LogScale URLs & Endpoints

Within LogScale and the documentation, the base URL of your LogScale installation is denoted as $YOUR_LOGSCALE_URL. The tables below list some commonly used endpoints, primarily for ingest, based on $YOUR_LOGSCALE_URL, as well as the URLs of our cloud environments.

Note

The IP addresses associated with the hostname(s) used to access LogScale are not static and may be subject to change, although changes are infrequent.

Important

For ingest-related endpoints, the $HOST portion of your endpoint may include the word ingest within the hostname. If the ingest URL is different, the full ingest url will be displayed at the top of the Ingest tokens page.

URL Template Description
${HOST}:${PORT} Standard UI endpoint.
${HOST}:${PORT} Standard Falcon LogScale Collector endpoint, including when sending LogScale logs to LogScale.
${HOST}:${PORT}/api/v1/* Prefix for REST-based API queries for ingest, searching, lookup, actions, alerts and other APIs.
${HOST}:${PORT}/api/v1/ingest/humio-structured LogScale structured data ingest endpoint.
${HOST}:${PORT}/api/v1/ingest/humio-unstructured LogScale unstructured data ingest endpoint.
${HOST}:${PORT}/api/v1/ingest/raw LogScale raw data ingest endpoint.
${HOST}:${PORT}/api/v1/ingest/json LogScale raw JSON ingest endpoint.
${HOST}:${PORT}/api/v1/ingest/elastic-bulk Elastic Bulk endpoint.
${HOST}:${PORT}/_bulk Elastic Bulk endpoint.
${HOST}:${ELASTIC_PORT}/ Elastic Bulk endpoint (by port).
${HOST}:${PORT}/api/v1/ingest/otlp OpenTelemetry endpoint.
${HOST}:${PORT}/api/v1/ingest/hec LogScale Event Collector API endpoint.
${HOST}:${PORT}/api/v1/ingest/hec/raw Raw LogScale Event Collector API endpoint.
${HOST}:${PORT}/services/collector LogScale Event Collector API endpoint.
${HOST}:${PORT}/services/collector/raw Raw LogScale Event Collector API endpoint.
${HOST}:${PORT}/graphql GraphQL endpoint

The table below explains the placeholders above. Note that ${HOST}:${PORT} is the equivalent of $YOUR_LOGSCALE_URL.

Component Default Description
${HOST} - The hostname or IP address.
${PORT} 443 This is the TCP/IP port. For LogScale cloud deployments, SSL/TLS is enabled.

${ELASTIC_PORT}

9200 Port 9200 is provided for compatibility with applications supporting Elastic protocol that cannot change their port configuration.

Self-Hosted

The exact configuration for self-installed deployments of LogScale will depend on your configuration. The following table outlines the recommended settings, although the precise ports used will depend on your configuration.

Important

Port 8080 should not be used for production deployments. LogScale recommends configuring a load balancer in front of your production cluster.

The load balancer should be configured to:

  • Publish an IP/Virtual IP using TLS communication with a signed certificate; and

  • Configured to use least-connected round-robin to forward the traffic.

On-Prem/Self-Installed Description
instance.domain.example:443 Standard UI endpoint.
instance.domain.com:443/api/v1/* Prefix for REST-based API queries for ingest, searching, lookup, actions, alerts and other APIs.
instance.domain.example:8080/api/v1/ingest/humio-structured LogScale Structured data ingest endpoint.
instance.domain.example:8080/api/v1/ingest/humio-unstructured LogScale Unstructured data ingest endpoint.
instance.domain.example:8080/api/v1/ingest/raw LogScale Raw data ingest endpoint.
instance.domain.example:8080/api/v1/ingest/elastic-bulk Elastic Bulk Endpoint.
instance.domain.example:8080/_bulk Elastic Bulk Endpoint.
instance.domain.example:9200/ Elastic Bulk Endpoint (by port).
instance.domain.example:8080/api/v1/ingest/otlp OpenTelemetry Endpoint.
instance.domain.example:8080/api/v1/ingest/hec LogScale Event Collector API Endpoint.
instance.domain.example:8080/api/v1/ingest/hec/raw Raw LogScale Event Collector API Endpoint.
instance.domain.example:8080/services/collector LogScale Event Collector API Endpoint.
instance.domain.example:8080/graphql GraphQL endpoint.
https://instance.domain.example:8080/ Default port before load-balancer configuration.