Edit Ingest Feed Configuration

Security Requirements and Controls

You can edit an existing ingest feed in order to change the configuration, for example to change details related to the AWS SQS queue.

  1. Go to Repositories and views page and select the repository where you created the feed.

  2. Click Settings, under Ingest on the side menu click Ingest feeds.

  3. On the Ingest feeds page, search for the feed you want to edit using the search box, then click the ⋮ icon next to the relevant feed and select Edit.

    Screenshot of the LogScale Ingest feeds management interface showing the action menu for an existing AWS S3 ingest feed. This image displays the dropdown menu that appears when clicking the vertical ellipsis (⋮) icon next to a configured feed entry in the feeds list. The menu reveals available management options including 'Edit' which allows administrators to modify the feed's configuration, 'Delete' for removing the feed entirely, and 'Enable/Disable' for temporarily activating or deactivating data ingestion without removing the configuration. This contextual menu provides access to all feed management functions from a single access point within the LogScale administrative interface. The image illustrates how administrators can locate and select the appropriate action when needing to modify parameters of an existing S3 ingest feed, such as changing the parser, updating AWS credentials, or adjusting preprocessing settings. This management interface ensures that ingest feed configurations can be maintained and adjusted as requirements change without needing to recreate the entire configuration from scratch.

    Figure 104. Ingest Feeds - Edit


  4. You can now edit the configuration as required, where:

    • Name

      Enter a name for the feed.

    • Description

      Enter a meaningful description for the feed.

    • Compression

      Select a compression type from the list. Auto (default) uses decompression based on MIME type and file extension.

    • Preprocessing

      Define how the data is processed prior to ingestion, it can be split by AWS records, which is used, for example, by CloudTrail or split by new line, which is used by VPC Data flow logs for example, the way data should be preprocessed depends on the log source.

    • Parser

      Select the parser to apply to ingest data. The parser can be any parser that is on repository, predefined, from a package, or custom. See Parse Data for more information.

  5. Click Next to confirm any changes and make changes to the AWS configurations. See AWS Steps Phase 2 for details on the values used in this section.

  6. Click Test AWS feed to verify the configuration, and then click Save to save the changes. Click Cancel if you want to discard the changes.