Skip to content
LogoLogScale DocumentationFull Library Knowledge Base Release Notes Integrations Training API GraphQL API Contacting Support
help

Versions of this Page

    • Self-Hosted Overview
    • Installing LogScale
      • System Requirements
      • Installing Using Containers
        • Container Deployment Using humio-core
          • Deploying a Kafka Cluster using Containers
          • Deploying a LogScale Cluster using Containers
        • Container Deployment Using humio-single-node-demo (Testing Only)
        • LogScale Kubernetes Reference Architecture
          • Humio Operator Overview
          • Cluster topology
          • Kubernetes Deployment Requirements
          • Deploying Prerequisites
          • Basic Architecture Configuration
          • Advanced Architecture Configuration
          • Kubernetes Deployment Limits
          • Deployment for High Availability
          • Disaster Recovery
          • Additional Considerations
          • Scaling a HumioCluster Up or Down
        • LogScale Deployment using Kubernetes
          • Install LogScale Operator on Kubernetes
          • AWS Cloud Reference Architecture
          • AWS Cloud Reference Deployment and Automation
          • Deploying LogScale with Operator on Google Cloud Platform (GCP)
            • Component Version Requirements
            • GCP Deployment Prerequisites
            • Deploy GCP Resources and LogScale
            • Accessing the Deployed GCP LogScale Instance
            • Testing GCP Deployment
            • GCP Deployment Cleanup
          • LogScale Operator Resource Management
          • Upgrading LogScale Operator on Kubernetes
      • Installing On Bare Metal or Cloud Instance
        • Preparing for Installation
        • Individual Node Configuration
        • Installing Java
        • Installing Native Kafka
          • Kafka with ZooKeeper
          • Kafka using Kraft
        • Deploying Kafka using Amazon MSK
        • Installing LogScale
        • LogScale Launcher Script
      • Installing Load Balancers
        • Apache Reverse Proxy
        • Caddy Reverse Proxy
        • Nginx Reverse Proxy
        • HAProxy Reverse Proxy
          • Configuring HAProxy as a Service
      • Deploying Auxiliary Services
        • PDF Render Service
          • Deploying Single PDF Render Services
          • Deploying Multiple PDF Render Services
          • PDF Render Server Configuration Options
          • Adding PDF Render to LogScale Configuration
          • Monitoring Auxiliary PDF Service
    • Instance Administration
      • Cluster statistics
      • Data Retention
      • LogScale Internal Logging
      • LogScale Multi-Cluster Search
        • Understanding Multi-Cluster Topologies
        • Multi-Cluster Security
        • Configuring Multi-Cluster
        • Creating a Multi-Cluster View using LogScale UI
        • Creating a Multi-Cluster View using GraphQL
          • Adding a remote connection
          • Changing Remote connections
          • Adding a local connection
          • Changing local connections
          • Deleting connections
        • Enabling Multi-Cluster Feature Flags
        • Multi-Cluster Version Support
        • Query Function Limitations
        • Identifying Queries on Remote Clusters
        • Messages During Multi-Cluster Queries
      • Log LogScale to LogScale
      • Query Administration
        • Query Monitor
          • Query Stats
          • Query Details
          • Query Clients
          • Block & Kill
        • Blocking Queries
          • Remove or Unblock
          • Add a Query
          • Blocked Signs
        • Query Quotas
      • Measure & Manage Ingest Usage
        • What's Measured
          • Measurement Repositories
        • Measure Data Ingest
        • Optimize Ingestion
