Skip to content
LogoLogScale DocumentationLibraryGuidance Release Notes Integrations Query Examples Training APIGraphQLSearch Archives Contact Support
🔖 🔔 ੆Help button for documentation
    • Self-Hosted Overview
    • Instance Administration
      • Data Retention
      • Measure and Monitor
        • Cluster Statistics
        • Measure and Manage Ingest Usage
          • What's Measured
            • Measurement Repositories
          • Measure Data Ingest
          • Optimize Ingestion
          • Monitor Usage
        • LogScale Internal Logging
          • Log LogScale to LogScale
      • Data Archiving
        • S3 Archiving
        • GCS Archiving
        • Azure Archiving
      • LogScale Multi-Cluster Search
        • Understand Multi-Cluster Topologies
        • Multi-Cluster Security
        • Configure Multi-Cluster
        • Create and Manage Multi-Cluster Views using LogScale UI
        • Create a Multi-Cluster View using GraphQL
          • Add a remote connection
          • Change Remote connections
          • Add a local connection
          • Change local connections
          • Delete connections
        • Advanced Multi-Cluster Topics
          • Enable Multi-Cluster Feature Flags
          • Query Function Limitations
          • Using match() in Multi-Cluster Scenarios
          • Identify Queries on Remote Clusters
          • Messages During Multi-Cluster Queries
    • Query Administration
      • Query Monitor
      • Blocked Queries
        • Add Query to Blocklist
        • Remove or Unblock an Existing Blocked Query
      • Organization-Owned Queries
        • Enable organization-owned queries for a role
          • View queries without organization ownership permissions
        • Update organization ownership for existing queries
      • Query Quotas
    • Configure Security
      • Initial and key users
      • Tokens in LogScale
        • API Tokens
          • Use API Tokens
          • Repository and View API Tokens
          • Organization API Tokens
          • System API Tokens
          • Personal API Token
      • Organization Essentials
        • Users and Permissions
          • Manage Users
            • Manage User Roles
            • Grant Permissions to Specific Assets
          • Manage Groups
            • Group Roles
            • Group Memberships
            • Group Synchronization
          • Manage Roles
            • Set Up Roles in a File
          • Permissions Requirements
            • Repository and View Permissions
        • Set User Defaults
      • Security policies
        • Dashboard security policies
        • API token security policies
          • Behavior when changing token security policies
          • Personal API token security policy
          • Repository and View API tokens security policy
          • Organization API tokens security policies
          • System tokens security policies
        • Actions security policies
      • IP Filters
        • IP Filter Rules
        • Manage IP Filters
        • Create an IP Filter
        • Edit an IP Filter
      • Session management
        • Configure session cookies
      • Audit Logging
    • Cluster Management
      • Cluster Nodes
        • Node Identifiers
      • Kafka Cluster
      • Auxiliary Nodes
      • Health Checks
    • Reference Material
      • Dynamic Configuration Parameters
        • AdHocTablesLimit
        • AggregatorOutputRowLimit
        • AllowInPlaceMigration
        • ArchivingClusterWideDisabled
        • ArchivingClusterWideEndAt
        • ArchivingClusterWideRegexForRepoName
        • ArchivingClusterWideStartFrom
        • DisableAssetSharing
        • BlockSignup
        • BucketStorageKeySchemeVersion
        • BucketStorageUploadInfrequentThresholdDays
        • BucketStorageWriteVersion
        • CancelQueriesExceedingAggregateOutputRowLimit
        • CorrelateConstellationTickLimit
        • CorrelateConstraintLimit
        • CorrelateLinkValuesLimit
        • CorrelateLinkValuesMaxByteSize
        • CorrelateMinIterations
        • CorrelateNumberOfTimeBuckets
        • CorrelateQueryEventLimit
        • CorrelateQueryLimit
        • DebugAuditRequestTrace
        • defaultDigestReplicationFactor
        • defaultSegmentReplicationFactor
        • DeleteDuplicatedNameViewsAfterMerging
        • DisableAnalyticsJob
        • DisableNewRegexEngine
        • DisableUserTracking
        • DisableViewWithSameNameCleanup
        • DisableAssetSharing
        • EnableGlobalJsonStatsLogger
        • FdrEnable
        • FdrExcludedNodes
        • FdrMaxNodes
        • FdrMaxNodesPerFeed
        • FdrS3FileSizeMax
        • FileReplicationFactor
        • FlushSegmentsAndGlobalOnShutdown
        • GracePeriodBeforeDeletingDeadEphemeralHostsMs
        • GracefulShutdownConsideredAliveSeconds
        • GraphQLSelectionSizeLimit
        • GraphQLAliasCountLimit
        • GraphQLDirectiveCountLimit
        • GraphQLMaxErrorsCount
        • GraphQLQueryAnalysisDisabled
        • GraphQLQueryDepthLimit
        • GraphQLFragmentCountLimit
        • GraphQLFragmentDepthLimit
        • GraphQLOperationCountLimit
        • GraphQLUnauthenticatedAliasCountLimit
        • GraphQLUnauthenticatedDirectiveCountLimit
        • GraphQLUnauthenticatedFragmentCountLimit
        • GraphQLUnauthenticatedFragmentDepthLimit
        • GraphQLUnauthenticatedOperationCountLimit
        • GraphQLUnauthenticatedQueryDepthLimit
        • GraphQLUnauthenticatedSelectionSizeLimit
        • GroupDefaultLimit
        • GroupMaxLimit
        • IngestFeedAwsDownloadMaxObjectSize
        • IngestFeedAwsProcessingDownloadBufferSize
        • IngestFeedAwsProcessingEventBufferSize
