Configuration Variables

Below is an alphabetical list of all of the Configuration Parameters (environment variables) used to configure LogScale on your Infrastructure. These are parameters that are exclusively related to LogScale software, as well as options that are related to other systems that integrate with LogScale (e.g., Amazon AWS, Google Cloud). Click on the name of a variable below for more details on it, along with related and similar options.

Some variables control a dynamic variable which can be modified in a running instance. For more information, see Dynamic Configuration Parameters

Use a simple text editor to open the LogScale configuration file, server.conf in the /etc/humio directory, and to change any of these variables on an installation of LogScale software. Once you've finished making changes, be sure to restart LogScale, depending on how you deployed it, for the server โ€” or for each node affected in a cluster, if not all nodes. It is a good idea to make these changes during a regular maintenance window to avoid unnecessary downtime.

Table: Configuration Parameters Table

VariableDefault ValueAvailabilityDescription
AD_HOC_TABLES_LIMIT10ย  Maximum number of ad hoc tables that can be created. Limits the total number of ad hoc query result tables that can exist in the system at one time.
AGGREGATE_ALERTS_MAX_CATCH_UP_LIMIT24hย  Sets how long back aggregate alerts will be able to catch up with delays, expressed using Relative Time Syntax. While an aggregate alert is catching up, it will not react to new events, so if a single event is causing the alert or the associated action(s) to fail, the alert will not trigger until that event is outside the catch up limit. For more information on what aggregate alerts are, see Triggers.
AGGREGATE_ALERT_MAX_THROTTLE_FIELD_VALUES_STORED100ย  Maximum number of field values stored for each aggregate alert
AGGREGATE_ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS60ย  Controls how long the system will wait when an aggregate alert live query is canceled due to excessive ingest delay.
AGGREGATOR_OUTPUT_ROW_LIMIT100 million rowsย  Number of rows allowed in queries with aggregate functions.
ALERT_DESPITE_WARNINGSfalseย  Alerts are activated even with warnings from the alert query
ALERT_DISCLAIMERย ย  Disclaimer to notify that alerts are sent from a given view or repository
ALERT_MAX_THROTTLE_FIELD_VALUES_STORED100ย  Maximum number of field values stored for each standard alert
ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS60ย  Controls how long the system will wait when a legacy alert live query is canceled due to excessive ingest delay.
ALLOWED_REDIRECT_TARGET_DOMAINSย ย  Specifies which domains are permitted as redirect targets after authentication or other redirect operations. This security setting prevents open redirect vulnerabilities by restricting where users can be redirected after login or other operations.
ALLOW_CHANGE_REPO_ON_EVENTSfalseย  HEC allows ingest to any specified repository
ALLOW_KAFKA_RESET_UNTIL_TIMESTAMP_MSย ย  Allows to perform a Kafka reset in a given timestamp in the future.
ALLOW_XML_DOCTYPE_DECLfalseย  ALLOW_XML_DOCTYPE_DECL Environment Variable
API_EXPLORER_ENABLEDtrueย  Enables or disables the API GraphQL Explorer functionality (see Accessing GraphQL with API Explorer).
ASSET_SHARING_DISABLEDfalseย  Specifies whether asset sharing can be disabled.
AUDITLOG_SENSITIVE_RETENTION_DAYS200 * 365 daysย  Specifies when sensitive logs are deleted by retention in humio-audit repository
AUTH0_CLIENT_IDย ย  Auth0 client ID
AUTH0_CLIENT_SECRETย ย  Auth0 client secret
AUTH0_DOMAINย ย  Auth0 domain name
AUTH0_USE_HTTP_PROXYfalseย  Use the HTTP proxy settings of the cluster when calling the endpoint for fetching a token
AUTHENTICATION_METHODsingle-userย  Enables a standard LDAP bind method
AUTH_ALLOW_SIGNUPtrueย  AUTH_ALLOW_SIGNUP Environment Variable
AUTH_BY_PROXY_HEADER_NAMEnoneย  Specifies usernames in header for the proxy
AUTOSHARDING_MAX131,072 shardsย  Controls the maximum number of data sources (shards) that LogScale's auto-sharding mechanism can create to distribute data across the cluster. This setting directly impacts query performance, memory usage, and data distribution efficiency.
AUTO_CREATE_USER_ON_SUCCESSFUL_LOGINfalseย  Automatically creates users in LogScale if they logged in with external authentication methods
AUTO_UPDATE_GROUP_MEMBERSHIPS_ON_SUCCESSFUL_LOGINfalseย  Allows to transfer group membership rules at login
AUTO_UPDATE_IP_LOCATION_DBtruedeprecated in 1.19 Deprecated and replaced by AUTO_UPDATE_MAXMIND
AUTO_UPDATE_MAXMINDtrueย  Enables automatic update of MaxMind GeoLite2 database
AWS_ACCESS_KEY_IDย ย  Sets the access key for AWS. For more information about AWS configuration for bucket storage and archiving, see Amazon Bucket Storage and S3 Archiving.
AWS_KMS_KEY_ARNย ย  Amazon Resource Name (ARN) of the Key Management Service (KMS) key for Amazon Web Services (AWS). This parameter enables secure encryption/decryption operations and can be used as an alternative authentication method to AWS_ACCESS_KEY_ID when integrated with IAM roles.
AWS_SECRET_ACCESS_KEYย ย  Sets the secret access key for AWS. For more information about AWS configuration for bucket storage and archiving, see Amazon Bucket Storage and S3 Archiving.
AZURE_ARCHIVING_ACCOUNTKEYย ย  Sets the account key for Azure archiving
AZURE_ARCHIVING_ACCOUNTNAMEย ย  Sets the account name for Azure archiving
AZURE_ARCHIVING_ENDPOINT_BASEย ย  Sets the URL for pointing to your own non-default storage endpoint for archiving
AZURE_INGEST_FEED_DEFAULT_CLIENT_IDย ย  Microsoft Identity Platform client ID for Azure Event Hub ingest feed authentication
AZURE_INGEST_FEED_SECRETย ย  Microsoft Identity Platform client secret for Azure Event Hub ingest feed authentication
AZURE_INGEST_FEED_TENANT_IDย ย  Microsoft Identity Platform tenant ID for Azure Event Hub ingest feed authentication
AZURE_RECOVER_FROM_ACCOUNTKEYย ย  Storage account access key
AZURE_RECOVER_FROM_ACCOUNTNAMEย ย  Storage account name
AZURE_RECOVER_FROM_BUCKETย ย  Container name to recover from.
AZURE_RECOVER_FROM_ENCRYPTION_KEYย ย  Encryption key matching primary
AZURE_RECOVER_FROM_ENDPOINT_BASEย ย  Blob endpoint URL
AZURE_RECOVER_FROM_OBJECT_KEY_PREFIXย ย  Object key prefix in primary bucket
AZURE_RECOVER_FROM_REPLACE_REGIONย ย  Region replacement mapping
AZURE_STORAGE_ACCOUNTKEYย ย  Sets the account key for Azure bucket storage. For more information about Azure bucket storage, see Azure Bucket Storage.
AZURE_STORAGE_ACCOUNTNAMEย ย  Sets the account name for Azure bucket storage. For more information about Azure bucket storage, see Azure Bucket Storage.
AZURE_STORAGE_BUCKETย ย  Azure bucket name for Azure bucket storage. For more information about Azure bucket storage, see Azure Bucket Storage.
AZURE_STORAGE_CONCURRENCYcores/2deprecated in 1.240 The number of concurrent downloading/uploading files in Azure storage
AZURE_STORAGE_ENCRYPTION_KEYย ย  Sets the encryption key for Azure storage
AZURE_STORAGE_ENDPOINT_BASEย ย  Sets the URL for pointing to your own non-Azure endpoint for Azure storage
AZURE_STORAGE_MAX_CONCURRENT_DOWNLOADS1 slot per 2 coresย  Controls the max concurrency of downloads from bucket storage.
AZURE_STORAGE_MAX_CONCURRENT_UPLOADS1 slot per 2 coresย  Controls the max concurrency of uploads to bucket storage.
AZURE_STORAGE_OBJECT_KEY_PREFIXย ย  Sets the optional prefix for all object keys
AZURE_STORAGE_PREFERRED_COPY_SOURCEfalseย  Sets how to download segments from bucket storage when prefetching. For more information about Azure bucket storage, see Azure Bucket Storage.
AZURE_STORAGE_RESPONSE_TIMEOUT_SECONDS60ย  Configures the response timeout for Azure bucket storage operations
AZURE_STORAGE_TRANSFER_THREAD_POOL_SIZE50% of node's CPU coresย  Controls the pool size for the shared thread pool used to execute uploads and downloads.
AZURE_STORAGE_USE_HTTP_PROXYtrueย  Enables/disables HTTP proxy for communicating with Azure Bucket Storage
BACKUP_DIRhumio-backupdeprecated in 1.57 Specifies the directory where to write a backup of the data files
BACKUP_KEYdeveloperย  Specifies the secret key used for encryption for data files backup
BACKUP_NAMEnonedeprecated in 1.57 Names the backup of the data files
BITBUCKET_OAUTH_CLIENT_IDnoneย  The Key from your BitBucket OAuth Consumer
BITBUCKET_OAUTH_CLIENT_SECRETnoneย  The Secret from your BitBucket OAuth Consumer
BITBUCKET_OAUTH_USE_HTTP_PROXYfalseย  Use the HTTP proxy settings of the cluster when calling the endpoint for fetching a token
BLOCKS_PER_MINISEGMENT300ย  Desired number of blocks in a mini-segment
BLOCKS_PER_SEGMENT30,000ย  Desired number of blocks in a final segment
BLOCK_CLOUD_SIGNUPStrueย  Boolean flag that controls whether new user signups for cloud instances are blocked. When set to true, new user registration will be disabled, preventing the creation of new accounts. Useful for maintenance periods or when you want to control access to the system.
BLOCK_SIGNUPtrueย  Boolean flag that controls whether new user signups are blocked. When set to true, new user registration will be disabled, preventing the creation of new accounts. Useful for maintenance periods or when you want to control access to the system.
BLOCK_SIZE_MAX_KB1,024 KBย  Maximum size in KB to target for blocks in a single segment
BLOCK_SIZE_MIN_KB384 KBย  Minimum size in KB to target for blocks in a single segment
BOOTSTRAP_HOST_ID0ย  Sets an ID for the server at first start up
BOOTSTRAP_ROOT_TOKEN_HASHED(not set)ย  Specifies the hashed root token for a LogScale instance
BUCKET_STORAGE_IGNORE_ETAG_UPLOADfalseย  For bucket storage to work with MinIO, disables checksum matching while uploading the file
BUCKET_STORAGE_INFREQUENT_ACCESS_CLASSINTELLIGENT_TIERINGย  Specify which storage class to use for infrequently accessed data in S3 buckets.
BUCKET_STORAGE_MESSAGE_DIGESTMD5ย  Specifies which cryptographic hash algorithm (the message digest algorithm) is used for data integrity verification in bucket storage.
BUCKET_STORAGE_MULTIPLE_ENDPOINTSfalseย  Proxy configuration applied to all bucket storage backends or not
BUCKET_STORAGE_SSE_COMPATIBLEย ย  Makes bucket storage not verify checksums of raw objects after uploading to an S3
CHATTER_INITIAL_REPLICATION_FACTOR3ย  Sets how many replicas the partitions in chatter have in Kafka. Only applied when the topic is created initially.
CLUSTER_PING_TIMEOUT_SECONDS90ย  Sets amount of time to wait for response from nodes when checking node responsiveness.
COMPRESSION_TYPEhighย  Sets default compression levels for segments and minisegments
CORESAvailable Processorsย  Specifies the number of CPU cores for the machine running LogScale
CORRELATE_CONSTELLATION_TICK_LIMIT5ย  Maximum number of processing ticks allowed in correlation constellation operations. This setting helps prevent excessive resource consumption in complex correlation operations. Higher values allow more complex correlations but consume more computational resources.
CORRELATE_CONSTRAINT_LIMIT5ย  Maximum number of constraints allowed in correlation operations. This setting limits the complexity of correlation queries to prevent excessive resource consumption. Higher values allow more complex constraints but may increase memory usage and processing time.
CORRELATE_MIN_ITERATIONS2ย  Minimum number of iterations that the correlation algorithm will perform. This setting ensures correlation operations run for at least the specified number of iterations, allowing time for patterns to emerge even if early convergence criteria are met.
CORRELATE_NUMBER_OF_TIME_BUCKETS100,000ย  Number of time buckets to use when performing correlation analysis. This setting controls how the time range is divided into discrete intervals for temporal correlation. Higher values provide finer time granularity but require more computational resources.
CORRELATE_QUERY_EVENT_LIMIT100,000ย  Maximum number of events allowed in correlation query operations.
CORRELATE_QUERY_LIMIT5ย  Maximum number of queries allowed in correlation operations.
CORS_ALLOWED_ORIGINStrueย  Websites or IP addresses that allow Cross-Origin Resource Sharing
CREATE_HUMIO_SEARCH_ALLfalseย  Allows creation of humio-search-all view
CS_ANALYTICS_URLย ย  The default CrowdStrike analytics URL to use.
DAYS_BEFORE_TOMBSTONE_DELETION14ย  Sets the restorability of deleted repositories or views, but not the data within them. For information about the configuration that sets the time in which you can restore data from the dataspace, see DELETE_BACKUP_AFTER_MILLIS.
DEBUG_AUDIT_REQUEST_TRACEtrueย  Controls whether to enable debug tracing for audit requests.
DEFAULT_ALLOW_REBALANCE_EXISTING_SEGMENTStrueย  Sets whether or not the existing segment decider will run
DEFAULT_ALLOW_UPDATE_DESIRED_DIGESTERStrueย  Enables automatic management of the digest partition table
DEFAULT_DIGEST_REPLICATION_FACTOR1ย  Configures the replication factor used for the digest partitions table
DEFAULT_GRAPHQUERY_ITERATION_LIMIT5ย  Defines the default limit for the number of times the correlate() will iterate over events during query execution.
DEFAULT_GROUPSย ย  List of default groups that users belong to
DEFAULT_MIN_HOST_ALIVE_PERCENTAGE_TO_ENABLE_CLUSTER_REBALANCING25ย  Sets the minimum percentage of cluster hosts that must be alive and operational before cluster rebalancing operations are permitted. This safety threshold prevents rebalancing activities during cluster outages or instability.
DEFAULT_PARSER_NAMEย ย  Name of default global parser.
DEFAULT_PDF_RENDER_SERVICE_URLย ย  URL of the default PDF render service for LogScale.