          • Best Practices to Optimize Data Ingestion
        • Monitor Usage
        • License Installation
      • Dynamic Configuration Parameters
        • BucketStorageKeySchemeVersion
        • BucketStorageUploadInfrequentThresholdDays
        • BucketStorageWriteVersion
        • defaultDigestReplicationFactor
        • defaultSegmentReplicationFactor
        • DelayIngestResponseDueToIngestLagScale
        • DelayIngestResponseDueToIngestLagMaxFactor
        • DelayIngestResponseDueToIngestLagThreshold
        • FdrEnable
        • FdrExcludedNodes
        • FdrMaxNodes
        • FlushSegmentsAndGlobalOnShutdown
        • GraphQLSelectionSizeLimit
        • GraphQlDirectivesAmountLimit
        • GroupDefaultLimit
        • GroupMaxLimit
        • IngestFeedAwsDownloadMaxObjectSize
        • IngestFeedAwsProcessingDownloadBufferSize
        • IngestFeedAwsProcessingEventBufferSize
        • IngestFeedAwsProcessingEventsPerBatch
        • IngestFeedGovernorRateOverride
        • IngestFeedGovernorIngestDelayHigh
        • IngestFeedGovernorIngestDelayLow
        • JoinRowLimit
        • LiveQueryMemoryLimit
        • LookupTableSyncAwaitSeconds
        • MatchFilesMaxHeapFraction
        • MaxCsvFileUploadSizeBytes
        • MaxIngestRequestSize
        • MaxJsonFileUploadSizeBytes
        • MaxOpenSegmentsOnWorker
        • QueryBacktrackingLimit
        • QueryCoordinatorMaxHeapFraction
        • QueryCoordinatorMemoryLimit
        • QueryMemoryLimit
        • QueryPartitionAutoBalance
        • QueryResultRowCountLimit
        • RdnsDefaultLimit
        • RdnsMaxLimit
        • ReplaceANSIEscapeCodes
        • StateRowLimit
        • StaticQueryFractionOfCores
        • TableCacheMaxStorageFraction
        • TableCacheMaxStorageFractionForIngestAndHttpOnly
        • TargetMaxRateForDatasource
        • UnauthenticatedGraphQLSelectionSizeLimit
        • UndersizedMergingRetentionPercentage
        • Getting Dynamic Configuration List
        • Setting a Dynamic Configuration Value
    • Organization Essentials
      • Organization Settings
      • Organization Query Monitor
        • Query Stats
        • Query Details
        • Query Clients
        • Block & Kill
      • Blocking Queries
        • Add Query to Blocklist
        • Blocked Query Indications
    • Configuring Security
      • Tokens in LogScale
      • IP Filters
        • IP Filter Rules
        • Managing IP Filters
        • Creating an IP Filter
        • Editing an IP Filter
      • Security Policies
        • Dashboard Security Policies
        • API Token Security Policies
          • Behavior When Changing Token Security Policies
          • Personal API Token Security Policy
          • Repository and View API Tokens Security Policy
          • Organization API Tokens Security Policies
          • System Tokens Security Policies
        • Actions Security Policies
        • Changing Actions Security Policies
          • Email Action Security Policy
          • OpsGenie Action Security Policy
          • PagerDuty Action Security Policy
          • Slack Action Security Policy
          • Upload file Action Security Policy
          • LogScale repository Action Security Policy
          • VictorOps Action Security Policy
          • Custom webhook actions Action Security Policy
      • API Tokens
        • Using API Tokens
          • Using an Expired API Token
          • Using an IP Filtered API Token
        • Repository and View API Tokens
          • Viewing Repository Tokens
          • Creating Repository API Tokens
          • Managing Repository API Tokens
        • Organization API Tokens
          • Viewing Organization API Tokens
          • Creating Organization API Tokens
          • Managing Organization API Tokens
        • System API Tokens
          • Viewing System Tokens
