Skip to content
LogoLogScale DocumentationLibraryGuidance Release Notes Integrations Query Examples Training APIGraphQLSearch Archives Contact Support
🔖੆Help button for documentation
    • Self-Hosted Overview
    • Instance Administration
      • Data Retention
      • Measure and Monitor
        • Cluster Statistics
        • Measure and Manage Ingest Usage
          • What's Measured
            • Measurement Repositories
          • Measure Data Ingest
          • Optimize Ingestion
          • Monitor Usage
        • LogScale Internal Logging
          • Log LogScale to LogScale
      • Data Archiving
        • S3 Archiving
        • GCS Archiving
        • Azure Archiving
      • LogScale Multi-Cluster Search
        • Understand Multi-Cluster Topologies
        • Multi-Cluster Security
        • Configure Multi-Cluster
        • Create and Manage Multi-Cluster Views using LogScale UI
        • Create a Multi-Cluster View using GraphQL
          • Add a remote connection
          • Change Remote connections
          • Add a local connection
          • Change local connections
          • Delete connections
        • Advanced Multi-Cluster Topics
          • Enable Multi-Cluster Feature Flags
          • Query Function Limitations
          • Using match() in Multi-Cluster Scenarios
          • Identify Queries on Remote Clusters
          • Messages During Multi-Cluster Queries
    • Query Administration
      • Query Monitor
      • Blocked Queries
        • Add Query to Blocklist
        • Remove or Unblock an Existing Blocked Query
      • Organization-Owned Queries
        • Enable organization-owned queries for a role
          • View queries without organization ownership permissions
        • Update organization ownership for existing queries
      • Query Quotas
    • Configure Security
      • Initial and key users
      • Tokens in LogScale
        • API Tokens
          • Use API Tokens
          • Repository and View API Tokens
          • Organization API Tokens
          • System API Tokens
          • Personal API Token
      • Organization Essentials
        • Users and Permissions
          • Manage Users
            • Manage User Roles
            • Grant Permissions to Specific Assets
          • Manage Groups
            • Group Roles
            • Group Memberships
            • Group Synchronization
          • Manage Roles
            • Set Up Roles in a File
          • Permissions Requirements
            • Repository and View Permissions
        • Set User Defaults
      • Security policies
        • Dashboard security policies
        • API token security policies
          • Behavior when changing token security policies
          • Personal API token security policy
          • Repository and View API tokens security policy
          • Organization API tokens security policies
          • System tokens security policies
        • Actions security policies
      • IP Filters
        • IP Filter Rules
        • Manage IP Filters
        • Create an IP Filter
        • Edit an IP Filter
      • Session management
        • Configure session cookies
      • Audit Logging
    • Cluster Management
      • Cluster Nodes
        • Node Identifiers
      • Kafka Cluster
      • Auxiliary Nodes
      • Health Checks
    • Ingesting Data
      • Log Shippers
      • Backfilling Data
      • Disabling Ingestion
      • Event Forwarding
        • Event Forwarders
        • Event Forwarding Rules
      • Ingesting FDR Data
        • Cluster Configuration
        • Adjust Polling Nodes Per Feed
        • Setting Visibility Timeout
        • Ingest FDR Data
          • Troubleshooting FDR Ingest
        • Error Handling
      • Ingest Listeners
      • Ingest Tokens
      • Ingest Feeds
        • Ingest Data from AWS S3
          • S3 Ingest Self-hosted Preparation
          • Set up a New AWS Ingest Feed
          • Edit Ingest Feed Configuration
          • Delete an Ingest Feed
          • Enable and Disable Ingest Feeds
        • Ingest Data from Azure Event Hubs
          • Authentication