DEFAULT_SEGMENT_REPLICATION_FACTOR1ย  Specifies the number of replicas each segment file will have.
DEFAULT_USER_INPUT_REGEX_ENGINEย deprecated in 1.227 Specifies which regular expression (regex) engine to use by default for user-provided regex patterns.
DELETES_DELAY_MILLIS600,000 msย  Hard minimum delay before a redaction rewrite begins
DELETE_BACKUP_AFTER_MILLIS604,800,000 msย  Configures when data files backup must be deleted
DELETE_DUPLICATED_NAME_VIEWS_AFTER_MERGINGfalseย  Controls whether to delete views with duplicate names after merging.
DELETE_ON_INGEST_QUEUEtrueย  Deletes events from the ingest queue
DIGEST_EXECUTOR_CORESCORES Divided by 2ย  Internal configuration to half the number of CPU cores set in CORES variable
DIRECTORYhumio-dataย  Data directory for LogScale
DISABLE_ANALYTICS_JOBtrueย  Controls whether analytics jobs are disabled.
DISABLE_BUCKET_CLEANING_TMP_FILESfalseย  Allows turning off cleaning of files in bucket storage temporary file directories
DISABLE_PERMISSION_CACHEfalseย  Controls whether the system's permission caching mechanism is enabled or disabled.
DISABLE_USER_TRACKINGtrueย  Controls whether user tracking is disabled.
DISABLE_VIEW_WITH_SAME_NAME_CLEANUPtrueย  Disable views with the same name during clean-up.
DUMP_THREADS_SECONDSย ย  Specifies the interval thread dumps are written with
ELASTIC_PORTย ย  Sets the port for ElasticSearch bulk endpoint
EMAIL_ACTION_DISCLAIMERย ย  Disclaimer in every email to clarify alerts or scheduled searches are sent as LogScale actions
EMERGENCY_USERSfalseย  Enables emergency users in case of issues with identity provider
ENABLEINTERNALLOGGERtrueย  When true, this variable causes LogScale to write its logs to the humio repository.
ENABLE_AGGREGATE_ALERTStrueย  Enables/disables aggregate alerts
ENABLE_ALERTStrueย  Enables/disables all alerts
ENABLE_BEARER_TOKEN_AUTHORIZATIONfalseย  Using less secure bearer token instead of secure cookies
ENABLE_EVENT_FORWARDINGfalseย  Enables/disables event forwarding
ENABLE_FDR_POLLING_ON_NODEtrueย  Enables polling and ingest of FDR data on the LogScale node
ENABLE_FILTER_ALERTStrueย  Enables/disables filter alerts
ENABLE_GLOBAL_JSON_STATS_LOGGERfalseย  Controls whether the global JSON statistics logger is enabled.
ENABLE_INGEST_FEEDtrueย  Enables/disables ingest feeds on the given node. This may vary between nodes in the cluster such that only some nodes run ingest feeds.
ENABLE_IOC_SERVICEtrueย  Enables the IOC database service.
ENABLE_ORGANIZATIONSfalseย  Whether organizations are enabled for a cluster.
ENABLE_PERSONAL_API_TOKENStrueย  Enables/disables use of personal API tokens
ENABLE_SANDBOXEStrueย  Enables/disables sandbox repositories
ENABLE_SCHEDULED_REPORTfalseย  Whether scheduled reports are enabled.
ENABLE_SCHEDULED_SEARCHESfalseย  Sets whether scheduled searches should be executed
ENFORCE_AUDITABLEfalseย  Sets permissions and enforce Auditable mode for root access
EXTERNAL_URLhttp://localhost:PORTย  URL that other hosts can use to reach this server
EXTRA_KAFKA_CONFIGS_FILEย removed in 1.245 Allows to add extra Kafka configuration properties
FALCON_DATA_CONNECTOR_URLย ย  URL for Falcon Data Connector.
FDR_MAX_NODES_PER_FEED5ย  Maximum number of nodes allowed per feed for FDR.
FDR_S3_FILE_SIZE_MAX250,000,000ย  Maximum file size in bytes for S3 files in FDR.
FDR_USE_PROXYย ย  Makes the FDR job use the proxy settings specified with HTTP_PROXY_* environment variables
FDR_VISIBILITY_TIMEOUT15 mย  Visibility timeout of SQS messages read by FDR integration
FEDERATED_SUBMISSION_TIMEOUT_MILLIS1 hourdeprecated in 1.184 Timeout for multi-cluster query submission.
FILE_REPLICATION_FACTOR5ย  Replication factor for files in the cluster.
FILTER_ALERTS_MAX_CATCH_UP_LIMIT24hย  Sets how long back filter alerts will be able to catch up with delays, expressed using Relative Time Syntax. Note that while a filter alert is catching up, it will not react to new events, so if a single event is causing the alert or the associated action(s) to fail, the alert will not trigger until that event is outside the catch up limit. For more information, see Filter Alerts.
FILTER_ALERTS_MAX_WAIT_FOR_MISSING_DATA10ย  Sets how long filter alerts will wait for query warnings about missing data to disappear, expressed using Relative Time Syntax. If a filter alert is waiting for query warnings to disappear for longer than 15 minutes, the alert will not react to new events. If the query warning is permanent, the alert will not trigger until the whole waiting time has passed. For more information, see Filter Alerts.
FILTER_ALERT_EMAIL_TRIGGER_LIMIT15ย  Sets a maximum limit on the number of email actions that can be triggered by a single filter alert within a specific time window. Filter alerts are limited to a maximum of 15 triggers per minute for email actions.
FILTER_ALERT_MAX_THROTTLE_FIELD_VALUES_STORED100ย  Maximum number of field values stored for each filter alert
FILTER_ALERT_NON_EMAIL_TRIGGER_LIMIT100 triggers/minuteย  Sets the maximum number of triggers per minute for any action other than email actions (such as webhooks, Slack messages, PagerDuty alerts, etc.) in filter alerts. Filter alerts are limited to a maximum of 100 triggers per minute for non-email actions.
FILTER_ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS60ย  Controls how long the system will wait when a filter alert live query is canceled due to excessive ingest delay.
FLUSH_BLOCK_SECONDS900 secondsย  How long a mini-segment can stay open
FORWARDING_BREAKER_EXP_BACKOFF_FACTOR2.0ย  Increase reset time after each new failure
FORWARDING_BREAKER_FAILURES50ย  Failures before stopping all events in event forwarding
FORWARDING_BREAKER_MAX_RESET60 secondsย  Max reset time in event forwarding
FORWARDING_BREAKER_RESET1 secondย  Awaiting time before a new event in event forwarding
FORWARDING_BREAKER_TIMEOUT10ย  Timeout before a call is considered a failure
FORWARDING_MAX_CONCURRENCY50,000ย  Max number of events waiting to be forwarded
GCP_ARCHIVING_ACCOUNT_JSON_FILEย ย  Path to the JSON configuration file for Google cloud storage archiving
GCP_ARCHIVING_BUCKETย ย  Sets the name of the bucket to use for archiving
GCP_ARCHIVING_ENCRYPTION_KEYย ย  Sets the encryption key for Google cloud storage for archiving
GCP_ARCHIVING_ENDPOINT_BASEย ย  Sets the URL for pointing to your own non-Google Cloud storage endpoint for archiving
GCP_ARCHIVING_OBJECT_KEY_PREFIXย ย  Allows nodes to share a bucket
GCP_EXPORT_BUCKETย  Specifies the bucket where exports are sent for Google Cloud Storage.
GCP_EXPORT_WORKLOAD_IDENTITYย ย  Uses Workload Identity for exporting to bucket of query results
GCP_RECOVER_FROM_BUCKETย ย  Primary GCS bucket name to recover snapshot from on the standby cluster
GCP_RECOVER_FROM_ENCRYPTION_KEYย ย  Encryption key from the primary cluster for reading encrypted GCS data during recovery
GCP_RECOVER_FROM_REPLACE_BUCKETย ย  Maps the primary GCS bucket name to the secondary bucket name during recovery, such as <primary-bucket>/<secondary-bucket>.
GCP_RECOVER_FROM_REPLACE_REGIONย ย  Replaces the source region in GCS bucket paths during recovery
GCP_RECOVER_FROM_WORKLOAD_IDENTITYtrueย  Enables Workload Identity for cross-region authentication during GCS recovery. Always "true".
GCP_STORAGE_ACCOUNT_JSON_FILEย ย  Path to the JSON configuration file for Google cloud storage
GCP_STORAGE_BUCKETย ย  Sets the name of the bucket to use
GCP_STORAGE_CONCURRENCYcores/2deprecated in 1.240 The number of concurrent downloading/uploading files in GCP storage
GCP_STORAGE_ENCRYPTION_KEYย ย  Sets the encryption key of the bucket to use
GCP_STORAGE_ENDPOINT_BASEย ย  Sets the URL for pointing to your own non-Google Cloud storage endpoint for storage
GCP_STORAGE_MAX_CONCURRENT_DOWNLOADS1 slot per 2 coresย  Controls the max concurrency of downloads from bucket storage.
GCP_STORAGE_MAX_CONCURRENT_UPLOADS1 slot per 2 coresย  Controls the max concurrency of uploads to bucket storage.
GCP_STORAGE_OBJECT_KEY_PREFIXย ย  Allows nodes to share a bucket
GCP_STORAGE_PREFERRED_COPY_SOURCEfalseย  Sets how to download segments from bucket storage when prefetching
GCP_STORAGE_TRANSFER_THREAD_POOL_SIZE50% of node's CPU coresย  Controls the pool size for the shared thread pool used to execute uploads and downloads.
GCP_STORAGE_USE_HTTP_PROXYtrueย  Enables/disables HTTP proxy for communicating with Google Cloud Bucket Storage
GCP_STORAGE_WORKLOAD_IDENTITYย ย  Uses Workload Identity for bucket storage
GC_KILL_THRESHOLD_MILLISย ย  Threshold for timeSpentOnGC that makes LogScale exit when exceeded
GITHUB_OAUTH_CLIENT_IDย ย  GITHUB_OAUTH_CLIENT_ID Environment Variable
GITHUB_OAUTH_CLIENT_SECRETย ย  GITHUB_OAUTH_CLIENT_SECRET Environment Variable
GITHUB_OAUTH_USE_HTTP_PROXYfalseย  Use the HTTP proxy settings of the cluster when calling the endpoint for fetching a token
GITHUB_USERย ย  GitHub username
GLOBAL_INITIAL_REPLICATION_FACTOR3ย  Sets how many replicas the partitions in global have in Kafka. Only applied when the topic is created initially.
GLOBAL_THROTTLE_PERCENTAGE20ย  Percentage of time allowed for a global publishing thread before other transactions of that type are throttled
GLOB_ALLOW_LIST_EMAIL_ACTIONSAllow allย  Blocks recipients of email actions that are not in the provided allow list.
GLOB_MATCH_LIMIT20,000ย  Sets the maximum number of rows for csv_file in match() function
GOOGLE_OAUTH_CLIENT_IDย ย  The client_id from your Google OAuth App
GOOGLE_OAUTH_CLIENT_SECRETย ย  The client_secret from your GitHub OAuth App
GOOGLE_OAUTH_USE_HTTP_PROXYfalseย  Use the HTTP proxy settings of the cluster when calling the endpoint for fetching a token
GRACEFUL_SHUTDOWN_CONSIDERED_ALIVE_SECONDS300ย  Number of seconds a server is considered alive during graceful shutdown.
GRACE_PERIOD_BEFORE_DELETING_DEAD_EPHEMERAL_HOSTS_MS100ย  Grace period in milliseconds before dead ephemeral hosts are deleted.
GRACE_PERIOD_SECS_BEFORE_DELETING_LOCAL_SEGMENT_COPIES30ย  Grace period in seconds before local segment copies are deleted.
GRAPHQL_ALIAS_COUNT_LIMIT100ย  Maximum number of aliases allowed in a GraphQL query.
GRAPHQL_DIRECTIVE_COUNT_LIMIT100ย  Maximum number of directives allowed in a GraphQL query.
GRAPHQL_FRAGMENT_COUNT_LIMITย ย  Maximum number of fragments allowed in a GraphQL query.
GRAPHQL_FRAGMENT_DEPTH_LIMIT10 fragmentsย  Maximum depth of fragments allowed in a GraphQL query.
GRAPHQL_MAX_ERRORS_COUNT100 errorsย  Maximum amount of errors that can be returned in the "errors" array in a GraphQL response.
GRAPHQL_OPERATION_COUNT_LIMITย ย  Maximum number of operations allowed in a GraphQL query.
GRAPHQL_QUERY_ANALYSIS_DISABLEDtrueย  Controls whether GraphQL query analysis is disabled.
GRAPHQL_QUERY_DEPTH_LIMIT13ย  Permitted maximum depth of a GraphQL query.
GRAPHQL_UNAUTHENTICATED_ALIAS_COUNT_LIMITย ย  Maximum number of aliases allowed in an unauthenticated GraphQL query.
GRAPHQL_UNAUTHENTICATED_DIRECTIVE_COUNT_LIMITย ย  Maximum number of directives allowed in an unauthenticated GraphQL query.
GRAPHQL_UNAUTHENTICATED_FRAGMENT_COUNT_LIMITย ย  Maximum number of fragments allowed in an unauthenticated GraphQL query.
GRAPHQL_UNAUTHENTICATED_FRAGMENT_DEPTH_LIMIT5 fragmentsย  Maximum fragment depth allowed in an unauthenticated GraphQL query.
GRAPHQL_UNAUTHENTICATED_OPERATION_COUNT_LIMITย ย  Maximum number of operations allowed in an unauthenticated GraphQL query.
GRAPHQL_UNAUTHENTICATED_QUERY_DEPTH_LIMITย ย  Permitted maximum depth of an unauthenticated GraphQL query.
GRAPHQL_UNAUTHENTICATED_SELECTION_SIZE_LIMITย ย  Maximum selection size allowed in an unauthenticated GraphQL query.
HEALTH_CHECK__CLUSTER_TIME_SKEW__WARN_THRESHOLD_MS15,000 msย  Sets the threshold for the difference in time between cluster nodes to indicate when the cluster-time-skew health check should trigger a WARN.
HEALTH_CHECK__EVENT_LATENCY_P99__WARN_THRESHOLD_SEC30 secย  Sets the threshold for latency for events. This latency is measured from the time an event in received by LogScale and until the digest phase is done processing that event (running live searches and persisting to disk). This value indicates when the event-latency-p99 health check should trigger a WARN.
HEALTH_CHECK__GLOBAL_TOPIC_LATENCY_P50__WARN_THRESHOLD_MSEC50 msย  Sets the threshold for latency in the global-events topic that is the shared communications channel in a cluster. This threshold indicates when the global-topic-latency-median health check should trigger a WARN.
HEALTH_CHECK__PRIMARY_DISK_USAGE__WARN_THRESHOLD_PCT90 secย  Used when configuring the primary-disk-usage health check to set the percentage threshold for when to trigger a WARN.
HEALTH_CHECK__PRIMARY_DISK_USAGE__WARN_THRESHOLD_SEC90 secย  Used when configuring the primary-disk-usage health check to set the percentage threshold for when to trigger a WARN.
HEALTH_CHECK__SECONDARY_DISK_USAGE__WARN_THRESHOLD_PCT90 secย  Used when configuring the secondary-disk-usage health check to set the percentage threshold for when to trigger a WARN.
HEALTH_CHECK__SECONDARY_DISK_USAGE__WARN_THRESHOLD_SEC90 secย  Used when configuring the secondary-disk-usage health check to set the percentage threshold for when to trigger a WARN.
HTTP_PROXY_ALLOW_ACTIONS_NOT_USEfalseย  Allows actions not to use HTTP proxy
HTTP_PROXY_ALLOW_NOTIFIERS_NOT_USEfalsedeprecated in 1.19 Configures alert notifiers not to use HTTP proxy
HTTP_PROXY_HOSTย ย  Configures the HTTP proxy host used by connections from LogScale
HTTP_PROXY_PASSWORDย ย  Sets the password for HTTP proxy configuration
HTTP_PROXY_PORT3,129ย  Sets the port for HTTP proxy configuration
HTTP_PROXY_USERNAMEย ย  Sets the username for HTTP proxy configuration
HUMIO_AUDITLOG_DIR/data/logsย 