        • IngestFeedAwsProcessingEventsPerBatch
        • IngestFeedGovernorRateOverride
        • IngestFeedGovernorIngestDelayHigh
        • IngestFeedGovernorIngestDelayLow
        • IsAutomaticUpdateCheckingAllowed
        • JoinDefaultLimit
        • JoinRowLimit
        • LiveAdhocTableUpdatePeriodMinimumMs
        • LiveQueryMemoryLimit
        • LookupTableSyncAwaitSeconds
        • MatchFilesMaxHeapFraction
        • MaxAccessTokenTTL
        • MaxQueryPenaltyCreditFactorForParkedQueries
        • MaxRelocatedDatasourcesInGlobal
        • MaxConcurrentQueriesOnWorker
        • MaxCsvFileUploadSizeBytes
        • MaxIngestRequestSize
        • MaxJsonFileUploadSizeBytes
        • MaxOpenSegmentsOnWorker
        • MaxQueryPollsForWorker
        • MaxScheduledReportsPerView
        • MaxScheduledReportsPerViewPerOrgOverride
        • MaxTableForQuerySizeBytes
        • MaxTableSize
        • MinQueryPermitsFactor
        • MinimumHumioVersion
        • MultiPassDefaultIterationLimit
        • MultiPassMaxIterationLimit
        • ParserBacktrackingLimit
        • ParserThrottlingAllocationFactor
        • QueryFSMSyncMergeThreshold
        • QueryBacktrackingLimit
        • QueryCoordinatorMaxHeapFraction
        • QueryCoordinatorMemoryLimit
        • QueryMemoryLimit
        • QueryPartitionAutoBalance
        • QueryResultRowCountLimit
        • QueryMaxLength
        • QuerySchedulerCostMetricsLoggingIntervalSeconds
        • RdnsDefaultLimit
        • RdnsMaxLimit
        • RejectIngestOnParserExceedingFraction
        • ReplaceANSIEscapeCodes
        • ReverseDnsConcurrentRequests
        • ReverseDnsDefaultLimit
        • ReverseDnsDefaultTimeoutInMs
        • ReverseDnsMaxLimit
        • ReverseDnsRequestsPerSecond
        • ReverseDnsConcurrentRequestsPerQuery
        • S3ArchivingClusterWideDisabled
        • S3ArchivingClusterWideEndAt
        • S3ArchivingClusterWideRegexForRepoName
        • S3ArchivingClusterWideStartFrom
        • SampleIntervalForDatasourceRates
        • SelfJoinLimit
        • StateRowLimit
        • StaticQueryFractionOfCores
        • TableCacheMaxStorageFraction
        • TableCacheMaxStorageFractionForIngestAndHttpOnly
        • TableCacheMemoryAllowanceFraction
        • TargetMaxRateForDatasource
        • UnauthenticatedGraphQLSelectionSizeLimit
        • UndersizedMergingRetentionPercentage
        • Get Dynamic Configuration List
        • Set a Dynamic Configuration Value
      • LogScale URLs and Endpoints
      • Configuration Variables
        • AD_HOC_TABLES_LIMIT
        • AGGREGATE_ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
        • AGGREGATE_ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS
        • AGGREGATE_ALERTS_MAX_CATCH_UP_LIMIT
        • AGGREGATOR_OUTPUT_ROW_LIMIT
        • ALERT_DESPITE_WARNINGS
        • ALERT_DISCLAIMER
        • ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
        • ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS
        • ALLOW_CHANGE_REPO_ON_EVENTS
        • ALLOW_KAFKA_RESET_UNTIL_TIMESTAMP_MS
        • ALLOW_XML_DOCTYPE_DECL
        • ALLOWED_REDIRECT_TARGET_DOMAINS
        • API_EXPLORER_ENABLED
        • ASSET_SHARING_DISABLED
        • AUDITLOG_SENSITIVE_RETENTION_DAYS
        • AUTH0_CLIENT_ID
        • AUTH0_CLIENT_SECRET
        • AUTH0_DOMAIN
        • AUTH0_USE_HTTP_PROXY
        • AUTH_ALLOW_SIGNUP
        • AUTH_BY_PROXY_HEADER_NAME
        • AUTHENTICATION_METHOD
        • AUTO_CREATE_USER_ON_SUCCESSFUL_LOGIN
        • AUTO_UPDATE_GROUP_MEMBERSHIPS_ON_SUCCESSFUL_LOGIN
        • AUTO_UPDATE_IP_LOCATION_DB
        • AUTO_UPDATE_MAXMIND
        • AUTOSHARDING_MAX
        • AWS_ACCESS_KEY_ID
        • AWS_KMS_KEY_ARN
        • AWS_SECRET_ACCESS_KEY
        • AZURE_ARCHIVING_ACCOUNTKEY
        • AZURE_ARCHIVING_ACCOUNTNAME
        • AZURE_ARCHIVING_ENDPOINT_BASE
        • AZURE_INGEST_FEED_DEFAULT_CLIENT_ID
        • AZURE_INGEST_FEED_SECRET
        • AZURE_INGEST_FEED_TENANT_ID
        • AZURE_RECOVER_FROM_ACCOUNTKEY
        • AZURE_RECOVER_FROM_ACCOUNTNAME
        • AZURE_RECOVER_FROM_BUCKET
        • AZURE_RECOVER_FROM_ENCRYPTION_KEY
        • AZURE_RECOVER_FROM_ENDPOINT_BASE
        • AZURE_RECOVER_FROM_OBJECT_KEY_PREFIX
        • AZURE_RECOVER_FROM_REPLACE_REGION
        • AZURE_STORAGE_ACCOUNTKEY
        • AZURE_STORAGE_ACCOUNTNAME
        • AZURE_STORAGE_BUCKET
        • AZURE_STORAGE_CONCURRENCY
        • AZURE_STORAGE_ENCRYPTION_KEY
        • AZURE_STORAGE_ENDPOINT_BASE
        • AZURE_STORAGE_MAX_CONCURRENT_DOWNLOADS
        • AZURE_STORAGE_MAX_CONCURRENT_UPLOADS
        • AZURE_STORAGE_OBJECT_KEY_PREFIX
        • AZURE_STORAGE_PREFERRED_COPY_SOURCE
        • AZURE_STORAGE_RESPONSE_TIMEOUT_SECONDS
        • AZURE_STORAGE_TRANSFER_THREAD_POOL_SIZE
        • AZURE_STORAGE_USE_HTTP_PROXY
        • BACKUP_DIR
        • BACKUP_KEY
        • BACKUP_NAME
        • BITBUCKET_OAUTH_CLIENT_ID
        • BITBUCKET_OAUTH_CLIENT_SECRET
        • BITBUCKET_OAUTH_USE_HTTP_PROXY
        • BLOCK_CLOUD_SIGNUPS
        • BLOCK_SIGNUP
        • BLOCK_SIZE_MAX_KB
        • BLOCK_SIZE_MIN_KB
        • BLOCKS_PER_MINISEGMENT
        • BLOCKS_PER_SEGMENT
        • BOOTSTRAP_HOST_ID
        • BOOTSTRAP_HOST_UUID_COOKIE
        • BOOTSTRAP_ROOT_TOKEN_HASHED
        • BUCKET_STORAGE_IGNORE_ETAG_UPLOAD
        • BUCKET_STORAGE_INFREQUENT_ACCESS_CLASS
        • BUCKET_STORAGE_MESSAGE_DIGEST
        • BUCKET_STORAGE_MULTIPLE_ENDPOINTS
        • BUCKET_STORAGE_SSE_COMPATIBLE
        • CHATTER_INITIAL_REPLICATION_FACTOR
        • CLUSTER_PING_TIMEOUT_SECONDS
        • COMPRESSION_TYPE
        • COOKIE_DOMAIN
        • COOKIE_PATH
        • COOKIE_SAMESITE
        • COOKIE_SECURE
        • CORES
        • CORRELATE_CONSTELLATION_TICK_LIMIT
