • bucket()
      • callFunction()
      • cidr()
      • collect()
      • communityId()
      • concat()
      • concatArray()
      • copyEvent()
      • count()
      • counterAsRate()
      • createEvents()
      • crypto:md5()
      • default()
      • drop()
      • dropEvent()
      • end()
      • eval()
      • eventFieldCount()
      • eventInternals()
      • eventSize()
      • fieldset()
      • fieldstats()
      • findTimestamp()
      • format()
      • formatDuration()
      • formatTime()
      • geography:distance()
      • geohash()
      • groupBy()
      • hash()
      • hashMatch()
      • hashRewrite()
      • head()
      • in()
      • ioc:lookup()
      • ipLocation()
      • join()
      • json:prettyPrint()
      • kvParse()
      • length()
      • linReg()
      • lookup()
      • lower()
      • lowercase()
      • match()
      • math:abs()
      • math:arccos()
      • math:arcsin()
      • math:arctan()
      • math:arctan2()
      • math:ceil()
      • math:cos()
      • math:cosh()
      • math:deg2rad()
      • math:exp()
      • math:expm1()
      • math:floor()
      • math:log()
      • math:log10()
      • math:log1p()
      • math:log2()
      • math:mod()
      • math:pow()
      • math:rad2deg()
      • math:sin()
      • math:sinh()
      • math:spherical2cartesian()
      • math:sqrt()
      • math:tan()
      • math:tanh()
      • max()
      • min()
      • now()
      • parseCEF()
      • parseCsv()
      • parseFixedWidth()
      • parseHexString()
      • parseInt()
      • parseJson()
      • parseLEEF()
      • parseTimestamp()
      • parseUrl()
      • parseXml()
      • percentile()
      • range()
      • rdns()
      • regex()
      • rename()
      • replace()
      • round()
      • sample()
      • sankey()
      • select()
      • selectFromMax()
      • selectFromMin()
      • selectLast()
      • selfJoin()
      • selfJoinFilter()
      • series()
      • session()
      • shannonEntropy()
      • sort()
      • split()
      • splitString()
      • start()
      • stats()
      • stdDev()
      • stripAnsiCodes()
      • subnet()
      • sum()
      • table()
      • tail()
      • test()
      • text:contains()
      • time:dayOfMonth()
      • time:dayOfWeek()
      • time:dayOfWeekName()
      • time:dayOfYear()
      • time:hour()
      • time:millisecond()
      • time:minute()
      • time:month()
      • time:monthName()
      • time:second()
      • time:weekOfYear()
      • time:year()
      • timeChart()
      • tokenHash()
      • top()
      • transpose()
      • unit:convert()
      • upper()
      • urlDecode()
      • urlEncode()
      • wildcard()
      • window()
      • worldMap()
      • writeJson()
      • xml:prettyPrint()
    • Template Language
      • Template Expressions
      • Template Variable Types
      • Template Examples
    • Keyboard Shortcuts
LogScale Self-Hosted (LTS)
Falcon LogScale Documentation
/ Falcon LogScale Self-Hosted 1.107.0-1.112.0
/ LogScale Configuration Parameters

INGEST_FEED_GOVERNOR_INGEST_DELAY_HIGH_DEFAULT

VariableINGEST_FEED_GOVERNOR_INGEST_DELAY_HIGH_DEFAULT
Introduced Version1.113
Description

The default ingest delay high setpoint for the ingest feed governor. If the ingest delay is greater than the value specified, ingest feeds may decrease ingest.

The dynamic configuration can override the value of the environment variable.

Default10 seconds
File last updated:
Support
  • Twitter
  • Facebook
  • LinkedIn
  • Youtube

© 2024 CrowdStrike All other marks contained herein are the property of their respective owners.

Not Available

Cloud USCloud EU

Enter search term