Sets the directory in which to store audit logs. When using containers this is set to be /data/logs inside the container by default.

On bare-metal it is set to /logs.

HUMIO_DEBUGLOG_DIR/data/logsย 

Sets the directory in which to store debug logs. When using containers this is set to be /data/logs inside the container by default.

On bare-metal it is set to /logs.

HUMIO_GC_OPTSย ย  JVM garbage collector configuration options
HUMIO_HEAP_SIZE_MBย ย  JVM heap size in megabytes, setting -Xmx and -Xms
HUMIO_HTTP_BINDHUMIO_SOCKET_BINDย  IP to bind the http listening socket to
HUMIO_JMX_OPTSย ย  JMX configuration options, excluding the JMX port setting
HUMIO_KAFKA_TOPIC_PREFIXย ย  Adds a prefix to the topic names in Kafka
HUMIO_LOG4J_CONFIGURATIONย ย  Sets the path for the log4j2-custom-config file
HUMIO_MEMORY_OPTSย ย  Heap space and other memory-related JVM options
HUMIO_PORTย ย  Sets the TCP port to listen for HTTP traffic
HUMIO_SOCKET_BIND0.0.0.0ย  Sets the IP address to bind the UDP/TCP/HTTP listening sockets
HUMIO_THREADNAME_PREFIXย ย  LogScale prefix for threadnames. Must either be empty or contain only word characters (such as, a-z,A-Z, and 0-9, plus non-leading '-' or '_'). If empty, LogScale defaults to humio.
INGEST_FEED_AWS_ACCESS_KEY_IDย ย  Access key ID to use when ingesting from AWS-based ingest feeds. Optional, if not set then we attempt tot use the default credentials provider chain.
INGEST_FEED_AWS_CREDENTIALS_PROVIDER_RENEWAL_BUFFER30ย  Specifies the time buffer before AWS credential expiration when the credentials provider should begin renewing credentials. This ensures credentials are refreshed in advance to prevent expiration during active ingest feed operations.
INGEST_FEED_AWS_CREDENTIALS_PROVIDER_SESSION_ID_PREFIXย ย  Defines the prefix string applied to AWS session identifiers when the ingest feed credentials provider assumes roles or creates temporary sessions.
INGEST_FEED_AWS_CREDENTIALS_PROVIDER_USE_PROXYtrueย  Defines if a proxy will be used when provisioning AWS credentials.
INGEST_FEED_AWS_DOWNLOAD_MAX_OBJECT_SIZE_DEFAULT2,147,483,648 bytesย  Max size of objects downloaded from S3.
INGEST_FEED_AWS_PROCESSING_DOWNLOAD_BUFFER_SIZE_DEFAULT8,388,608 bytesย  Size of the buffer when downloading.
INGEST_FEED_AWS_PROCESSING_EVENTS_PER_BATCH_DEFAULT1,000 eventsย  Number of events ingested per batch.
INGEST_FEED_AWS_PROCESSING_EVENT_BUFFER_SIZE_DEFAULT1 MBย  Size of the buffer after preprocessing and splitting into individual events.
INGEST_FEED_AWS_REGIONย ย  Specify the region of the AWS bucket. This is not necessary if the value is supplied through the credentials' provider chain.
INGEST_FEED_AWS_ROLE_ARNย ย  Specify the ARN of S3 bucket on AWS.
INGEST_FEED_AZURE_CLIENT_IDย ย  Sets the ID of the default client.
INGEST_FEED_AZURE_CLIENT_SECRETย ย  Sets the secret access key for azure
INGEST_FEED_AZURE_CREDENTIAL_RETRIEVAL_TIMEOUT10ย  Controls the maximum time allowed for retrieving Azure credentials during the authentication process for Azure-based data ingestion.
INGEST_FEED_AZURE_TENANT_IDย ย  Sets the tenant ID to use to access Azure.
INGEST_FEED_AZURE_USE_ENVIRONMENT_AUTHfalseย  Controls whether the system uses environment-based authentication methods when connecting to Azure services for data ingestion. When set to true, instructs LogScale to use environment-based authentication mechanisms for Azure.
INGEST_FEED_AZURE_USE_PROXYtrueย  Controls whether the system routes Azure service connections through a proxy server during data ingestion. When set to true, instructs LogScale to use configured proxy settings for Azure connections.
INGEST_FEED_GOVERNOR_GAIN_PER_CORE_DEFAULT100,000ย  Change in rate when under/over the setpoint. Increasing this will make the governor more aggressive in changing the ingest rate.
INGEST_FEED_GOVERNOR_INGEST_DELAY_HIGH_DEFAULT10 secondsย 

Default ingest delay high setpoint for the ingest feed governor.

INGEST_FEED_GOVERNOR_INGEST_DELAY_LOW_DEFAULT5 secondsย 

Default ingest delay low setpoint for the ingest feed governor.