          • Set up a New Azure Ingest Feed
          • Edit Azure Ingest Feed Configuration
          • Delete an Azure Ingest Feed
          • Enable and Disable Azure Ingest Feeds
    • Reference Material
      • Dynamic Configuration Parameters
        • AdHocTablesLimit
        • AggregatorOutputRowLimit
        • AllowInPlaceMigration
        • ArchivingClusterWideDisabled
        • ArchivingClusterWideEndAt
        • ArchivingClusterWideRegexForRepoName
        • ArchivingClusterWideStartFrom
        • DisableAssetSharing
        • BlockSignup
        • BucketStorageKeySchemeVersion
        • BucketStorageUploadInfrequentThresholdDays
        • BucketStorageWriteVersion
        • CancelQueriesExceedingAggregateOutputRowLimit
        • CorrelateConstellationTickLimit
        • CorrelateConstraintLimit
        • CorrelateLinkValuesLimit
        • CorrelateLinkValuesMaxByteSize
        • CorrelateMinIterations
        • CorrelateNumberOfTimeBuckets
        • CorrelateQueryEventLimit
        • CorrelateQueryLimit
        • DebugAuditRequestTrace
        • defaultDigestReplicationFactor
        • defaultSegmentReplicationFactor
        • DeleteDuplicatedNameViewsAfterMerging
        • DisableAnalyticsJob
        • DisableNewRegexEngine
        • DisableUserTracking
        • DisableViewWithSameNameCleanup
        • DisableAssetSharing
        • EnableGlobalJsonStatsLogger
        • FdrEnable
        • FdrExcludedNodes
        • FdrMaxNodes
        • FdrMaxNodesPerFeed
        • FdrS3FileSizeMax
        • FileReplicationFactor
        • FlushSegmentsAndGlobalOnShutdown
        • GracePeriodBeforeDeletingDeadEphemeralHostsMs
        • GracefulShutdownConsideredAliveSeconds
        • GraphQLSelectionSizeLimit
        • GraphQLAliasCountLimit
        • GraphQLDirectiveCountLimit
        • GraphQLMaxErrorsCount
        • GraphQLQueryAnalysisDisabled
        • GraphQLQueryDepthLimit
        • GraphQLFragmentCountLimit
        • GraphQLFragmentDepthLimit
        • GraphQLOperationCountLimit
        • GraphQLUnauthenticatedAliasCountLimit
        • GraphQLUnauthenticatedDirectiveCountLimit
        • GraphQLUnauthenticatedFragmentCountLimit
        • GraphQLUnauthenticatedFragmentDepthLimit
        • GraphQLUnauthenticatedOperationCountLimit
        • GraphQLUnauthenticatedQueryDepthLimit
        • GraphQLUnauthenticatedSelectionSizeLimit
        • GroupDefaultLimit
        • GroupMaxLimit
        • IngestFeedAwsDownloadMaxObjectSize
        • IngestFeedAwsProcessingDownloadBufferSize
        • IngestFeedAwsProcessingEventBufferSize
        • IngestFeedAwsProcessingEventsPerBatch
        • IngestFeedGovernorRateOverride
        • IngestFeedGovernorIngestDelayHigh
        • IngestFeedGovernorIngestDelayLow
        • IsAutomaticUpdateCheckingAllowed
        • JoinDefaultLimit
        • JoinRowLimit
        • LiveAdhocTableUpdatePeriodMinimumMs
        • LiveQueryMemoryLimit
        • LookupTableSyncAwaitSeconds
        • MatchFilesMaxHeapFraction
        • MaxAccessTokenTTL
        • MaxQueryPenaltyCreditFactorForParkedQueries
        • MaxRelocatedDatasourcesInGlobal
        • MaxConcurrentQueriesOnWorker
        • MaxCsvFileUploadSizeBytes
        • MaxIngestRequestSize
        • MaxJsonFileUploadSizeBytes
        • MaxOpenSegmentsOnWorker
        • MaxQueryPollsForWorker
        • MaxTableSize
        • MinQueryPermitsFactor
        • MinimumHumioVersion
        • MultiPassDefaultIterationLimit
        • MultiPassMaxIterationLimit
        • ParserBacktrackingLimit
        • ParserThrottlingAllocationFactor
        • QueryFSMSyncMergeThreshold
        • QueryBacktrackingLimit
        • QueryCoordinatorMaxHeapFraction
        • QueryCoordinatorMemoryLimit
        • QueryMemoryLimit
        • QueryPartitionAutoBalance
        • QueryResultRowCountLimit
        • QueryMaxLength
        • QuerySchedulerCostMetricsLoggingIntervalSeconds
        • RdnsDefaultLimit
        • RdnsMaxLimit
        • RejectIngestOnParserExceedingFraction
        • ReplaceANSIEscapeCodes
        • ReverseDnsConcurrentRequests
        • ReverseDnsDefaultLimit