        • CORRELATE_CONSTRAINT_LIMIT
        • CORRELATE_LINK_VALUES_LIMIT
        • CORRELATE_LINK_VALUES_MAX_BYTE_SIZE
        • CORRELATE_MIN_ITERATIONS
        • CORRELATE_NUMBER_OF_TIME_BUCKETS
        • CORRELATE_QUERY_EVENT_LIMIT
        • CORRELATE_QUERY_LIMIT
        • CORS_ALLOWED_ORIGINS
        • CREATE_HUMIO_SEARCH_ALL
        • CS_ANALYTICS_URL
        • DAYS_BEFORE_TOMBSTONE_DELETION
        • DEBUG_AUDIT_REQUEST_TRACE
        • DEFAULT_ALLOW_REBALANCE_EXISTING_SEGMENTS
        • DEFAULT_ALLOW_UPDATE_DESIRED_DIGESTERS
        • DEFAULT_DIGEST_REPLICATION_FACTOR
        • DEFAULT_GRAPHQUERY_ITERATION_LIMIT
        • DEFAULT_GROUPS
        • DEFAULT_MIN_HOST_ALIVE_PERCENTAGE_TO_ENABLE_CLUSTER_REBALANCING
        • DEFAULT_PARSER_NAME
        • DEFAULT_PDF_RENDER_SERVICE_URL
        • DEFAULT_SEGMENT_REPLICATION_FACTOR
        • DEFAULT_USER_INPUT_REGEX_ENGINE
        • DELETE_BACKUP_AFTER_MILLIS
        • DELETE_DUPLICATED_NAME_VIEWS_AFTER_MERGING
        • DELETE_ON_INGEST_QUEUE
        • DELETES_DELAY_MILLIS
        • DIGEST_EXECUTOR_CORES
        • DIRECTORY
        • DISABLE_ANALYTICS_JOB
        • DISABLE_BUCKET_CLEANING_TMP_FILES
        • DISABLE_PERMISSION_CACHE
        • DISABLE_USER_TRACKING
        • DISABLE_VIEW_WITH_SAME_NAME_CLEANUP
        • DUMP_THREADS_SECONDS
        • ELASTIC_PORT
        • EMAIL_ACTION_DISCLAIMER
        • EMERGENCY_USERS
        • ENABLE_AGGREGATE_ALERTS
        • ENABLE_ALERTS
        • ENABLE_BEARER_TOKEN_AUTHORIZATION
        • ENABLE_EVENT_FORWARDING
        • ENABLE_FDR_POLLING_ON_NODE
        • ENABLE_FILTER_ALERTS
        • ENABLE_GLOBAL_JSON_STATS_LOGGER
        • ENABLE_INGEST_FEED
        • ENABLE_IOC_SERVICE
        • ENABLE_ORGANIZATIONS
        • ENABLE_PERSONAL_API_TOKENS
        • ENABLE_SANDBOXES
        • ENABLE_SCHEDULED_REPORT
        • ENABLE_SCHEDULED_SEARCHES
        • ENABLEINTERNALLOGGER
        • ENFORCE_AUDITABLE
        • EXTERNAL_URL
        • FALCON_DATA_CONNECTOR_URL
        • FDR_MAX_NODES_PER_FEED
        • FDR_S3_FILE_SIZE_MAX
        • FDR_USE_PROXY
        • FDR_VISIBILITY_TIMEOUT
        • FEDERATED_SUBMISSION_TIMEOUT_MILLIS
        • FILE_INPUT_STREAM_READ_TIMEOUT
        • FILE_REPLICATION_FACTOR
        • FILE_UPLOAD_TIMEOUT
        • FILTER_ALERT_EMAIL_TRIGGER_LIMIT
        • FILTER_ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
        • FILTER_ALERT_NON_EMAIL_TRIGGER_LIMIT
        • FILTER_ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS
        • FILTER_ALERTS_MAX_CATCH_UP_LIMIT
        • FILTER_ALERTS_MAX_WAIT_FOR_MISSING_DATA
        • FLUSH_BLOCK_SECONDS
        • FORWARDING_BREAKER_EXP_BACKOFF_FACTOR
        • FORWARDING_BREAKER_FAILURES
        • FORWARDING_BREAKER_MAX_RESET
        • FORWARDING_BREAKER_RESET
        • FORWARDING_BREAKER_TIMEOUT
        • FORWARDING_MAX_CONCURRENCY
        • GC_KILL_THRESHOLD_MILLIS
        • GCP_ARCHIVING_ACCOUNT_JSON_FILE
        • GCP_ARCHIVING_BUCKET
        • GCP_ARCHIVING_ENCRYPTION_KEY
        • GCP_ARCHIVING_ENDPOINT_BASE
        • GCP_ARCHIVING_OBJECT_KEY_PREFIX
        • GCP_EXPORT_BUCKET
        • GCP_EXPORT_WORKLOAD_IDENTITY
        • GCP_RECOVER_FROM_BUCKET
        • GCP_RECOVER_FROM_ENCRYPTION_KEY
        • GCP_RECOVER_FROM_REPLACE_BUCKET
        • GCP_RECOVER_FROM_REPLACE_REGION
        • GCP_RECOVER_FROM_WORKLOAD_IDENTITY
        • GCP_STORAGE_ACCOUNT_JSON_FILE
        • GCP_STORAGE_BUCKET
        • GCP_STORAGE_CONCURRENCY
        • GCP_STORAGE_ENCRYPTION_KEY
        • GCP_STORAGE_ENDPOINT_BASE
        • GCP_STORAGE_MAX_CONCURRENT_DOWNLOADS
        • GCP_STORAGE_MAX_CONCURRENT_UPLOADS
        • GCP_STORAGE_OBJECT_KEY_PREFIX
        • GCP_STORAGE_PREFERRED_COPY_SOURCE
        • GCP_STORAGE_TRANSFER_THREAD_POOL_SIZE
        • GCP_STORAGE_USE_HTTP_PROXY
        • GCP_STORAGE_WORKLOAD_IDENTITY
        • GITHUB_OAUTH_CLIENT_ID
        • GITHUB_OAUTH_CLIENT_SECRET
        • GITHUB_OAUTH_USE_HTTP_PROXY
        • GITHUB_USER
        • GLOB_ALLOW_LIST_EMAIL_ACTIONS
        • GLOB_MATCH_LIMIT
        • GLOBAL_INITIAL_REPLICATION_FACTOR
        • GLOBAL_THROTTLE_PERCENTAGE
        • GOOGLE_OAUTH_CLIENT_ID
        • GOOGLE_OAUTH_CLIENT_SECRET
        • GOOGLE_OAUTH_USE_HTTP_PROXY
        • GRACE_PERIOD_BEFORE_DELETING_DEAD_EPHEMERAL_HOSTS_MS
        • GRACE_PERIOD_SECS_BEFORE_DELETING_LOCAL_SEGMENT_COPIES
        • GRACEFUL_SHUTDOWN_CONSIDERED_ALIVE_SECONDS
        • GRAPHQL_ALIAS_COUNT_LIMIT
        • GRAPHQL_DIRECTIVE_COUNT_LIMIT
        • GRAPHQL_MAX_ERRORS_COUNT
        • GRAPHQL_QUERY_ANALYSIS_DISABLED
        • GRAPHQL_QUERY_DEPTH_LIMIT
        • GRAPHQL_FRAGMENT_COUNT_LIMIT
        • GRAPHQL_FRAGMENT_DEPTH_LIMIT
        • GRAPHQL_OPERATION_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_ALIAS_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_DIRECTIVE_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_FRAGMENT_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_FRAGMENT_DEPTH_LIMIT
        • GRAPHQL_UNAUTHENTICATED_OPERATION_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_QUERY_DEPTH_LIMIT
        • GRAPHQL_UNAUTHENTICATED_SELECTION_SIZE_LIMIT
        • HEALTH_CHECK__CLUSTER_TIME_SKEW__WARN_THRESHOLD_MS
        • HEALTH_CHECK__EVENT_LATENCY_P99__WARN_THRESHOLD_SEC
        • HEALTH_CHECK__GLOBAL_TOPIC_LATENCY_P50__WARN_THRESHOLD_MSEC
        • HEALTH_CHECK__PRIMARY_DISK_USAGE__WARN_THRESHOLD_PCT
        • HEALTH_CHECK__PRIMARY_DISK_USAGE__WARN_THRESHOLD_SEC
        • HEALTH_CHECK__SECONDARY_DISK_USAGE__WARN_THRESHOLD_PCT
        • HEALTH_CHECK__SECONDARY_DISK_USAGE__WARN_THRESHOLD_SEC
        • HTTP_PROXY_HOST
        • HTTP_PROXY_ALLOW_ACTIONS_NOT_USE
        • HTTP_PROXY_ALLOW_NOTIFIERS_NOT_USE
        • HTTP_PROXY_PASSWORD