INGEST_FEED_GOVERNOR_INITIAL_RATE_PER_CORE8,000 bytes per seconds per coreย  The initial rate of ingest allowed by the governor in bytes per second per core.
INGEST_FEED_JOB_SETTINGS_EXECUTION_INFO_INTERVAL5ย  Determines the frequency at which ingestion feed job execution information is collected and reported.
INGEST_FEED_JOB_SETTINGS_POLL_INTERVAL10ย  Controls how frequently the system checks for changes to ingestion feed job settings.
INGEST_FEED_POLL_PERIOD60 secondsย  Specify the amount of time between successive polls of ingest feeds without pressure. In case of pressure, the ingest feeds will be polled as soon as possible.
INGEST_FEED_SECRET_ACCESS_KEYsee descriptionย  Secret access key to use when ingesting from AWS-based ingest feeds. Optional, if not set then we attempt to use the default credentials provider chain.
INGEST_OCCUPANCY_QUERY_PERMIT_LIMIT20 %ย  Maximum percentage of ingest readers occupancy set for limiting query resources
INGEST_QUEUE_INITIAL_REPLICATION_FACTOR3ย  Replication factor for the Kafka ingest queue. Only applied when the topic is created initially.
INGEST_REQUEST_MAX_QUEUE_SECS25ย  Controls the maximum time that ingestion requests can spend waiting in the queue before processing.
INITIAL_DISABLED_NODE_TASKSemptyย  Enables/disables node tasks
INITIAL_FEATURE_FLAGSemptyย  Allows administrators to define which features are enabled in LogScale at boot time.
IOC_CROWDSTRIKE_API_CLIENT_IDย ย  Sets the client ID for CrowdStrike Intel API
IOC_CROWDSTRIKE_API_CLIENT_SECRETย ย  Sets the client secret for CrowdStrike Intel API
IOC_CROWDSTRIKE_API_URLย ย  CrowdStrike API server URL for IOCs database download
IOC_UPDATE_SERVER_URLhttps://ioc.humio.comย  API server URL for IOCs database download
IOC_USE_HTTP_PROXYtrueย  Allows to choose HTTP_PROXY for IOCs database update
IPFIX_PEN_FILEย ย  Name and location of CSV file where private enterprise elements of IPFIX configuration are specified.
IP_FILTER_ACTIONSย ย  IP-based access control list (ACL) for outgoing connections made by actions. Replaces IP_FILTER_NOTIFIERS.
IP_FILTER_IDPย ย  IP filter that restricts which IP addresses LogScale can connect to when communicating with identity providers.
IP_FILTER_NOTIFIERSย ย  IP-based access control list (ACL) for outgoing connections made by notifiers. Replaced by IP_FILTER_ACTIONS.
IP_FILTER_RDNSย ย  IP filter for filtering which IP addresses may be queried with the rdns() function or reverseDns() function.
IP_FILTER_RDNS_SERVERย ย  IP filter for filtering which DNS servers may be specified in the rdns() function or reverseDns() function.
IP_FILTER_ROOT_USERSallow allย  Controls IP address filtering for root (administrative) user access to the system. This setting helps LogScale maintain a strong security posture by limiting administrative access to trusted network locations based on the IP addresses, significantly reducing the risk of unauthorized privileged access even if credentials are compromised.
JOIN_DEFAULT_LIMIT100,000ย  Default limit for join operations in queries.
JVM_LOG_DIR/data/logsย 

Sets the directory in which to store Java logs. When using containers this is set to be /data/logs inside the container by default.

On bare-metal it is set to /logs.

JVM_TMP_DIR/data/humio-data/jvm-tmpย 

Sets the directory in which to store temporary Java data. When using containers this is set to be /data/humio-data/jvm-tmp inside the container by default.