          • Creating System API Tokens
          • Managing System Tokens
      • Session Management
      • Configure Session Cookies
      • Audit Logging
    • Authentication & Identity Providers
      • Configure Identity Provider
      • SAML Authentication
        • Active Dir. Federation Svc.
        • Azure Active Dir.
        • Duo Security
        • Okta
        • PingFederate
      • OpenID Connect
      • LDAP Authentication
      • OAuth Protocol
        • Authenticating with BitBucket Sign-In
        • Authenticating with GitHub Sign-In
        • Authenticating with Google Sign-In
        • OAuth with Auth0
        • Set the Callback URL
      • Proxy Authentication
      • Single User
      • Root Access
      • Emergency Access
    • Users & permissions
      • Permission Levels
      • Manage Users
        • Edit a User
        • Manage User Roles
        • Remove a User
      • Manage Groups
        • Group Roles
        • Group Memberships
        • Group Synchronization
      • Manage Roles
      • Default Role Permissions
      • Repository & View Permissions
      • Organization Admin. Permissions
      • Cluster Management Permissions
      • Supported Functionality
      • Functionality Requirements
      • Setting up Roles in a File
    • Cluster Management
      • Cluster nodes
      • Auxiliary Nodes
      • Adding & Removing Nodes
      • Node Identifiers
      • Digest Rules
      • Data Storage, Buckets and Archiving
        • Bucket Storage
          • Amazon Bucket Storage
            • Other Options
            • Export to S3 Bucket with Amazon
          • Google Bucket
          • MinIO
          • S3 Archiving
          • Secondary Storage
      • Switching Kafka
        • Switch Kafka and ZooKeeper
        • Switch Kafka using Kraft Mode
      • Updating LogScale
      • Replacing Hardware in a Cluster
      • Health Checks
    • Configuration Settings
      • Basic Configuration
      • Email Configuration
        • SMTP Server Configuration
        • Configure Postmark
      • Feature Flags
      • HTTP Proxy Client
      • IOC Configuration
      • IP Filter
      • JVM Configuration
      • MaxMind Configuration
      • TLS
      • Kafka Configuration
        • Kafka Usage
      • Long-Retention Tuning
    • Ingesting Data
      • Log Shippers
      • Backfilling Data
      • Disabling Ingestion
      • Event Forwarding
        • Event Forwarders
        • Event Forwarding Rules
      • Ingesting FDR Data
        • Cluster Configuration
        • Adjust Polling Nodes
        • Visibility Timeout
        • Ingest FDR Data
          • Troubleshooting FDR Ingest
        • Error Handling
      • Ingest Listeners
      • Ingest Tokens
      • Ingest Data from AWS S3
        • S3 Ingest Self-hosted Preparation
        • Set up a New Ingest Feed
        • Edit Ingest Feed Configuration
        • Delete an Ingest Feed
        • Enable and Disable Ingest Feeds
    • LogScale Configuration Parameters
      • ACTION_LINK_BASE_URL
      • ALERT_DESPITE_WARNINGS
      • ALERT_DISCLAIMER
      • ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
      • ALLOW_CHANGE_REPO_ON_EVENTS
      • ALLOW_XML_DOCTYPE_DECL
      • API_EXPLORER_ENABLED
      • AUDITLOG_SENSITIVE_RETENTION_DAYS
      • AUTH_ALLOW_SIGNUP
      • AUTH_BY_PROXY_HEADER_NAME
      • AUTHENTICATION_METHOD
      • AUTO_CREATE_USER_ON_SUCCESSFUL_LOGIN
      • AUTO_UPDATE_GROUP_MEMBERSHIPS_ON_SUCCESSFUL_LOGIN
      • AUTO_UPDATE_IP_LOCATION_DB
      • AUTO_UPDATE_MAXMIND
      • AUTOSHARDING_CHECKINTERVAL_MS
      • AUTOSHARDING_MAX
      • AUTOSHARDING_TRIGGER_DELAY_MS
      • AWS_ACCESS_KEY_ID
      • AWS_SECRET_ACCESS_KEY
      • BACKUP_DIR
      • BACKUP_KEY
      • BACKUP_NAME
      • BITBUCKET_OAUTH_CLIENT_ID
      • BITBUCKET_OAUTH_CLIENT_SECRET
      • BOOTSTRAP_HOST_ID