        • HTTP_PROXY_PORT
        • HTTP_PROXY_USERNAME
        • HUMIO_AUDITLOG_DIR
        • HUMIO_DEBUGLOG_DIR
        • HUMIO_GC_OPTS
        • HUMIO_HEAP_SIZE_MB
        • HUMIO_HTTP_BIND
        • HUMIO_JMX_OPTS
        • HUMIO_KAFKA_TOPIC_PREFIX
        • HUMIO_LOG4J_CONFIGURATION
        • HUMIO_MEMORY_OPTS
        • HUMIO_PORT
        • HUMIO_SOCKET_BIND
        • HUMIO_THREADNAME_PREFIX
        • INGEST_FEED_AWS_ACCESS_KEY_ID
        • INGEST_FEED_AWS_CREDENTIALS_PROVIDER_RENEWAL_BUFFER
        • INGEST_FEED_AWS_CREDENTIALS_PROVIDER_SESSION_ID_PREFIX
        • INGEST_FEED_AWS_CREDENTIALS_PROVIDER_USE_PROXY
        • INGEST_FEED_AWS_DOWNLOAD_MAX_OBJECT_SIZE_DEFAULT
        • INGEST_FEED_AWS_PROCESSING_DOWNLOAD_BUFFER_SIZE_DEFAULT
        • INGEST_FEED_AWS_PROCESSING_EVENT_BUFFER_SIZE_DEFAULT
        • INGEST_FEED_AWS_PROCESSING_EVENTS_PER_BATCH_DEFAULT
        • INGEST_FEED_AWS_REGION
        • INGEST_FEED_AWS_ROLE_ARN
        • INGEST_FEED_AZURE_CLIENT_ID
        • INGEST_FEED_AZURE_CLIENT_SECRET
        • INGEST_FEED_AZURE_CREDENTIAL_RETRIEVAL_TIMEOUT
        • INGEST_FEED_AZURE_TENANT_ID
        • INGEST_FEED_AZURE_USE_ENVIRONMENT_AUTH
        • INGEST_FEED_AZURE_USE_PROXY
        • INGEST_FEED_GOVERNOR_GAIN_PER_CORE_DEFAULT
        • INGEST_FEED_GOVERNOR_INGEST_DELAY_HIGH_DEFAULT
        • INGEST_FEED_GOVERNOR_INGEST_DELAY_LOW_DEFAULT
        • INGEST_FEED_GOVERNOR_INITIAL_RATE_PER_CORE
        • INGEST_FEED_JOB_SETTINGS_EXECUTION_INFO_INTERVAL
        • INGEST_FEED_JOB_SETTINGS_POLL_INTERVAL
        • INGEST_FEED_POLL_PERIOD
        • INGEST_FEED_SECRET_ACCESS_KEY
        • INGEST_OCCUPANCY_QUERY_PERMIT_LIMIT
        • INGEST_QUEUE_INITIAL_REPLICATION_FACTOR
        • INGEST_REQUEST_MAX_QUEUE_SECS
        • INITIAL_DISABLED_NODE_TASKS
        • INITIAL_FEATURE_FLAGS
        • IOC_CROWDSTRIKE_API_CLIENT_ID
        • IOC_CROWDSTRIKE_API_CLIENT_SECRET
        • IOC_CROWDSTRIKE_API_URL
        • IOC_UPDATE_SERVER_URL
        • IOC_USE_HTTP_PROXY
        • IP_FILTER_ACTIONS
        • IP_FILTER_IDP
        • IP_FILTER_NOTIFIERS
        • IP_FILTER_RDNS
        • IP_FILTER_RDNS_SERVER
        • IP_FILTER_ROOT_USERS
        • IPFIX_PEN_FILE
        • JOIN_DEFAULT_LIMIT
        • JVM_LOG_DIR
        • JVM_TMP_DIR
        • JWKS_REFRESH_INTERVAL
        • KAFKA_ADMIN_
        • KAFKA_CHATTER_CONSUMER_
        • KAFKA_CHATTER_PRODUCER_
        • KAFKA_CLIENT_RACK
        • KAFKA_CLIENT_RACK_ENV_VAR
        • KAFKA_COMMON_
        • KAFKA_EGRESS_CONSUMER_GROUP_PREFIX
        • KAFKA_EGRESS_EVENT_FORWARDER_TOPICS_TO_DISABLE
        • KAFKA_GLOBAL_CONSUMER_
        • KAFKA_GLOBAL_PRODUCER_
        • KAFKA_INGEST_QUEUE_CONSUMER_
        • KAFKA_INGEST_QUEUE_PRODUCER_
        • KAFKA_MANAGED_BY_HUMIO
        • KAFKA_SERVERS
        • LDAP_AUTH_PRINCIPAL
        • LDAP_AUTH_PRINCIPALS_REGEX
        • LDAP_AUTH_PROVIDER_CERT
        • LDAP_AUTH_PROVIDER_URL
        • LDAP_DOMAIN_NAME
        • LDAP_GROUP_BASE_DN
        • LDAP_GROUP_FILTER
        • LDAP_GROUP_SEARCH_BIND_FOR_LOOKUP
        • LDAP_GROUPNAME_ATTRIBUTE
        • LDAP_SEARCH_BASE_DN
        • LDAP_SEARCH_BIND_NAME
        • LDAP_SEARCH_BIND_PASSWORD
        • LDAP_SEARCH_DOMAIN_NAME
        • LDAP_SEARCH_FILTER
        • LDAP_USERNAME_ATTRIBUTE
        • LDAP_VERBOSE_LOGGING
        • LIVEQUERY_CANCEL_COST_PERCENTAGE
        • LIVEQUERY_CANCEL_TRIGGER_DELAY_MS
        • LOCAL_STORAGE_GLOBAL_SNAPSHOT_BOOT_TIMEOUT_SECONDS
        • LOCAL_STORAGE_MIN_AGE_DAYS
        • LOCAL_STORAGE_PERCENTAGE
        • LOCAL_STORAGE_PREFILL_PERCENTAGE
        • LOG_COLLECTOR_DOWNLOAD_ENDPOINTS_USE_HTTP_PROXY
        • LOG_COLLECTOR_FLEET_MANAGEMENT_URL
        • LOG_COLLECTOR_UPDATE_SERVER
        • LOG_COLLECTOR_UPDATE_SERVER_USE_HTTP_PROXY
        • LOGSCALE_SAML_IDP_REQUIRE_MATCHING_EMAIL_DOMAIN
        • MAPPER_JOB_QUEUE_LENGTH
        • MAX_ACCUMULATED_POLL_SECONDS
        • MAX_BUCKET_POINTS
        • MAX_CHARS_TO_FIND_TIMESTAMP
        • MAX_CONCURRENT_EXPORTS_PER_VIEW
        • MAX_CONCURRENT_QUERIES_ON_WORKER
        • MAX_CSV_FILEUPLOAD_SIZE
        • MAX_DISTINCT_TAG_VALUES
        • MAX_EVENT_FIELD_COUNT
        • MAX_EVENT_FIELD_COUNT_IN_PARSER
        • MAX_EVENT_SIZE
        • MAX_FEDERATED_CONNECTION_TAGS
        • MAX_FEDERATED_CONNECTIONS
        • MAX_FILEUPLOAD_SIZE
        • MAX_GRAPHQUERY_ITERATION_LIMIT
        • MAX_HOURS_SEGMENT_OPEN
        • MAX_INGEST_DELAY_SECONDS
        • MAX_INGEST_EVENTS_PER_TIMEOUT
        • MAX_INGEST_REQUEST_SIZE
        • MAX_JITREX_BACKTRACK
        • MAX_JOIN_LIMIT
        • MAX_JSON_FILEUPLOAD_SIZE
        • MAX_NUMBER_OF_GLOBALDATA_DUMPS_TO_KEEP
        • MAX_OFFSETS_AFTER_KAFKA_RESET
        • MAX_POLL_CONCURRENCY_AT_SOURCE
        • MAX_POLL_CONCURRENCY_AT_TARGET
        • MAX_POLLS_PER_SECOND
        • MAX_QUERY_POLLS_FOR_WORKER
        • MAX_REGEX_REPETITIONS
        • MAX_SECS_WAIT_FOR_SYNC_WHEN_CHANGING_DIGEST_LEADER
        • MAX_SERIES_LIMIT
        • MAX_SERIES_MEMLIMIT
        • MAX_WORLD_MAP_BUCKETS
        • MAXMIND_ACCOUNT_ID
        • MAXMIND_BASE_URL
        • MAXMIND_EDITION_ID
        • MAXMIND_IP_LOCATION_EDITION_ID
        • MAXMIND_LICENSE_KEY
        • MAXMIND_USE_HTTP_PROXY
        • MAX_TABLE_SIZE_BYTES
        • MERGE_TARGET_RETENTION_PERCENTAGE
        • METRIC_RETENTION_IN_DAYS
        • MIN_QUERY_PERMITS_FACTOR
        • MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING
        • MINISEGMENT_PREMERGE_MIN_FILES_WHEN_IDLE
        • MINIMUM_HUMIO_VERSION
        • MINISEGMENT_PREMERGE_MAX_BLOCKS
        • MINISEGMENT_PREMERGE_MIN_FILES
        • MULTI_PASS_DEFAULT_ITERATION_LIMIT
        • MULTI_PASS_MAX_ITERATION_LIMIT
        • NODE_ROLES
        • OIDC_AUDIENCE
        • OIDC_AUTHORIZATION_ENDPOINT