JWKS_REFRESH_INTERVAL3,600,000ย  JWKS_REFRESH_INTERVAL Environment Variable
KAFKA_ADMIN_ย ย  Prefix that allows you to pass Kafka admin configuration parameters to Kafka admin clients.
KAFKA_CHATTER_CONSUMER_ย ย  Prefix that allows you to pass Kafka configuration parameters to Kafka consumer clients used for reading from the chatter queue. Replaces EXTRA_KAFKA_CONFIGS_FILE.
KAFKA_CHATTER_PRODUCER_ย ย  Prefix that allows you to pass Kafka configuration parameters to Kafka producer clients used for writing to the chatter queue. Replaces EXTRA_KAFKA_CONFIGS_FILE.
KAFKA_CLIENT_RACKย ย  Specifies the client.rack value directly.
KAFKA_CLIENT_RACK_ENV_VARZONEย  Finds the name of the variable that holds the value of client.rack.
KAFKA_COMMON_ย ย  Allows you to pass configuration parameters to all Kafka clients. Replaces EXTRA_KAFKA_CONFIGS_FILE. If a parameter set here is also set in a client-specific prefix, then this has lower precedence than the others. For example, if you set both KAFKA_COMMON_BLAH and KAFKA_GLOBAL_CONSUMER_BLAH, then for the global consumer, the latter "wins".
KAFKA_EGRESS_CONSUMER_GROUP_PREFIXย ย  Defines a prefix that will be applied to Kafka consumer group IDs used for egress (outbound) operations. A consumer group prefix is used to identify which groups should be considered when deleting data from the ingest queue topic.
KAFKA_EGRESS_EVENT_FORWARDER_TOPICS_TO_DISABLEย ย  Controls which Kafka topics should be excluded from the event forwarding mechanism.
KAFKA_GLOBAL_CONSUMER_ย ย  Prefix that allows you to pass Kafka configuration parameters to specific Kafka consumer clients reading from the global queue. Replaces EXTRA_KAFKA_CONFIGS_FILE.
KAFKA_GLOBAL_PRODUCER_ย ย  Prefix that allows you to pass Kafka configuration parameters to specific Kafka producer clients writing to the global queue. Replaces EXTRA_KAFKA_CONFIGS_FILE.
KAFKA_INGEST_QUEUE_CONSUMER_ย ย  Prefix that allows you to pass Kafka configuration parameters to specific Kafka consumer clients reading from the ingest queue. Replaces EXTRA_KAFKA_CONFIGS_FILE.
KAFKA_INGEST_QUEUE_PRODUCER_ย ย  Prefix that allows you to pass Kafka configuration parameters to specific Kafka producer clients writing to the ingest queue. Replaces EXTRA_KAFKA_CONFIGS_FILE.
KAFKA_MANAGED_BY_HUMIOtrueย  Set/unset LogScale to create topics and manage replicas in Kafka
KAFKA_SERVERSย ย  Kafka bootstrap servers list
LDAP_AUTH_PRINCIPALย ย  Allows to transform LogScale login usernames so to enable LDAP authentication
LDAP_AUTH_PRINCIPALS_REGEXย ย  Separates multiple patterns with users in more locations within LDAP
LDAP_AUTH_PROVIDER_CERTย ย  The certification for key exchange to connect for LDAP authentication
LDAP_AUTH_PROVIDER_URLย ย  The URL to connect to for LDAP authentication. From version 1.237, only ldaps connections are supported.
LDAP_DOMAIN_NAMEย ย  Allows users to login with their username and not domain name
LDAP_GROUPNAME_ATTRIBUTEย ย  Allows using an alternate attribute on the group record in LDAP as the group name in LogScale RBAC configuration
LDAP_GROUP_BASE_DNย ย  The query to perform to get the user's groups for LDAP
LDAP_GROUP_FILTERย ย  LDAP_GROUP_FILTER Environment Variable
LDAP_GROUP_SEARCH_BIND_FOR_LOOKUPfalseย  LDAP_GROUP_SEARCH_BIND_FOR_LOOKUP Environment Variable
LDAP_SEARCH_BASE_DNย ย  Sets the base DN search prefix for LDAP-Search authentication method
LDAP_SEARCH_BIND_NAMEย ย  Sets the bind principal for LDAP-Search authentication method
LDAP_SEARCH_BIND_PASSWORDย ย  Sets the bind password for LDAP-Search authentication method
LDAP_SEARCH_DOMAIN_NAMEย ย  LDAP_SEARCH_DOMAIN_NAME Environment Variable
LDAP_SEARCH_FILTERย ย  LDAP_SEARCH_FILTER Environment Variable
LDAP_USERNAME_ATTRIBUTEย ย  Allows choosing some attribute in the LDAP user record as the username in LogScale
LDAP_VERBOSE_LOGGINGfalseย  If true, emit log messages when users sign in using LDAP authentication.
LIVEQUERY_CANCEL_COST_PERCENTAGE10ย  Backlog allowed before canceling the queries with the highest cost
LIVEQUERY_CANCEL_TRIGGER_DELAY_MS20,000 msย  Sets cancelling of the most consuming live queries
LOCAL_STORAGE_GLOBAL_SNAPSHOT_BOOT_TIMEOUT_SECONDS60ย  Configures global snapshot boot time for fetching from local storage.
LOCAL_STORAGE_MIN_AGE_DAYSย ย  Minimum number of days to keep a fresh segment file before it is deleted locally
LOCAL_STORAGE_PERCENTAGE85 %ย  Sets a limit to the percentage of disk full
LOCAL_STORAGE_PREFILL_PERCENTAGE70% of LOCAL_STORAGE_PERCENTAGEย  Configures eager prefilling of disks from bucket storage
LOGSCALE_SAML_IDP_REQUIRE_MATCHING_EMAIL_DOMAINfalseย  Whether the email domain is required to match
LOG_COLLECTOR_DOWNLOAD_ENDPOINTS_USE_HTTP_PROXYtrueย  Controls whether the download endpoint should use the configured HTTP proxy. The default is to use the proxy.
LOG_COLLECTOR_FLEET_MANAGEMENT_URLย ย  Specifies the URL endpoint for the Log Collector Fleet Management service.
LOG_COLLECTOR_UPDATE_SERVERhttps://lc-update.humio.comย  Specifies the URL endpoint for the Log Collector Update Server, which provides software updates for deployed log collectors.
LOG_COLLECTOR_UPDATE_SERVER_USE_HTTP_PROXYtrueย  Controls whether the update server should use the configured HTTP proxy. The default is to use the proxy.
MAPPER_JOB_QUEUE_LENGTH50% of the cores on the nodeย  Controls the maximum size of the mapper pool queue in each worker.
MAXMIND_ACCOUNT_IDtrueย  Sets automatic update of MaxMind IP location database
MAXMIND_BASE_URLย ย  Enables to change the base path to download MaxMind from
MAXMIND_EDITION_IDย deprecated in 1.19 Deprecated, replaced by MAXMIND_IP_LOCATION_EDITION_ID
MAXMIND_IP_LOCATION_EDITION_IDย ย  Allows to use an alternative MaxMind database for IP location information (optional)
MAXMIND_LICENSE_KEYย ย  Where to specify the license key for your account if you have a MaxMind license
MAXMIND_USE_HTTP_PROXYtrueย  Control if MaxMind databases are downloaded using the HTTP proxy or not.
MAX_ACCUMULATED_POLL_SECONDS3ย  Controls the maximum amount of time that can accumulate for polling operations before triggering resource management actions.
MAX_BUCKET_POINTS10,000ย  MAX_BUCKET_POINTS Environment Variable
MAX_CHARS_TO_FIND_TIMESTAMPย ย  Sets the number of characters searched by the findTimestamp() function
MAX_CONCURRENT_EXPORTS_PER_VIEW10ย  MAX_CONCURRENT_EXPORTS_PER_VIEW Environment Variable
MAX_CONCURRENT_QUERIES_ON_WORKER1,000ย  Maximum number of historic queries that can be executed on a single worker node. This limit does not apply to live parts of queries.
MAX_DISTINCT_TAG_VALUES1,000ย  Allows auto-grouping of tags
MAX_EVENT_FIELD_COUNT8,000 fieldsย  Sets the enforced maximum number of fields in an event in the ingest phase
MAX_EVENT_FIELD_COUNT_IN_PARSER50,000 fieldsย  Specifies the number of fields allowed within the parser
MAX_EVENT_SIZE1 MiBย  Specifies the maximum allowed event size.
MAX_FEDERATED_CONNECTIONS50 connectionsย  Number of connections that can be attached to a Multi-Cluster View.
MAX_FEDERATED_CONNECTION_TAGS25 tagsย  Number of tags that can be added to a Multi-Cluster View Connection.
MAX_FILEUPLOAD_SIZE104,857,600 bytesย  Specifies the maximum size of uploaded files.
MAX_GRAPHQUERY_ITERATION_LIMIT10ย  Defines the maximum limit for the number of times the correlate() can be set to iterate over events during query execution.
MAX_HOURS_SEGMENT_OPEN24 hoursย  The maximum number of hours a merge target will remain open for writing before being closed.
MAX_INGEST_DELAY_SECONDS3,600 secondsย  Events backlog allowed before LogScale starts responding on http interfaces
MAX_INGEST_EVENTS_PER_TIMEOUT1,024ย  Controls the maximum number of events that can be processed in a single ingestion batch before a timeout check is performed.
MAX_INGEST_REQUEST_SIZE33,554,432 bytesย  Size limit of ingest requests after content-encoding has been applied.
MAX_JITREX_BACKTRACK1,000deprecated in 1.227 Limits CPU resources spent in a regex match
MAX_JOIN_LIMIT200,000 rowsย  Sets the limit parameter of the join() function.
MAX_NUMBER_OF_GLOBALDATA_DUMPS_TO_KEEP20 data dumpsย  Maximum number of global data dumps
MAX_OFFSETS_AFTER_KAFKA_RESETย  Controls the maximum number of Kafka offsets that will be tracked after a consumer group reset operation.
MAX_POLLS_PER_SECOND2,000ย  Controls the maximum rate at which polling operations can be initiated across the entire system.
MAX_POLL_CONCURRENCY_AT_SOURCE2,500ย  Controls the maximum number of concurrent polling operations that can be performed against a single data source.
MAX_POLL_CONCURRENCY_AT_TARGET2,500ย  Controls the maximum number of concurrent polling operations that can be directed at a single target repository or destination.
MAX_QUERY_POLLS_FOR_WORKER100ย  Maximum number of worker polls (across all workers) scheduled per second.
MAX_REGEX_REPETITIONS100deprecated in 1.227 Controls the maximum number of repetitions allowed in regular expression patterns used in queries and parsers.
MAX_SECS_WAIT_FOR_SYNC_WHEN_CHANGING_DIGEST_LEADER5 minutesย  Specifies when digest coordination will permit a node that is not in sync
MAX_SERIES_LIMIT500 seriesย  Determines the max amount of series in a bucket and/or timechart.
MAX_SERIES_MEMLIMITย ย  Determines the maximum memory for a series in a bucket and/or timechart.
MAX_TABLE_SIZE_BYTESย  Controls the max table size.
MAX_WORLD_MAP_BUCKETS65,536ย  Controls the maximum number of data buckets (points or regions) that can be displayed on world map visualizations.