      • BOOTSTRAP_HOST_UUID_COOKIE
      • BOOTSTRAP_ROOT_TOKEN_HASHED
      • BUCKET_STORAGE_SSE_COMPATIBLE
      • BUCKET_STORAGE_IGNORE_ETAG_AFTER_UPLOAD
      • BUCKET_STORAGE_IGNORE_ETAG_UPLOAD
      • BUCKET_STORAGE_MULTIPLE_ENDPOINTS
      • CACHE_STORAGE_DIRECTORY
      • CACHE_STORAGE_PERCENTAGE
      • COMPRESSION_TYPE
      • COOKIE_DOMAIN
      • COOKIE_PATH
      • COOKIE_SAMESITE
      • COOKIE_SECURE
      • CORES
      • CORS_ALLOWED_ORIGINS
      • CREATE_HUMIO_SEARCH_ALL
      • DAYS_BEFORE_TOMBSTONE_DELETION
      • DEFAULT_GROUPS
      • DEFAULT_ALLOW_REBALANCE_EXISTING_SEGMENTS
      • DEFAULT_ALLOW_UPDATE_DESIRED_DIGESTERS
      • DEFAULT_DIGEST_REPLICATION_FACTOR
      • AGGREGATE_ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
      • FILTER_ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
      • DEFAULT_SEGMENT_REPLICATION_FACTOR
      • DELETE_BACKUP_AFTER_MILLIS
      • DELETE_ON_INGEST_QUEUE
      • DIGEST_EXECUTOR_CORES
      • DIGEST_REPLICATION_FACTOR
      • DIRECTORY
      • DISABLE_BUCKET_CLEANING_TMP_FILES
      • DUMP_THREADS_SECONDS
      • ELASTIC_PORT
      • EMAIL_ACTION_DISCLAIMER
      • EMERGENCY_USERS
      • ENABLE_ALERTS
      • ENABLE_BEARER_TOKEN_AUTHORIZATION
      • ENABLE_EVENT_FORWARDING
      • ENABLE_FDR_POLLING_ON_NODE
      • ENABLE_AGGREGATE_ALERTS
      • ENABLE_FILTER_ALERTS
      • ENABLE_INGEST_FEED
      • ENABLE_PERSONAL_API_TOKENS
      • ENABLE_QUERY_LOAD_BALANCING
      • ENABLE_SANDBOXES
      • ENABLE_SCHEDULED_SEARCHES
      • ENABLEINTERNALLOGGER
      • ENFORCE_AUDITABLE
      • EXTERNAL_URL
      • EXTRA_KAFKA_CONFIGS_FILE
      • FDR_VISIBILITY_TIMEOUT
      • FDR_USE_PROXY
      • AGGREGATE_ALERTS_MAX_CATCH_UP_LIMIT
      • FILTER_ALERTS_MAX_CATCH_UP_LIMIT
      • FILTER_ALERT_MAX_EMAIL_TRIGGER_LIMIT
      • FILTER_ALERT_MAX_NON_EMAIL_TRIGGER_LIMIT
      • FILTER_ALERTS_MAX_WAIT_FOR_MISSING_DATA
      • FLUSH_BLOCK_SECONDS
      • FORWARDING_BREAKER_EXP_BACKOFF_FACTOR
      • FORWARDING_BREAKER_FAILURES
      • FORWARDING_BREAKER_MAX_RESET
      • FORWARDING_BREAKER_RESET
      • FORWARDING_BREAKER_TIMEOUT
      • FORWARDING_MAX_CONCURRENCY
      • GC_KILL_THRESHOLD_MILLIS
      • GCP_STORAGE_BUCKET
      • GCP_STORAGE_CONCURRENCY
      • GCP_STORAGE_ENCRYPTION_KEY
      • GCP_STORAGE_OBJECT_KEY_PREFIX
      • GCP_STORAGE_USE_HTTP_PROXY
      • GCP_EXPORT_WORKLOAD_IDENTITY
      • GCP_STORAGE_WORKLOAD_IDENTITY
      • GITHUB_OAUTH_CLIENT_ID
      • GITHUB_OAUTH_CLIENT_SECRET
      • GLOBAL_THROTTLE_PERCENTAGE
      • GLOB_ALLOW_LIST_EMAIL_ACTIONS
      • GLOB_MATCH_LIMIT
      • GOOGLE_OAUTH_CLIENT_ID
      • GOOGLE_OAUTH_CLIENT_SECRET
      • HTTP_PROXY_ALLOW_ACTIONS_NOT_USE
      • HTTP_PROXY_ALLOW_NOTIFIERS_NOT_USE
      • HTTP_PROXY_HOST
      • HTTP_PROXY_PASSWORD
      • HTTP_PROXY_PORT
      • HTTP_PROXY_USERNAME
      • HUMIO_HTTP_BIND
      • HUMIO_JVM_ARGS
      • HUMIO_KAFKA_TOPIC_PREFIX
      • HUMIO_LOG4J_CONFIGURATION
      • HUMIO_PORT
      • HUMIO_SOCKET_BIND
      • IDLE_POLL_TIME_BEFORE_DASHBOARD_QUERY_IS_CANCELLED_MINUTES
      • INGEST_FEED_POLL_PERIOD
      • INGEST_FEED_AWS_ROLE_ARN
      • INGEST_FEED_AWS_REGION
      • INGEST_FEED_AWS_ACCESS_KEY_ID
      • INGEST_FEED_SECRET_ACCESS_KEY
      • INGEST_FEED_AWS_CREDENTIALS_PROVIDER_USE_PROXY
      • INGEST_FEED_AWS_DOWNLOAD_MAX_OBJECT_SIZE_DEFAULT
      • INGEST_FEED_AWS_PROCESSING_DOWNLOAD_BUFFER_SIZE_DEFAULT
      • INGEST_FEED_AWS_PROCESSING_EVENT_BUFFER_SIZE_DEFAULT
      • INGEST_FEED_AWS_PROCESSING_EVENTS_PER_BATCH_DEFAULT
      • INGEST_FEED_GOVERNOR_INGEST_DELAY_LOW_DEFAULT
      • INGEST_FEED_GOVERNOR_INGEST_DELAY_HIGH_DEFAULT
      • INGEST_FEED_GOVERNOR_INITIAL_RATE_PER_CORE
      • INGEST_FEED_GOVERNOR_GAIN_PER_CORE_DEFAULT
      • INGEST_OCCUPANCY_QUERY_PERMIT_LIMIT
      • INGEST_QUEUE_REPLICATION_FACTOR