        • OIDC_CACHE_USERINFO_MS
        • OIDC_ENABLE_DIRECT_TOKEN_AUTH
        • OIDC_GROUPS_CLAIM
        • OIDC_JWKS_URI
        • OIDC_MULTI_ORG_CLAIM
        • OIDC_OAUTH_CLIENT_ID
        • OIDC_OAUTH_CLIENT_SECRET
        • OIDC_ORGANIZATION_CLAIM
        • OIDC_PROVIDER
        • OIDC_REGISTRATION_ENDPOINT
        • OIDC_REQUIRE_ISSUER_MATCH
        • OIDC_SCOPE_CLAIM
        • OIDC_SCOPES
        • OIDC_SERVICE_NAME
        • OIDC_SUBDOMAIN_FROM_REQUEST_URL
        • OIDC_TOKEN_ENDPOINT
        • OIDC_TOKEN_ENDPOINT_AUTH_METHOD
        • OIDC_USE_HTTP_PROXY
        • OIDC_USERINFO_ENDPOINT
        • OIDC_USERNAME_CLAIM
        • ONLY_CREATE_USER_IF_SYNCED_GROUPS_HAVE_ACCESS
        • PARSER_THROTTLING_ALLOC_FACTOR
        • PDF_RENDER_SERVICE_CALLBACK_BASE_URL
        • POSTMARK_FROM
        • POSTMARK_SERVER_SECRET
        • PRIMARY_STORAGE_MAX_FILL_PERCENTAGE
        • PROMETHEUS_METRICS_PORT
        • PROXY_PREFIX_URL
        • PUBLIC_URL
        • QUERY_CACHE_MIN_COST
        • QUERY_CACHE_STORAGE_MAX_USE_PERCENTAGE
        • QUERY_COORDINATION_PARTITIONS
        • QUERY_COORDINATOR_EXECUTOR_CORES
        • QUERY_COORDINATOR_START_RATE_LIMIT
        • QUERY_COORDINATOR_START_RATE_LIMIT_INTERVAL_MILLIS
        • QUERY_EXECUTOR_CORES
        • QUERY_SCHEDULER_QUERY_QUEUE_SIZE
        • QUERY_SPENT_FACTOR
        • QUERY_MAX_LENGTH
        • RDNS_DEFAULT_SERVER
        • READ_GROUP_PERMISSIONS_FROM_FILE
        • REGION_SELECT_CONFIG_URL
        • REJECT_INGEST_ON_PARSER_EXCEEDING_FRACTION
        • RUNTIME_KIND_NAME
        • S3_ACTION_ACCESSKEY
        • S3_ACTION_MAX_FILE_SIZE_BYTES
        • S3_ACTION_SECRETKEY
        • S3_ARCHIVING_ACCESSKEY
        • S3_ARCHIVING_CLUSTER_WIDE_DISABLED
        • S3_ARCHIVING_CLUSTER_WIDE_END_AT
        • S3_ARCHIVING_CLUSTER_WIDE_REGEX_FOR_REPO_NAME
        • S3_ARCHIVING_CLUSTER_WIDE_START_FROM
        • S3_ARCHIVING_ENDPOINT_BASE
        • S3_ARCHIVING_REQUIRE_ROLE
        • S3_ARCHIVING_SECRETKEY
        • S3_ARCHIVING_USE_HTTP_PROXY
        • S3_ARCHIVING_WORKERCOUNT
        • S3_EXPORT_USE_HTTP_PROXY
        • S3_NETTY_CLIENT
        • S3_NETTY_CONNECTING_TIMEOUT_SECONDS
        • S3_NETTY_CONNECTION_ACQUISITION_TIMEOUT_SECONDS
        • S3_NETTY_CONNECTION_IDLE_TIMEOUT_SECONDS
        • S3_NETTY_CONNECTION_TTL_SECONDS
        • S3_NETTY_READ_TIMEOUT_SECONDS
        • S3_NETTY_TCP_KEEP_ALIVE
        • S3_NETTY_THREAD_POOL_MAX_SIZE
        • S3_NETTY_WRITE_TIMEOUT_SECONDS
        • S3_RECOVER_FROM_BUCKET
        • S3_RECOVER_FROM_ENCRYPTION_KEY_SECRET_KEY
        • S3_RECOVER_FROM_ENCRYPTION_KEY_SECRET_NAME
        • S3_RECOVER_FROM_KMS_KEY_ARN
        • S3_RECOVER_FROM_REGION
        • S3_RECOVER_FROM_REPLACE_BUCKET
        • S3_RECOVER_FROM_REPLACE_REGION
        • S3_STORAGE_2_KMS_KEY_ARN
        • S3_STORAGE_ACCESSKEY
        • S3_STORAGE_BUCKET
        • S3_STORAGE_CONCURRENCY
        • S3_STORAGE_DISABLE_UPLOAD_DUPLICATE_CHECK
        • S3_STORAGE_ENCRYPTION_KEY
        • S3_STORAGE_ENDPOINT_BASE
        • S3_STORAGE_KMS_KEY_ARN
        • S3_STORAGE_MAX_CONCURRENT_DOWNLOADS
        • S3_STORAGE_MAX_CONCURRENT_UPLOADS
        • S3_STORAGE_OBJECT_KEY_PREFIX
        • S3_STORAGE_PREFERRED_COPY_SOURCE
        • S3_STORAGE_REGION
        • S3_STORAGE_SECRETKEY
        • S3_STORAGE_STREAM_IDLE_TIMEOUT_SECONDS
        • S3_STORAGE_TRANSFER_THREAD_POOL_SIZE
        • S3_STORAGE_USE_HTTP_PROXY
        • SAML_ALTERNATIVE_IDP_CERTIFICATE
        • SAML_DEBUG
        • SAML_GROUP_MEMBERSHIP_ATTRIBUTE
        • SAML_IDP_CERTIFICATE
        • SAML_IDP_ENTITY_ID
        • SAML_IDP_SIGN_ON_URL
        • SAML_METADATA_ENDPOINT_URL
        • SAML_USER_ATTRIBUTE
        • SANGRIA_LOG_SLOW_MILLIS
        • SCHEDULED_REPORT_MAX_RETRY_ATTEMPTS
        • SCHEDULED_SEARCH_BACKFILL_LIMIT
        • SCHEDULED_SEARCH_DESPITE_WARNINGS
        • SCHEDULED_SEARCH_MAX_NUMBER_OF_RERUNS
        • SCHEDULED_SEARCH_MAX_WAIT_FOR_MISSING_DATA
        • SEARCH_PIPELINE_MONITOR_QUERY
        • SECRET_MANAGER_ENABLED
        • SEGMENT_READ_MAXIMUM_SIZE_KB
        • SEGMENTMOVER_EXECUTOR_CORES
        • SELFJOIN_LIMIT
        • SEND_USER_INVITES
        • SHARED_DASHBOARDS_ENABLED
        • SHUTDOWN_ABORT_FLUSH_TIMEOUT_MILLIS
        • SINGLE_USER_PASSWORD
        • SINGLE_USER_USERNAME
        • SLACK_POST_MESSAGE_URL
        • SMTP_HOST
        • SMTP_PASSWORD
        • SMTP_PORT
        • SMTP_SENDER_ADDRESS
        • SMTP_USE_STARTTLS
        • SMTP_USERNAME
        • STATIC_IMAGE_CONTENT_URL
        • STATIC_USERS
        • STREAMING_QUERY_KEEPALIVE_NEWLINES
        • STREAMING_QUERY_KEEPALIVE_NEWLINES_ON_NODES
        • STREAMING_QUERY_KEEPALIVE_TIMEOUT
        • TABLE_CACHE_MAX_STORAGE_FRACTION
        • TABLE_CACHE_MAX_STORAGE_FRACTION_FOR_INGEST_AND_HTTP_ONLY
        • TABLE_CACHE_MEMORY_ALLOWANCE_FRACTION
        • TAG_HASHING_BUCKETS
        • TCP_INGEST_MAX_TIMEOUT_SECONDS
        • THREAD_SIZE_LOGGING_INTERVAL_SECONDS
        • TLS_CIPHER_SUITES
        • TLS_CLIENT_ALIAS
        • TLS_CLIENT_AUTH
        • TLS_DEFAULT_ALIAS
        • TLS_DEFAULT_SERVER_ALIAS
        • TLS_HOSTNAME_VERIFICATION_FILTER
        • TLS_KEY_PASSWORD
        • TLS_KEYSTORE_LOCATION
        • TLS_KEYSTORE_TYPE
        • TLS_PROTOCOLS
        • TLS_SERVER
        • TLS_TRUSTSTORE_LOCATION
        • TLS_TRUSTSTORE_PASSWORD
        • TLS_TRUSTSTORE_TYPE
        • TOP_K_MAX_MAP_SIZE_HISTORICAL
        • TOP_K_MAX_MAP_SIZE_LIVE
        • TOPIC_MAX_MESSAGE_BYTES
        • TOTAL_MEMORY_MB
        • UI_AUTH_FLOW
        • USE_AWS_SDK
        • USING_EPHEMERAL_DISKS
        • VALUE_DEDUP_LEVEL
        • VERBOSE_AUTH
        • WARN_ON_INGEST_DELAY_MILLIS
        • ZONE
      • Limits and Standards