MERGE_TARGET_RETENTION_PERCENTAGE3.33 %ย  The minimum desired merge-result segments based on retention size/time.
METRIC_RETENTION_IN_DAYS5 yearsย  Allows to configure humio-metrics retention.
MINIMUM_HUMIO_VERSION1.0.0ย  Minimum version of Humio (LogScale) required for the cluster.
MINISEGMENT_PREMERGE_MAX_BLOCKSnumber of blocks in normal mini segmentsย  Configures how many blocks are allowed in the merge result from merging mini segments into larger mini segments.
MINISEGMENT_PREMERGE_MIN_FILES12 minisegmentsย  Minimum number of mini segments that must go into a merge.
MINISEGMENT_PREMERGE_MIN_FILES_WHEN_IDLE4 minisegmentsย  Minimum number of mini segments that must go into a merge, for idle datasources.
MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING48 msย  Logs a warning if mini segment is not merged
MIN_QUERY_PERMITS_FACTOR1.0ย  Minimum factor for query permits allocation.
MULTI_PASS_DEFAULT_ITERATION_LIMIT10ย  Default limit for the number of iterations in multi-pass operations.
MULTI_PASS_MAX_ITERATION_LIMIT50ย  Maximum limit for the number of iterations in multi-pass operations.
NODE_ROLESallย  Defines the logical roles for a node within the LogScale cluster
OIDC_AUDIENCEย ย  Audience to expect in a JWT
OIDC_AUTHORIZATION_ENDPOINTย ย  URL to endpoint user is redirected to when authorizing
OIDC_CACHE_USERINFO_MS600,000 msย  How long user info is cached on a LogScale node
OIDC_ENABLE_DIRECT_TOKEN_AUTHfalseย  Whether direct token authorization is enabled.
OIDC_GROUPS_CLAIMhumio-groupsย  Claim name to interpret as the groups in LogScale
OIDC_JWKS_URIย ย  URL to JWKS endpoint for keys to validate tokens
OIDC_MULTI_ORG_CLAIMย ย  Claim name when running with multiple organizations in LogScale
OIDC_OAUTH_CLIENT_IDย ย  Client ID of OpenID application
OIDC_OAUTH_CLIENT_SECRETย ย  Client secret of OpenID application
OIDC_ORGANIZATION_CLAIMย ย  Specifies which claim in the OIDC token should be used to determine the user's organization within LogScale.
OIDC_PROVIDERย ย  URL to the OpenID Connect provider
OIDC_REGISTRATION_ENDPOINTย ย  Specifies the endpoint URL where LogScale can dynamically register itself as a client with the OIDC provider. Not supported by all OIDC providers.
OIDC_REQUIRE_ISSUER_MATCHtrueย  Whether issuer match is required.
OIDC_SCOPESย ย  OIDC_SCOPES Environment Variable
OIDC_SCOPE_CLAIMscopeย  Claim for OIDC scope.
OIDC_SERVICE_NAMEOpenID Connectย  OIDC provider name displayed at sign in
OIDC_SUBDOMAIN_FROM_REQUEST_URLfalseย  Whether subdomain from request URL is permitted.
OIDC_TOKEN_ENDPOINTย ย  URL to token endpoint used to exchange authentication code to an access token
OIDC_TOKEN_ENDPOINT_AUTH_METHODย ย  Authorization method for a token endpoint
OIDC_USERINFO_ENDPOINTย ย  URL to user info endpoint to retrieve user information from an access token
OIDC_USERNAME_CLAIMhumio-userย  Name of the claim to interpret as username in LogScale
OIDC_USE_HTTP_PROXYtrueย  Whether to use the HTTP proxy for calling OIDC
ONLY_CREATE_USER_IF_SYNCED_GROUPS_HAVE_ACCESSfalseย  Configures whether users are created if synced groups have access to the sandbox and system repositories
PARSER_THROTTLING_ALLOC_FACTOR1.0ย  Factor used to determine the allocation of resources for parser throttling. Controls the fraction of resources dedicated to parsing operations to prevent overload.
PDF_RENDER_SERVICE_CALLBACK_BASE_URLย ย  Private URL for PDF Render Service callbacks.
POSTMARK_FROMย ย  Send emails using the Postmark service
POSTMARK_SERVER_SECRETย ย  Sets the values for your server's token when using the Postmark service
PRIMARY_STORAGE_MAX_FILL_PERCENTAGEย ย  Primary segment files' storage limit
PROMETHEUS_METRICS_PORTย ย  Enables Prometheus to scrape metrics from LogScale
PROXY_PREFIX_URLย ย  Specifies a URL prefix to be used when LogScale is deployed behind a reverse proxy or load balancer. Helps LogScale correctly generate URLs when it's not directly accessible at the root path of a domain.
PUBLIC_URLย ย  Public URL where LogScale instance is reachable from a browser
QUERY_CACHE_MIN_COST1,000Lย  Enables/disables caching when using features that store a copy of live search results to the local disk
QUERY_CACHE_STORAGE_MAX_USE_PERCENTAGE0.1ย  Controls the maximum percentage of available storage that can be used for the query cache.
QUERY_COORDINATION_PARTITIONS1,024ย  Determines the number of partitions used for query coordination across the cluster.
QUERY_COORDINATOR_EXECUTOR_CORESCore count/2ย  Specifies the number of CPU cores allocated to the query coordinator's executor thread pool.
QUERY_COORDINATOR_START_RATE_LIMITnumber of cores/2added in 1.243 Maximum number of new queries can be started per interval based on the interval length specified in QUERY_COORDINATOR_START_RATE_LIMIT_INTERVAL_MILLIS. If the limit is reached, then query execution is delayed.
QUERY_COORDINATOR_START_RATE_LIMIT_INTERVAL_MILLIS1,000added in 1.243 The interval in milliseconds over which the start rate limit in QUERY_COORDINATOR_START_RATE_LIMIT is applied. Defaults to 1000. Minimum value is 1000.
QUERY_EXECUTOR_CORESย ย  Sets the number of CPU cores to reduce pressure on context switching due to hyper-threading
QUERY_MAX_LENGTH66,000 charactersย  Maximum query length in characters.
QUERY_SCHEDULER_QUERY_QUEUE_SIZE16,384 queriesย  Number of queries that can be enqueued on the query workers while waiting to start running.
QUERY_SPENT_FACTOR0.5ย  Defines the weight of recent query costs when scheduling. Higher values mean that users with high recent query costs will see their queries penalized more during scheduling by the query scheduler. If set to 0, this weighting is disabled.
RDNS_DEFAULT_SERVERย  Default server to use for reverse DNS queries using rdns() function or reverseDns() function.
READ_GROUP_PERMISSIONS_FROM_FILEfalseย  Allows groups and roles to be converted to new RBAC model and visible under Administration in read-only
REGION_SELECT_CONFIG_URLย  Specifies the URL from which LogScale should fetch region selection configuration information. The default value is typically empty or null, which means region selection is not enabled.
REJECT_INGEST_ON_PARSER_EXCEEDING_FRACTION0.85ย  Fraction threshold that determines when to reject ingest operations if a parser is exceeding its allocated resources. When parser resource usage exceeds this fraction of its allocation, new ingest operations will be rejected.
RUNTIME_KIND_NAMEย ย  Specifies the type or "kind" of runtime environment in which LogScale is operating. Values can be onprem (for self-hosted),oncloud (for Cloud), or oncommunity (for community edition). Set during deployment and never changed.
S3_ACTION_ACCESSKEYย ย  Sets the AWS access keys for pushing data to S3 with S3 Action
S3_ACTION_MAX_FILE_SIZE_BYTES52,428,800 bytesย  Maximum size allowed for files uploaded with the S3 action.
S3_ACTION_SECRETKEYย ย  Sets the AWS secret keys for pushing data to S3 with S3 Action
S3_ARCHIVING_ACCESSKEYย ย  Sets the S3 access keys for archiving ingested logs in export format
S3_ARCHIVING_CLUSTER_WIDE_DISABLEDfalseย  Boolean flag that controls whether S3 archiving is disabled across the entire cluster. When set to true, S3 archiving will be disabled for all repositories in the cluster regardless of individual settings.
S3_ARCHIVING_CLUSTER_WIDE_END_AT2099-12-31T23:59:59.999Zย  End date and time for cluster-wide S3 archiving period. Specifies when to stop S3 archiving across the cluster. Value should be in ISO-8601 format (yyyy-MM-dd'T'HH:mm:ss.SSSZ).
S3_ARCHIVING_CLUSTER_WIDE_REGEX_FOR_REPO_NAME.*ย  Regular expression pattern used to match repository names for cluster-wide S3 archiving. Only repositories with names matching this pattern will be included in cluster-wide S3 archiving. Use ".*" to match all repositories.
S3_ARCHIVING_CLUSTER_WIDE_START_FROM2020-01-01T00:00:00.000Zย  Start date and time for cluster-wide S3 archiving period. Specifies when to begin S3 archiving across the cluster. Value should be in ISO-8601 format (yyyy-MM-dd'T'HH:mm:ss.SSSZ).
S3_ARCHIVING_ENDPOINT_BASEย ย  Allows to point to a non-AWS endpoint for archiving
S3_ARCHIVING_REQUIRE_ROLEย ย  Sets whether S3 configuration is using an IAM user or IAM role (recommended).
S3_ARCHIVING_SECRETKEYย ย  Sets the S3 secret key for archiving of ingested logs in an export format
S3_ARCHIVING_USE_HTTP_PROXYtrueย  Whether to use the globally configured HTTP proxy for communicating with S3
S3_ARCHIVING_WORKERCOUNT1ย  Sets the number of parallel workers for upload
S3_EXPORT_USE_HTTP_PROXYtrueย  Enables/disables HTTP proxy configured for exporting to Amazon S3
S3_NETTY_CLIENTtrueย  Sets the Netty client as the default for S3 bucket storage.
S3_NETTY_CONNECTING_TIMEOUT_SECONDS2ย  Number of seconds to wait when initially establishing a connection before giving up and timing out when using S3 Netty client. Relevant only when S3_NETTY_CLIENT is true.
S3_NETTY_CONNECTION_ACQUISITION_TIMEOUT_SECONDS3,600ย  The number of seconds to wait when acquiring a connection from the pool before giving up and timing out when using S3 Netty client. Relevant only when S3_NETTY_CLIENT is true.
S3_NETTY_CONNECTION_IDLE_TIMEOUT_SECONDS5ย  Number of seconds that a connection should be allowed to remain open while idle when using S3 Netty client. Relevant only when S3_NETTY_CLIENT is true.
S3_NETTY_CONNECTION_TTL_SECONDS0ย  The maximum number of seconds that a connection should be allowed to remain open, regardless of usage frequency, when using S3 Netty client. Relevant only when S3_NETTY_CLIENT is true.