      • INITIAL_FEATURE_FLAGS
      • INITIAL_DISABLED_NODE_TASK
      • IOC_CROWDSTRIKE_API_CLIENT_ID
      • IOC_CROWDSTRIKE_API_CLIENT_SECRET
      • IOC_CROWDSTRIKE_API_URL
      • IOC_UPDATE_SERVER_URL
      • IOC_USE_HTTP_PROXY
      • OIDC_USE_HTTP_PROXY
      • IP_FILTER_ACTIONS
      • IP_FILTER_NOTIFIERS
      • IP_FILTER_RDNS_SERVER
      • IP_FILTER_RDNS
      • JWKS_REFRESH_INTERVAL
      • KAFKA_CLIENT_RACK
      • KAFKA_CLIENT_RACK_ENV_VAR
      • KAFKA_MANAGED_BY_HUMIO
      • KAFKA_SERVERS
      • LDAP_AUTH_PRINCIPAL
      • LDAP_AUTH_PRINCIPALS_REGEX
      • LDAP_AUTH_PROVIDER_CERT
      • LDAP_AUTH_PROVIDER_URL
      • LDAP_DOMAIN_NAME
      • LDAP_GROUP_BASE_DN
      • LDAP_GROUP_FILTER
      • LDAP_GROUP_SEARCH_BIND_FOR_LOOKUP
      • LDAP_GROUPNAME_ATTRIBUTE
      • LDAP_SEARCH_BASE_DN
      • LDAP_SEARCH_DOMAIN_NAME
      • LDAP_SEARCH_FILTER
      • LDAP_USERNAME_ATTRIBUTE
      • LDAP_VERBOSE_LOGGING
      • LIVEQUERY_CANCEL_COST_PERCENTAGE
      • LIVEQUERY_CANCEL_TRIGGER_DELAY_MS
      • LOCAL_STORAGE_MIN_AGE_DAYS
      • LOCAL_STORAGE_PERCENTAGE
      • LOCAL_STORAGE_PREFILL_PERCENTAGE
      • MAX_BUCKET_POINTS
      • MAX_CHARS_TO_FIND_TIMESTAMP
      • MAX_CONCURRENT_EXPORTS_PER_VIEW
      • MAX_DISTINCT_TAG_VALUES
      • MAX_EVENT_FIELD_COUNT
      • MAX_EVENT_FIELD_COUNT_IN_PARSER
      • MAX_EVENT_SIZE
      • MAX_FILEUPLOAD_SIZE
      • MAX_GRAPHQL_QUERY_DEPTH
      • MAX_HOURS_SEGMENT_OPEN
      • MAX_INGEST_DELAY_SECONDS
      • MAX_INGEST_REQUEST_SIZE
      • MAX_INTERNAL_STATESIZE
      • MAX_JITREX_BACKTRACK
      • MAX_JOIN_LIMIT
      • MAX_NUMBER_OF_GLOBALDATA_DUMPS_TO_KEEP
      • MAX_SERIES_LIMIT
      • MAX_SERIES_MEMLIMIT
      • MAXMIND_ACCOUNT_ID
      • MAXMIND_BASE_URL
      • MAXMIND_EDITION_ID
      • MAXMIND_IP_LOCATION_EDITION_ID
      • MAXMIND_LICENSE_KEY
      • MERGE_TARGET_RETENTION_PERCENTAGE
      • MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING
      • MINISEGMENT_PREMERGE_MIN_FILES
      • MINISEGMENT_PREMERGE_MAX_BLOCKS
      • NODE_ROLES
      • OIDC_AUDIENCE
      • OIDC_AUTHORIZATION_ENDPOINT
      • OIDC_CACHE_USERINFO_MS
      • OIDC_GROUPS_CLAIM
      • OIDC_JWKS_URI
      • OIDC_OAUTH_CLIENT_ID
      • OIDC_OAUTH_CLIENT_SECRET
      • OIDC_PROVIDER
      • OIDC_SCOPES
      • OIDC_SERVICE_NAME
      • OIDC_TOKEN_ENDPOINT_AUTH_METHOD
      • OIDC_TOKEN_ENDPOINT
      • OIDC_USERINFO_ENDPOINT
      • OIDC_USERNAME_CLAIM
      • ONLY_CREATE_USER_IF_SYNCED_GROUPS_HAVE_ACCESS
      • PERMISSION_MODEL_MODE
      • POSTMARK_FROM
      • POSTMARK_SERVER_SECRET
      • PRIMARY_STORAGE_MAX_FILL_PERCENTAGE
      • PRIMARY_STORAGE_PERCENTAGE
      • PROMETHEUS_METRICS_PORT
      • PUBLIC_URL
      • QUERY_CACHE_MIN_COST
      • QUERY_COORDINATOR
      • QUERY_EXECUTOR_CORES
      • RDNS_DEFAULT_SERVER
      • READ_GROUP_PERMISSIONS_FROM_FILE
      • S3_ARCHIVING_ACCESSKEY
      • S3_ARCHIVING_ENDPOINT_BASE
      • S3_ARCHIVING_SECRETKEY
      • S3_ARCHIVING_USE_HTTP_PROXY
      • S3_ARCHIVING_WORKERCOUNT
      • S3_EXPORT_USE_HTTP_PROXY
      • S3_RECOVER_FROM_KMS_KEY_ARN
      • S3_STORAGE_ACCESSKEY
      • S3_STORAGE_BUCKET
      • S3_STORAGE_CONCURRENCY
      • S3_STORAGE_ENCRYPTION_KEY
      • S3_STORAGE_ENDPOINT_BASE
      • S3_STORAGE_KMS_KEY_ARN
      • S3_STORAGE_2_KMS_KEY_ARN
      • S3_STORAGE_PREFERRED_COPY_SOURCE
      • S3_STORAGE_OBJECT_KEY_PREFIX
      • S3_STORAGE_REGION
      • S3_STORAGE_SECRETKEY
      • S3_STORAGE_USE_HTTP_PROXY
      • SAML_DEBUG
      • SAML_GROUP_MEMBERSHIP_ATTRIBUTE
      • SAML_IDP_CERTIFICATE
      • SAML_ALTERNATIVE_IDP_CERTIFICATE
      • SAML_IDP_ENTITY_ID
      • SAML_IDP_SIGN_ON_URL
      • SAML_USER_ATTRIBUTE
      • SANGRIA_LOG_SLOW_MILLIS
      • SCHEDULED_SEARCH_BACKFILL_LIMIT
      • SCHEDULED_SEARCH_DESPITE_WARNINGS
      • SCHEDULED_SEARCH_MAX_WAIT_FOR_MISSING_DATA