 

    • Deployment Overview
    • Planning Your Deployment
      • System Requirements
      • Responsibilities Matrix
      • Capacity Planning
        • Capacity Vectors
          • Ingestion Capacity
          • Digest Capacity
          • Storage Capacity
          • Query Capacity
          • UI Performance
          • Configuring Specific Node Roles
        • Monitoring Capacity Metrics
        • Scenarios
      • Planning to install LogScale
    • Instance Sizing
    • Authentication and identity providers
      • SAML Authentication
          • Certificate Rotation
          • Certificate management best practices
        • Active Dir. Federation Svc.
        • Entra ID (formerly Azure Active Dir.)
        • Duo Security
        • Okta
        • PingOne
        • Google
        • Auth0
      • OpenID Connect
      • LDAP Authentication
      • OAuth Protocol
        • Authenticate with BitBucket sign-in
        • Authenticate with GitHub sign-in
        • Authenticate with Google sign-in
        • OAuth with Auth0
      • Proxy authentication
      • Other authentication methods
        • Single user
        • Root access
        • Emergency access
    • Storage Architecture
      • Primary Storage
      • Bucket Storage
        • Amazon Bucket Storage
          • IAM User Example Policy
          • Switch to a Fresh Bucket
          • Other options
          • Export to S3 Bucket with Amazon
        • Azure Bucket Storage
            • Other options
          • Migrate from S3Proxy to Azure Bucket Storage
        • Google Bucket
        • MinIO
        • Snapshot Uploads
      • Digest Node Storage
      • Digest Rules
      • Storage Rules
    • Installing Using Containers
      • Using humio-single-node-demo (Testing Only)
      • Using humio-core
        • Deploying a Kafka Cluster using Containers
        • Deploying a LogScale Cluster using Containers
    • Installing On Bare Metal or Cloud Instance
      • Preparing for Installation
      • Individual Node Configuration
      • Installing Native Kafka
      • Upgrading Kafka
      • Deploying Kafka using Amazon MSK
      • Installing LogScale
      • LogScale Launcher Script
    • Installing Load Balancers
      • Apache Reverse Proxy
      • Caddy Reverse Proxy
      • Nginx Reverse Proxy
      • HAProxy Reverse Proxy
    • Deploying Auxiliary Services
      • PDF Render Service
        • Deploying Single PDF Render Services
        • Deploying Multiple PDF Render Services
        • Configuring Logging for the PDF Service
        • PDF Render Server Configuration Options
        • Adding PDF Render to LogScale Configuration
        • Monitoring Auxiliary PDF Service
    • Configuration Settings
      • List of Ports
      • Basic Configuration
      • Enabling Rack Awareness
      • Email Configuration
        • SMTP Server Configuration
        • Configure Postmark
      • Feature Flags
      • HTTP Proxy Client
      • IOC Configuration
      • IP Filter
      • JVM Configuration
      • MaxMind Configuration
      • TLS
      • Kafka Configuration
        • Kafka Admin API
      • Long-Retention Tuning
    • Managing Your Deployment
      • Monitoring Tips
      • Adding and Removing Nodes
      • Switching Kafka
        • Switch Kafka using KRaft Mode
      • Updating LogScale
      • Replacing Hardware in a Cluster
      • License Installation
    • Testing Your Deployment
      • Cluster Admin/Ops
      • End User Functionality
      • Admin User Functionality
      • Operational Testing
      • Performance Testing