S3_NETTY_READ_TIMEOUT_SECONDS120ย  The number of seconds to wait for a read on a socket before an exception is thrown. Relevant only when S3_NETTY_CLIENT is true.
S3_NETTY_TCP_KEEP_ALIVEfalseย  Sets whether TCP keep alive is enabled or disabled when using S3 Netty client. By default, this is disabled. Relevant only when S3_NETTY_CLIENT is true.
S3_NETTY_THREAD_POOL_MAX_SIZEvalue of S3_STORAGE_CONCURRENCY divided by twoย  Sets the maximum size for the thread pool when using S3 Netty client. Relevant only when S3_NETTY_CLIENT is true.
S3_NETTY_WRITE_TIMEOUT_SECONDS30ย  The number of seconds to wait for a write on a socket before an exception is thrown. Relevant only when S3_NETTY_CLIENT is true.
S3_RECOVER_FROM_BUCKETย ย  S3 bucket name to recover data from on the standby cluster
S3_RECOVER_FROM_ENCRYPTION_KEY_SECRET_KEYย ย  Key within the Kubernetes secret that holds the source S3 encryption key
S3_RECOVER_FROM_ENCRYPTION_KEY_SECRET_NAMEย ย  Kubernetes secret name containing the source S3 encryption key
S3_RECOVER_FROM_KMS_KEY_ARNย ย  Arn to the KMS key when using server side encryption on a recovery bucket
S3_RECOVER_FROM_REGIONย ย  AWS region of the S3 bucket to recover data from
S3_RECOVER_FROM_REPLACE_BUCKETย ย  Replaces the source S3 bucket name with the target bucket name in writes during recovery
S3_RECOVER_FROM_REPLACE_REGIONย ย  Replaces the source AWS region with the target region in S3 bucket paths during recovery
S3_STORAGE_2_KMS_KEY_ARNย ย  ARN to the KMS key when using server side encryption on a 2nd bucket
S3_STORAGE_ACCESSKEYย ย  Sets the access key for S3 storage
S3_STORAGE_BUCKETย ย  Bucket storage S3 variant
S3_STORAGE_CONCURRENCYcores/2deprecated in 1.240 The number of concurrent downloading/uploading files in S3 storage
S3_STORAGE_DISABLE_UPLOAD_DUPLICATE_CHECKfalseย  If true, turns off overwrite protection for files that already exist in the bucket. If false, the If-None-Match header is used when using AWS SDK to prevent overwriting files that already exist in the bucket.
S3_STORAGE_ENCRYPTION_KEYย ย  Sets the encryption key for S3 storage
S3_STORAGE_ENDPOINT_BASEย ย  Sets the URL for pointing to your own non-AWS endpoint for S3 storage
S3_STORAGE_KMS_KEY_ARNย ย  ARN to the KMS key when using server side encryption on a bucket
S3_STORAGE_MAX_CONCURRENT_DOWNLOADS1 slot per 2 coresย  Controls the max concurrency of downloads from bucket storage.
S3_STORAGE_MAX_CONCURRENT_UPLOADS1 slot per 2 coresย  Controls the max concurrency of uploads to bucket storage.
S3_STORAGE_OBJECT_KEY_PREFIXย ย  Sets the optional prefix for all object keys
S3_STORAGE_PREFERRED_COPY_SOURCEfalseย  Sets how to download segments from bucket storage when prefetching
S3_STORAGE_REGIONย ย  S3_STORAGE_REGION Environment Variable
S3_STORAGE_SECRETKEYย ย  Sets Secret Key for S3 bucket storage
S3_STORAGE_STREAM_IDLE_TIMEOUT_SECONDS180added in 1.243 Sets the idle timeout in seconds for S3 storage streams. If the S3 provider stops sending data for this duration, the transfer aborts instead of blocking indefinitely. This prevents hanging transfers when the S3 provider crashes or becomes unresponsive. Applies to both S3 uploads and downloads.
S3_STORAGE_TRANSFER_THREAD_POOL_SIZE50% of node's CPU coresย  Controls the pool size for the shared thread pool used to execute uploads and downloads.
S3_STORAGE_USE_HTTP_PROXYtrueย  Enables/disables HTTP proxy for communicating with Amazon Bucket Storage
SAML_ALTERNATIVE_IDP_CERTIFICATEย ย  Provides an alternative certificate for authentication
SAML_DEBUGfalseย  SAML_DEBUG Environment Variable
SAML_GROUP_MEMBERSHIP_ATTRIBUTEย ย  Synchronizes the groups upon successful login in LogScale
SAML_IDP_CERTIFICATEย ย  Provides a certificate for authentication
SAML_IDP_ENTITY_IDย ย  IDP identifier used internally in the authentication flow
SAML_IDP_SIGN_ON_URLย ย  User accessing LogScale is redirected to this variable and authentication flow starts
SAML_METADATA_ENDPOINT_URLย ย  Specifies a SAML metadata endpoint URL where LogScale will fetch the IdP signing certificate.
SAML_USER_ATTRIBUTEย ย  Allows to set a different user attribute name
SANGRIA_LOG_SLOW_MILLISย ย  SANGRIA_LOG_SLOW_MILLIS Environment Variable
SCHEDULED_REPORT_MAX_RETRY_ATTEMPTS5 retriesย  Maximum number of retries that will be attempted for scheduled reports. If a report times out more than this number of times, the report is disabled.
SCHEDULED_SEARCH_BACKFILL_LIMIT5ย  Configures the global maximum backfill limit for scheduled searches
SCHEDULED_SEARCH_DESPITE_WARNINGSfalseย  Configures actions trigger in schedules searches in case of warnings
SCHEDULED_SEARCH_MAX_NUMBER_OF_RERUNSย ย  Sets the maximum number of reruns that can be scheduled for schedule searches.
SCHEDULED_SEARCH_MAX_WAIT_FOR_MISSING_DATA10ย  Sets the maximum time a schedule search will be retried in case of missing data warnings
SEARCH_PIPELINE_MONITOR_QUERY#kind=logs | count()ย  The query that runs by default on the search pipeline monitor.
SECRET_MANAGER_ENABLEDtrueย  Controls whether the integrated secret management functionality is enabled. Secret manager for managing secrets through LogScale to a service, such as AWS Secrets Manager.
SEGMENTMOVER_EXECUTOR_COREScoreCount / 2ย  Controls the number of CPU cores allocated to the segment mover executor.
SEGMENT_READ_MAXIMUM_SIZE_KB1,024ย  Maximum buffer size in KB for reading storage segment data. Controls the trade-off between memory usage and I/O performance during segment reads.
SELFJOIN_LIMIT10ย  Maximum number of self-joins allowed in a query. Limits the complexity of queries to prevent excessive resource consumption from queries with too many self-joins. If 0 or less, then it is unlimited.
SEND_USER_INVITEStrueย  Sets whether to send email invitations
SHARED_DASHBOARDS_ENABLEDtrueย  Allows to disable shared dashboards
SHUTDOWN_ABORT_FLUSH_TIMEOUT_MILLIS30,000 msย  How long the digest worker thread keeps working on flushing the contents of in-memory buffers at shutdown
SINGLE_USER_PASSWORDย ย  Sets the password for single-user authentication mode
SINGLE_USER_USERNAMEuserย  Sets the username for single-user authentication mode
SLACK_POST_MESSAGE_URLhttps://slack.com/api/chat.postMessageย  Specifies the URL endpoint for sending notifications to Slack. Used when LogScale is configured to send alerts or notifications to Slack channels. It defines the URL that LogScale uses to post messages to your Slack workspace.
SMTP_HOSTย ย  Allows to send emails using an SMTP server
SMTP_PASSWORDย ย  Sets the secret password when using an SMTP server for emails
SMTP_PORTย ย  Sets the port number when using an SMTP server for emails
SMTP_SENDER_ADDRESSย ย  Sets your sender address when using an SMTP server for emails
SMTP_USERNAMEย ย  Sets your username when using an SMTP server for emails
SMTP_USE_STARTTLSย ย  Enables/disables StartTLS when using an SMTP server for emails
STATIC_IMAGE_CONTENT_URLย ย  Allows note widgets to display images from the configured URL
STATIC_USERSย ย  Used to define user accounts directly in the configuration rather than through an external authentication system.
STREAMING_QUERY_KEEPALIVE_NEWLINESfalseย  Whether to emit a newline into streaming query responses
STREAMING_QUERY_KEEPALIVE_NEWLINES_ON_NODESfalseย  Whether to emit a newline into streaming query responses for internal requests
STREAMING_QUERY_KEEPALIVE_TIMEOUTunsetย  The keep-alive duration to set on HTTP responses for streaming queries
TABLE_CACHE_MAX_STORAGE_FRACTION0.001ย  Fraction of disk space allowed for caching file data used for query functions such as match() and readFile().
TABLE_CACHE_MAX_STORAGE_FRACTION_FOR_INGEST_AND_HTTP_ONLY0.1ย  Fraction of disk space allowed on ingest or httponly node for caching file data used for query functions such as match() and readFile().
TABLE_CACHE_MEMORY_ALLOWANCE_FRACTION0.2ย  Specifies the maximum fraction of available memory for the table cache. Controls how much of the system's memory can be used for caching query result tables. It is specified as a fraction of the total memory available for files.
TAG_HASHING_BUCKETS32ย  Used to support auto-grouping of tags
TCP_INGEST_MAX_TIMEOUT_SECONDSย ย  Sets the timeout for TCP ingest listeners
THREAD_SIZE_LOGGING_INTERVAL_SECONDSย ย  THREAD_SIZE_LOGGING_INTERVAL_SECONDS Environment Variable
TLS_CIPHER_SUITESย ย  Used to set the allowed TLS protocols and cipher suites
TLS_CLIENT_ALIASย ย  Alias of the key in the keystore to use when a client request is made from other LogScale instances or to a webhook notifier
TLS_CLIENT_AUTHfalseย  Whether to require TLS client authentication
TLS_DEFAULT_ALIASย ย  Alias of the key in the keystore to use when serving a client without an SNI extension header
TLS_DEFAULT_SERVER_ALIASย ย  The alias of the private key in the keystore to use when LogScale cannot determine a suitable private key using SNI. If not specified, an arbitrary private key is used.
TLS_HOSTNAME_VERIFICATION_FILTERย ย  Whether to perform hostname verification
TLS_KEYSTORE_LOCATIONย ย  Path to the keystore
TLS_KEYSTORE_TYPEย ย  The type of keystore, either PKCS12 or JKS
TLS_KEY_PASSWORDย ย  The key password for TLS
TLS_PROTOCOLSย ย  Sets the TLS protocols to allow when communicating
TLS_SERVERย ย  Whether TLS should be used when serving the web interface
TLS_TRUSTSTORE_LOCATIONย ย  Path to the truststore
TLS_TRUSTSTORE_PASSWORDย ย  Password to unlock the truststore, if any
TLS_TRUSTSTORE_TYPEย ย  The type of truststore, either PKCS12 or JKS
TOPIC_MAX_MESSAGE_BYTES8,388,608 bytesย 