      • SECONDARY_DATA_DIRECTORY
      • SECONDARY_STORAGE_MAX_FILL_PERCENTAGE
      • SEND_USER_INVITES
      • SHARED_DASHBOARDS_ENABLED
      • SHUTDOWN_ABORT_FLUSH_TIMEOUT_MILLIS
      • SINGLE_USER_PASSWORD
      • SINGLE_USER_USERNAME
      • SMTP_HOST
      • SMTP_PASSWORD
      • SMTP_PORT
      • SMTP_SENDER_ADDRESS
      • SMTP_USE_STARTTLS
      • SMTP_USERNAME
      • STATIC_IMAGE_CONTENT_URL
      • STORAGE_REPLICATION_FACTOR
      • STREAMING_QUERY_KEEPALIVE_NEWLINES_ON_NODES
      • STREAMING_QUERY_KEEPALIVE_NEWLINES
      • STREAMING_QUERY_KEEPALIVE_TIMEOUT
      • TABLE_CACHE_MAX_STORAGE_FRACTION
      • TABLE_CACHE_MAX_STORAGE_FRACTION_FOR_INGEST_AND_HTTP_ONLY
      • TAG_HASHING_BUCKETS
      • TCP_INGEST_MAX_TIMEOUT_SECONDS
      • THREAD_SIZE_LOGGING_INTERVAL_SECONDS
      • TLS_CIPHER_SUITES
      • TLS_CLIENT_ALIAS
      • TLS_CLIENT_AUTH
      • TLS_DEFAULT_ALIAS
      • TLS_HOSTNAME_VERIFICATION_FILTER
      • TLS_KEY_PASSWORD
      • TLS_KEYSTORE_TYPE
      • TLS_PROTOCOLS
      • TLS_SERVER
      • TLS_TRUSTSTORE_LOCATION
      • TLS_TRUSTSTORE_PASSWORD
      • TLS_TRUSTSTORE_TYPE
      • TOP_K_MAX_MAP_SIZE_HISTORICAL
      • TOP_K_MAX_MAP_SIZE_LIVE
      • UI_AUTH_FLOW
      • UNSAFE_ALLOW_FEDERATED_MATCH
      • UNSAFE_RELAX_FEDERATED_PROTOCOL_VERSION_CHECK
      • USING_EPHEMERAL_DISKS
      • VALUE_DEDUP_LEVEL
      • VERBOSE_AUTH
      • WARN_ON_INGEST_DELAY_MILLIS
      • ZONE
      • ZOOKEEPER_PREFIX_FOR_NODE_UUID
      • ZOOKEEPER_SESSIONTIMEOUT_FOR_NODE_UUID
      • ZOOKEEPER_URL_FOR_NODE_UUID
      • ZOOKEEPER_URL
      • MAX_SECS_WAIT_FOR_SYNC_WHEN_CHANGING_DIGEST_LEADER
    • LogScale URLs & Endpoints
    • Limits & Standards
    • Data Analysis Overview
    • LogScale User Interface
      • Managing Your Account
    • Repositories & Views
      • Create Repository or View
      • Repository and View Settings
      • Falcon LTR Repositories
      • Lookup Files
      • Delete Repositories & Views
    • Parsing Data
      • Built-in Parsers
      • Creating a Parser
      • Ingest Tokens
      • Parser Errors
      • Removing Fields
      • Event Tags
      • Parsing Timestamps
    • Searching Data
      • Query Editor
      • Event Fields
      • Display Fields
      • Select & Filter
      • Adding & Removing Fields
      • Inspect Events
      • Show in Context
      • Format Columns
      • Column Properties
      • Field Data Types
      • Field Interactions
      • Different Visuals
      • Highlight Filter Match
      • Change Time Interval
      • Set Time Zone
      • Save Searches
      • Export Data
      • Event Display Methods
      • Search Status
      • Event List Interactions
      • Field Aliasing
        • Configuring Field Aliasing
        • Managing Field Aliasing
        • Searching with Field Aliasing
        • Understanding Field Mapping Requirements
        • Understanding Schema Requirements
    • Writing Queries
      • Basic Query Principles
      • Managing Queries
      • Common Queries
      • Writing Better Queries
      • Query Readability & Better Usage
      • Example Queries
    • Query Language Syntax
      • Comments
      • Query Filters
      • Operators
      • Adding Fields
      • User Parameters/Variables
      • Conditional Evaluation
      • Array Syntax
      • Expressions
      • Function Syntax
      • Time Syntax
        • Supported Timezones
        • Relative Time Syntax
      • Regular Expression Syntax
        • Regular Expression Syntax Patterns
        • Unsupported Regular Expression Patterns
        • Regular Expression Flags
        • LogScale Regular Expression Engines
        • Differences from Other Regex Implementations
    • Query Joins and Lookups
      • Types of Join
      • Join Methods
      • Using Ad-hoc Tables
      • Using Lookup Files