 

    • Reference Architectures
    • Cluster Topologies
    • AWS Reference Architecture
      • Architecture Types
        • Basic
        • Ingress
        • Dedicated UI
        • Advanced
      • Requirements
      • Terraform Configuration
      • Terraform Modules
        • VPC (Virtual Private Cloud) Module
        • MSK (Amazon Managed Streaming for Kafka) Module
        • EKS (Elastic Kubernetes Service) Module
        • Pre-install Module
        • LogScale Module
      • Build Process
      • Maintaining
        • Upgrading LogScale
        • Scaling the Architecture
        • Kafka Node Pod Scaling
        • LogScale Kubernetes Pod Scaling
        • Scaling up infrastructure
        • Scaling Infrastructure Out
      • Disaster Recovery
        • Operations Guide
          • Requirements
          • Terraform Configuration
          • DR Failover
        • Technical Reference
          • Requirements
          • Lambda Function Internals
          • TLS CA Certificate Mismatch Fix
          • CloudWatch Alarm and SNS Configuration
          • Why nodePools = null on Standby
          • Troubleshooting
          • Security Details
          • IAM Permissions Reference
          • Deterministic S3 Bucket Naming
          • Terraform Backend Configuration
          • Global DNS Details
          • Lambda Configuration Details
          • S3 Storage for DR — Implementation Details
          • EKS Node Group Topology — DR Modes
          • Remote State Data Flow
          • Workspace Safety Validation
          • AWS DR Recovery Environment Variables
          • DNS Architecture — FQDN Locking Details
          • Known Limitations
          • End-to-End Request Flow
          • Network Considerations Checklist
    • Azure Reference Architecture
      • Architecture Types
        • Basic
        • Ingress
        • Dedicated UI
        • Advanced
      • Requirements
      • Instance Sizing
      • Terraform Modules
      • Build Process
        • Prerequisites Setup
        • Targeted Deployment
        • Post-Deployment
        • Performance Validation
        • Troubleshooting
        • Monitoring Best Practices
      • Maintaining
      • Disaster Recovery
        • Operations Guide
          • Requirements
          • Terraform Configuration
          • DR Failover
        • Technical Reference
          • Network Architecture
          • Traffic Manager Configuration
          • DNS Architecture
          • RBAC Permissions
          • Failover Function Security
          • TLS Certificate Configuration
          • Workspace and Validation Guards
          • Module Dependency Matrix
          • Module Dependency Graph
          • Cross-Region Storage Access
          • Environment Variables
          • Failover Timing Reference
          • Troubleshooting
    • Google Cloud Platform (GCP) Reference Architecture
      • Architecture Types
        • Basic
        • Dedicated UI
        • Advanced
      • Requirements
        • Prerequisites
        • Kubernetes Namespace Separation
        • Cluster Size Configuration
        • Bring Your Own Kafka
        • Targeted Terraform
      • Sizing
      • Terraform Configuration
        • Configure DNS
        • Configure Terraform Backend
        • Configure Variables
        • Set LogScale License
        • Set GCP Authentication
        • Comment Out Provider Conflicts
      • Terraform Modules
        • VPC (Virtual Private Cloud) Module
        • Google Kubernetes Engine (GKE) Module
        • GKE Cluster
        • Cloud Storage Buckets
        • Pre-install Module
        • LogScale Module
      • Build Process
        • Prerequisites
        • Deployment Steps
        • Getting Access to the GKE Cluster
      • Maintaining
        • Upgrading LogScale
        • Scaling the Architecture
        • Kafka Node Pod Scaling
        • LogScale Kubernetes Pod Scaling
        • Scaling Up Infrastructure
        • Scaling Infrastructure Out
      • Disaster Recovery
        • Operations Guide
          • Requirements
          • Architecture
          • Stage 1: DR Configuration Setup
          • Stage 2: Verification
          • Stage 3: Failover Testing
          • DR Failover Timing Summary
          • Troubleshooting
          • Initial Deployment
          • GCP DR Data Flow - Encryption Keys, GCS Buckets, Remote State
          • DR Post-Install Verification Checklist
          • Node Pool Topology
          • Variables Inventory
        • Technical Reference
          • Network Architecture
          • Traffic Routing During Failover
          • Failover Function Details
          • Cross-Region Storage Access
          • Environment Variables
          • Security Details
    • Kubernetes Reference Architecture
      • Architecture Types
        • Basic
        • Ingress
        • Dedicated UI
        • Advanced
      • Requirements
      • Terraform Configuration
      • Build Process
      • Maintaining
    • Oracle Cloud Infrastructure (OCI) Reference Architecture
      • Architecture Types
        • Basic
        • Ingress
        • Dedicated UI
        • Advanced
      • Cluster Sizing
      • Deployment Modes
      • OCI Components
      • Network Architecture
      • NVMe Storage Provisioning Architecture
      • Requirements
      • Terraform Configuration
      • Terraform Modules
        • Core Networking (module.oci-core)
        • Object Storage (module.oci-logscale-storage)
        • OCI Bastion Service (module.oci-bastion)
        • OKE Cluster (module.oke)
        • OKE Node Pool Topology
        • Pre-Install (module.pre-install)
        • LogScale Application (module.logscale)
        • cert-manager OCI Webhook (module.cert-manager-oci-webhook)
      • Build and Deployment Process
        • DR Module Deployment Matrix
        • Module Dependency Graph
        • Cluster Deployment
      • Kubernetes Access
        • Access Modes
        • Bastion Tunnel Mode (Production)
        • Public Endpoint Mode (Development)
        • Quick Access
        • Regenerating the Kubeconfig
        • Context and Port Reference
      • Disaster Recovery
        • Operations Guide
          • Proposal
          • Executive Summary
          • Architecture
          • Architecture Considerations
          • Terraform Sequence
          • Cluster Access
          • Certificate Management
          • Dynamic Secondary IP Lookup via Remote State
          • DR Deployment
          • DR Failover Timing
          • Quick Reference
          • Known Issues and Recommendations
          • Disaster Recovery Additional Resources
        • Technical Reference
          • Network Security Configuration
          • Troubleshooting Checklist
      • Additional Resources

