LogScale will detect for a high load on a data source, and trigger auto-sharding. The events then get an extra tag, #humioAutoShard that is assigned a random integer value.

This is configured through the settings AUTOSHARDING_TRIGGER_DELAY_MS, which is compared to the time an event spends in the ingest pipeline. When the delay threshold is exceeded, the number of shards on that data source is doubled. The default value for AUTOSHARDING_TRIGGER_DELAY_MS is 5000 ms (5 seconds). The delay needs to be increasing as well, as noted two times in a row at an interval of AUTOSHARDING_CHECKINTERVAL_MS.

See Cluster Management for more information.