        • Using the readFile() Function
        • Using the match() Function
      • Using join() or selfJoin()
        • Using the join() Function
        • Using the selfJoin() Function
        • Join Operation and Optimization
    • Query Functions
      • Function Types and Arguments
      • Aggregate Query Functions
      • Array Query Functions
      • Comparison Query Functions
      • Conditional Query Functions
      • Event & Data Manipulation Query Functions
      • Filtering Query Functions
      • Formatting Query Functions
      • Geolocation Query Functions
      • Hash Query Functions
      • Join Query Functions
      • Math Query Functions
      • Network & Location Query Functions
      • Parsing Query Functions
      • Regular Expression Query Functions
      • Security Query Functions
      • Statistics Query Functions
      • String Query Functions
      • Time & Date Query Functions
      • Widget Query Functions
      • array:append()
      • array:contains()
      • array:drop()
      • array:eval()
      • array:filter()
      • array:intersection()
      • array:length()
      • array:reduceAll()
      • array:reduceRow()
      • array:reduceColumn()
      • array:regex()
      • array:rename()
      • array:union()
      • asn()
      • avg()
      • base64Decode()
      • beta:param()
      • beta:repeating()
      • bitfield:extractFlags()
      • bitfield:extractFlagsAsArray()
      • bitfield:extractFlagsAsString()
      • bucket()
      • callFunction()
      • coalesce()
      • cidr()
      • collect()
      • communityId()
      • concat()
      • concatArray()
      • copyEvent()
      • count()
      • counterAsRate()
      • createEvents()
      • crypto:md5()
      • crypto:sha1()
      • crypto:sha256()
      • default()
      • defineTable()
      • drop()
      • dropEvent()
      • duration()
      • end()
      • eval()
      • eventFieldCount()
      • eventInternals()
      • eventSize()
      • fieldset()
      • fieldstats()
      • findTimestamp()
      • format()
      • formatDuration()
      • formatTime()
      • geography:distance()
      • geohash()
      • getField()
      • groupBy()
      • hash()
      • hashMatch()
      • hashRewrite()
      • head()
      • if()
      • in()
      • ioc:lookup()
      • ipLocation()
      • join()
      • json:prettyPrint()
      • kvParse()
      • length()
      • linReg()
      • lookup()
      • lower()
      • lowercase()
      • match()
      • math:abs()
      • math:arccos()
      • math:arcsin()
      • math:arctan()
      • math:arctan2()
      • math:ceil()
      • math:cos()
      • math:cosh()
      • math:deg2rad()
      • math:exp()
      • math:expm1()
      • math:floor()
      • math:log()
      • math:log10()
      • math:log1p()
      • math:log2()
      • math:mod()
      • math:pow()
      • math:rad2deg()
      • math:sin()
      • math:sinh()
      • math:spherical2cartesian()
      • math:sqrt()
      • math:tan()
      • math:tanh()
      • max()
      • min()
      • objectArray:eval()
      • now()
      • parseCEF()
      • parseCsv()
      • parseFixedWidth()
      • parseHexString()
      • parseInt()
      • parseJson()
      • parseLEEF()
      • parseTimestamp()
      • parseUri()
      • parseUrl()
      • parseXml()
      • percentile()
      • range()
      • rdns()
      • regex()
      • readFile()
      • rename()
      • replace()
      • round()
      • sample()
      • sankey()
      • select()
      • selectFromMax()
      • selectFromMin()
      • selectLast()
      • selfJoin()
      • selfJoinFilter()
      • series()
      • session()
      • setField()
      • shannonEntropy()
      • sort()
      • split()
      • splitString()
      • start()
      • stats()
      • stdDev()
      • stripAnsiCodes()
      • subnet()