 

    • Humio Operator
    • Install Humio Operator on Kubernetes
    • Humio Operator Resource Management
    • Kafka Configuration Migration Guide
    • Humio Operator Version Matrix
    • Upgrading
      • Independently-Managed CRDs
      • Helm-Managed CRDs
      • Migrating from Helm-Managed CRDs
      • Troubleshooting
    • Operator Release Notes
      • Full Humio Operator Release Notes

 

    • CrowdStrike Query Language (CQL)
    • Data Representation in LogScale
      • Event Stream
      • Event Structure
      • Event Timestamps
      • Event Data During Queries
      • Event Time Selection and Sequence
      • Field Naming and Standards
      • Data Retention and Expiration
      • Ingesting Old Data
    • Query Operation
      • Query Pipeline
        • Query Pipeline Sequence
        • Event Data Sources
        • Query Statement Order
        • Query Processing
        • Modifying Event Data
        • Modifying an Event Set
        • Finalizing an Event Set
      • Subqueries
        • Subquery Syntax
        • Subquery Inputs: What Events Are Processed
        • Subquery Outputs: How Results Are Used
        • Subquery Examples
        • Subquery Categories
        • Subquery Context and Limitations
      • Query Context
      • Files
      • Query Prefix
      • Effects of Limits
        • Implied Limit
        • Function Limits
        • Variables Governing Limits
      • Query Performance
      • Query Readability and Format
    • Query Language Syntax
      • Comments
      • Query Filters
      • Operators
      • Adding Fields to Events
      • User Parameters/Variables
      • Conditional Evaluation
      • Array Syntax
      • Expressions
      • Saved Searches (User Functions)
      • Function Syntax
      • Time Syntax
        • Supported Time Zones
        • Relative Time Syntax
      • Referencing Resources
      • Regular Expression Syntax
        • Regular Expression Engine V2 Syntax Patterns
        • Regular Expression Syntax Patterns
          • Unsupported Regular Expression Patterns
        • Regular Expression Flags
        • LogScale Regular Expression Engines
        • Differences from Other Regex Implementations
      • Persisted Aggregations Syntax
    • Function Operation
      • Function Parameters
      • Function Location
      • Function Input/Output
      • Function Types
    • Datatypes in CQL
      • Aggregate Function
      • Array
      • Arrayname
      • Array of aggregate functions
      • Array of arrays of strings
      • Array of expressions
      • Array of fieldnames
      • Array of numbers
      • Array of strings
      • Boolean
      • Double
      • Fixed Values
      • Expression
      • Fieldname
      • File
      • Function
      • Integer
      • Long
      • Number
      • Regex
      • Relative time
      • String
      • Time point
      • Timezone
    • Query Functions
      • Aggregate Query Functions
      • Array Query Functions
      • Comparison Query Functions
      • Conditional Query Functions
      • Data Manipulation Query Functions
      • Event Information Query Functions
      • Filtering Query Functions
      • Formatting Query Functions
      • Geolocation Query Functions
      • Hash Query Functions
      • Join Query Functions
      • Query Debugging Functions
      • Math Query Functions
      • Network and Location Query Functions
      • Parsing Query Functions
      • Preamble Query Functions
      • Regular Expression Query Functions
      • Security Related Query Functions
      • Sequence Query Functions
      • Statistics Query Functions
      • String Query Functions
      • Time and Date Query Functions
      • Transformation Query Functions
      • Widget Query Functions
      • accumulate()
      • appendAggregation()
      • array:append()
      • array:contains()
      • array:dedup()
      • array:drop()
      • array:eval()
      • array:exists()
      • array:filter()
      • array:intersection()
      • array:length()
      • array:reduceAll()
      • array:reduceColumn()
      • array:reduceRow()
      • array:regex()
      • array:rename()
      • array:sort()
      • array:union()
      • asn()
      • avg()
      • base64Decode()
      • base64Encode()
      • beta:param()
      • beta:repeating()
      • bitfield:extractFlags()
      • bitfield:extractFlagsAsArray()
      • bitfield:extractFlagsAsString()
      • bucket()
      • callFunction()
      • cidr()
      • coalesce()
      • collect()
      • communityId()
      • concat()
      • concatArray()
      • copyEvent()
      • correlate()
      • count()
      • counterAsRate()
      • createEvents()
      • crypto:md5()
      • crypto:sha1()
      • crypto:sha256()
      • default()
      • defineTable()
      • drop()
      • dropEvent()
      • duration()
      • end()
      • eval()
      • eventFieldCount()
      • eventInternals()
      • eventSize()
      • explain:asTable()
          • Output Format
          • Time Measurement Details
          • Query Optimization Effects
      • fieldset()
      • fieldstats()
      • findTimestamp()
      • format()
      • formatDuration()
      • formatTime()
      • geography:distance()
      • geohash()
      • getField()
      • groupBy()
          • Grouping in groupBy()
          • Limits when using groupBy()
      • hash()
      • hashMatch()
      • hashRewrite()
      • head()
      • if()
      • in()
      • ioc:lookup()
      • ipLocation()
      • join()
      • json:prettyPrint()
      • kvParse()
      • length()
      • linReg()
      • lower()
      • lowercase()
      • match()
      • matchAsArray()
      • math:abs()
      • math:arccos()
      • math:arcsin()
      • math:arctan()
      • math:arctan2()
      • math:ceil()
      • math:cos()
      • math:cosh()
      • math:deg2rad()
      • math:exp()
      • math:expm1()
      • math:floor()
      • math:log()
      • math:log10()
      • math:log1p()
      • math:log2()
      • math:mod()
      • math:pow()
      • math:rad2deg()
      • math:sin()
      • math:sinh()
      • math:spherical2cartesian()
      • math:sqrt()
      • math:tan()
      • math:tanh()
      • max()
      • min()
      • neighbor()
      • now()
      • objectArray:eval()
      • objectArray:exists()
      • parseCEF()
      • parseCsv()
      • parseFixedWidth()
      • parseHexString()
      • parseInt()
      • parseJson()
      • parseLEEF()
      • parseTimestamp()
      • parseUri()
      • parseUrl()
      • parseXml()
      • partition()
      • percentage()
      • percentile()
      • range()
      • rdns()
      • readFile()
      • readPersistedAggregation()
      • regex()
      • rename()
      • replace()
      • reverseDns()
      • round()
      • sample()
      • sankey()
      • select()
      • selectFromMax()
      • selectFromMin()
      • selectLast()
      • selfJoin()
      • selfJoinFilter()
      • series()
      • session()
      • setField()
      • setTimeInterval()
      • shannonEntropy()
      • slidingTimeWindow()
      • slidingWindow()
      • sort()
      • split()
      • splitString()
      • start()
      • stats()
      • stdDev()
      • stripAnsiCodes()
      • subnet()
      • sum()
      • table()
      • tail()
      • test()
      • text:contains()
      • text:editDistance()
      • text:editDistanceAsArray()
      • text:endsWith()
      • text:length()
      • text:positionOf()
      • text:startsWith()
      • text:substring()
      • text:trim()
      • time:dayOfMonth()
      • time:dayOfWeek()
      • time:dayOfWeekName()
      • time:dayOfYear()
      • time:hour()
      • time:millisecond()
      • time:minute()
      • time:month()
      • time:monthName()
      • time:second()
      • time:weekOfYear()
      • time:year()
      • timeChart()
      • tokenHash()
      • top()
      • transpose()
      • unit:convert()
      • upper()
      • urlDecode()
      • urlEncode()
      • wildcard()
      • window()
      • worldMap()
      • writeJson()
      • xml:prettyPrint()
    • Common Query Patterns
      • Common Misconceptions
      • Converting Data
      • Modifying Data
      • Array Operations
      • Deduplicating Data
      • Limiting Returned Events
        • Grouping or Limting by Specific fields
      • Sorting Data
      • Formatting Values
      • LogScale and Time
      • Other Tricks and Recipes
    • Query Basics
    • Query management
      • Writing New Queries
      • Save searches
      • Grant Permissions for Saved Queries
      • Use Saved Queries in Interactions
    • Troubleshooting Queries
    • SQL to CQL
      • LogScale and Database Terminology
      • SQL to CQL: Basic Query Structure
      • SQL to CQL: Time-Based Queries
      • SQL to CQL: Pattern Matching & Search
      • SQL to CQL: Dynamic vs. Static Schema
      • SQL to CQL: Analytical Capabilities
      • SQL to CQL: Iterative Development Approach
      • SQL to CQL: Collaboration & Reusability
      • SQL to CQL: Sorting and Limiting Results
      • SQL to CQL: Filtering with Multiple Conditions
      • SQL to CQL: Data Aggregation
      • SQL to CQL: Subqueries
      • SQL to CQL: Joins and Correlations
LogScale Self-Hosted (GA)
Falcon LogScale Documentation
/ Falcon LogScale Self-Hosted 1.247-1.255.0 (GA)
/ Reference Material
/ Dynamic Configuration Parameters

UnauthenticatedGraphQLSelectionSizeLimit

OptionUnauthenticatedGraphQLSelectionSizeLimit
Description Number of GraphQL queries on the total number of selected fields and fragments for unauthenticated users.
Introduced Version1.100.3
Default150 queries

Specifies the number of GraphQL queries on the total number of selected fields and fragments for unauthenticated users.

Support
  • Twitter
  • LinkedIn
  • Youtube

© 2026 CrowdStrike All other marks contained herein are the property of their respective owners.

Version Support

Available version: 1.100.3

Enter search term