When LogScale is managing Kafka, overrides the default message size for the ingest queue and chatter topics. It is only applicable on initial creation of a topic. To customize the behavior, use the scripts shipping with the Kafka install: kafka/bin/kafka-configs.sh.

See MAX_EVENT_SIZE for more information.

TOP_K_MAX_MAP_SIZE_HISTORICAL32 * 1,024 bytesย  TOP_K_MAX_MAP_SIZE_HISTORICAL Environment Variable
TOP_K_MAX_MAP_SIZE_LIVE8 * 1,024 bytesย  TOP_K_MAX_MAP_SIZE_LIVE Environment Variable
TOTAL_MEMORY_MBย ย  Total available memory on the host in megabytes, used by the launcher to calculate JVM memory defaults
UI_AUTH_FLOWtrueย  UI_AUTH_FLOW Environment Variable
USE_AWS_SDKtrueย  Controls whether to use the AWS SDK for AWS-related operations. This parameter affects how LogScale interacts with AWS S3 (for storage).
USING_EPHEMERAL_DISKSfalseย  Whether to use ephemeral disks on all nodes
VALUE_DEDUP_LEVELย ย  Limits the CPU time spent on removing duplication of values
VERBOSE_AUTHfalseย  VERBOSE_AUTH Environment Variable
WARN_ON_INGEST_DELAY_MILLIS120,000 msย  Warns when ingest is delayed
ZONEย ย  When set, allows spread of partitions across the different zones.