      • sum()
      • table()
      • tail()
      • test()
      • text:contains()
      • time:dayOfMonth()
      • time:dayOfWeek()
      • time:dayOfWeekName()
      • time:dayOfYear()
      • time:hour()
      • time:millisecond()
      • time:minute()
      • time:month()
      • time:monthName()
      • time:second()
      • time:weekOfYear()
      • time:year()
      • timeChart()
      • tokenHash()
      • top()
      • transpose()
      • unit:convert()
      • upper()
      • urlDecode()
      • urlEncode()
      • wildcard()
      • window()
      • worldMap()
      • writeJson()
      • xml:prettyPrint()
    • Dashboards & Widgets
      • Create Dashboards and Widgets
      • Manage Widgets
      • Manage Dashboards
      • Edit Dashboards
      • Organize Information on Dashboards
        • Sections
      • Work with Time on Dashboards
        • Shared Time Selector
        • Widget Time Selector
        • Section Time Selector
        • Live Dashboards
        • Time Zone Settings
        • Default Time Settings for Dashboards
      • Manage Dashboard Parameters
      • Manage Dashboard Interactions
      • Export Dashboards as PDF
        • PDF Export Options
      • Widgets
        • Bar Chart Widget
        • Event List Widget
        • Gauge Widget
        • Heat Map Widget
        • Note Widget
        • Parameter Panel Widget
        • Pie Chart Widget
        • Sankey Diagram Widget
        • Scatter Chart Widget
        • Single Value Widget
        • Table Widget
        • Time Chart Widget
        • World Map Widget
        • Embedding iFrame Widgets
    • Automation
      • Alerts
        • Aggregate Alerts
        • Filter Alerts
        • Legacy Alerts
        • Alert Activities
        • Creating Alerts
        • Editing Alerts
          • Alert Properties
        • Managing Alerts
        • Setting Alert Throttle Period
        • Sending Aggregate Results to Actions
        • Monitoring Alerts
        • Diagnosing Alerts
          • Errors when Using Live join() Functions
          • Monitor Alerts with humio-activity Repository
            • Alert Raw Event Example
      • Scheduled Searches
        • Creating a Scheduled Search
        • Spacing Out Searches
        • Scheduled Search Errors and Resolutions
      • Scheduled PDF Reports
        • Scheduled Reports Security
          • Creating a Scheduled PDF Role using the UI
        • Managing Scheduled Reports
        • Creating Scheduled Reports
        • Editing Scheduled Reports
        • Limitations
        • Scheduled Reports Errors and Resolutions
      • Cron Schedule Templates
      • Actions
        • Creating Actions
        • Managing Actions
        • Action Type: Email
        • Action Type: Falcon LogScale Repository
        • Action Type: OpsGenie
        • Action Type: PagerDuty
        • Action Type: Slack
        • Action Type: Upload File
        • Action Type: VictorOps (Splunk On-Call)
        • Action Type: Webhooks
        • Message Templates and Variables
      • Troubleshoot Alerts and Scheduled Searches
    • Template Language
      • Template Expressions
      • Template Variable Types
      • Template Examples
    • Keyboard Shortcuts
LogScale Self-Hosted (LTS)
Falcon LogScale Documentation
/ Falcon LogScale Self-Hosted 1.143.0-1.153.3 (LTS)
/ LogScale Configuration Parameters

GCP_EXPORT_WORKLOAD_IDENTITY

VariableGCP_EXPORT_WORKLOAD_IDENTITY
Description Uses Workload Identity for exporting to bucket of query results

This variable allows to use Workload Identity for exporting data to bucket rather than an explicit service account for Google cloud.

Support
  • Twitter
  • Facebook
  • LinkedIn
  • Youtube

© 2024 CrowdStrike All other marks contained herein are the property of their respective owners.

Not Available

Cloud USCloud EU

Enter search term