        • ReverseDnsDefaultTimeoutInMs
        • ReverseDnsMaxLimit
        • ReverseDnsRequestsPerSecond
        • ReverseDnsConcurrentRequestsPerQuery
        • S3ArchivingClusterWideDisabled
        • S3ArchivingClusterWideEndAt
        • S3ArchivingClusterWideRegexForRepoName
        • S3ArchivingClusterWideStartFrom
        • SampleIntervalForDatasourceRates
        • SelfJoinLimit
        • StateRowLimit
        • StaticQueryFractionOfCores
        • TableCacheMaxStorageFraction
        • TableCacheMaxStorageFractionForIngestAndHttpOnly
        • TableCacheMemoryAllowanceFraction
        • TargetMaxRateForDatasource
        • UnauthenticatedGraphQLSelectionSizeLimit
        • UndersizedMergingRetentionPercentage
        • Get Dynamic Configuration List
        • Set a Dynamic Configuration Value
      • LogScale URLs and Endpoints
      • Configuration Variables
        • AD_HOC_TABLES_LIMIT
        • AGGREGATE_ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
        • AGGREGATE_ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS
        • AGGREGATE_ALERTS_MAX_CATCH_UP_LIMIT
        • AGGREGATOR_OUTPUT_ROW_LIMIT
        • ALERT_DESPITE_WARNINGS
        • ALERT_DISCLAIMER
        • ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
        • ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS
        • ALLOW_CHANGE_REPO_ON_EVENTS
        • ALLOW_KAFKA_RESET_UNTIL_TIMESTAMP_MS
        • ALLOW_XML_DOCTYPE_DECL
        • ALLOWED_REDIRECT_TARGET_DOMAINS
        • API_EXPLORER_ENABLED
        • ASSET_SHARING_DISABLED
        • AUDITLOG_SENSITIVE_RETENTION_DAYS
        • AUTH0_CLIENT_ID
        • AUTH0_CLIENT_SECRET
        • AUTH0_DOMAIN
        • AUTH0_USE_HTTP_PROXY
        • AUTH_ALLOW_SIGNUP
        • AUTH_BY_PROXY_HEADER_NAME
        • AUTHENTICATION_METHOD
        • AUTO_CREATE_USER_ON_SUCCESSFUL_LOGIN
        • AUTO_UPDATE_GROUP_MEMBERSHIPS_ON_SUCCESSFUL_LOGIN
        • AUTO_UPDATE_IP_LOCATION_DB
        • AUTO_UPDATE_MAXMIND
        • AUTOSHARDING_MAX
        • AWS_ACCESS_KEY_ID
        • AWS_KMS_KEY_ARN
        • AWS_SECRET_ACCESS_KEY
        • AZURE_ARCHIVING_ACCOUNTKEY
        • AZURE_ARCHIVING_ACCOUNTNAME
        • AZURE_ARCHIVING_ENDPOINT_BASE
        • AZURE_RECOVER_FROM_ACCOUNTKEY
        • AZURE_RECOVER_FROM_ACCOUNTNAME
        • AZURE_RECOVER_FROM_BUCKET
        • AZURE_RECOVER_FROM_ENCRYPTION_KEY
        • AZURE_RECOVER_FROM_ENDPOINT_BASE
        • AZURE_RECOVER_FROM_OBJECT_KEY_PREFIX
        • AZURE_RECOVER_FROM_REPLACE_REGION
        • AZURE_STORAGE_ACCOUNTKEY
        • AZURE_STORAGE_ACCOUNTNAME
        • AZURE_STORAGE_BUCKET
        • AZURE_STORAGE_CONCURRENCY
        • AZURE_STORAGE_ENCRYPTION_KEY
        • AZURE_STORAGE_ENDPOINT_BASE
        • AZURE_STORAGE_MAX_CONCURRENT_DOWNLOADS
        • AZURE_STORAGE_MAX_CONCURRENT_UPLOADS
        • AZURE_STORAGE_OBJECT_KEY_PREFIX
        • AZURE_STORAGE_PREFERRED_COPY_SOURCE
        • AZURE_STORAGE_RESPONSE_TIMEOUT_SECONDS
        • AZURE_STORAGE_TRANSFER_THREAD_POOL_SIZE
        • AZURE_STORAGE_USE_HTTP_PROXY
        • BACKUP_DIR
        • BACKUP_KEY
        • BACKUP_NAME
        • BITBUCKET_OAUTH_CLIENT_ID
        • BITBUCKET_OAUTH_CLIENT_SECRET
        • BITBUCKET_OAUTH_USE_HTTP_PROXY
        • BLOCK_CLOUD_SIGNUPS
        • BLOCK_SIGNUP
        • BLOCK_SIZE_MAX_KB
        • BLOCK_SIZE_MIN_KB
        • BLOCKS_PER_MINISEGMENT
        • BLOCKS_PER_SEGMENT
        • BOOTSTRAP_HOST_ID
        • BOOTSTRAP_HOST_UUID_COOKIE
        • BOOTSTRAP_ROOT_TOKEN_HASHED
        • BUCKET_STORAGE_IGNORE_ETAG_UPLOAD
        • BUCKET_STORAGE_INFREQUENT_ACCESS_CLASS
        • BUCKET_STORAGE_MESSAGE_DIGEST
        • BUCKET_STORAGE_MULTIPLE_ENDPOINTS
        • BUCKET_STORAGE_SSE_COMPATIBLE
        • CACHE_STORAGE_DIRECTORY
        • CACHE_STORAGE_PERCENTAGE
        • CACHE_STORAGE_SOURCE
        • CHATTER_INITIAL_REPLICATION_FACTOR
        • CLUSTER_PING_TIMEOUT_SECONDS
        • COMPRESSION_TYPE
        • COOKIE_DOMAIN
        • COOKIE_PATH
        • COOKIE_SAMESITE
        • COOKIE_SECURE
        • CORES
        • CORRELATE_CONSTELLATION_TICK_LIMIT
        • CORRELATE_CONSTRAINT_LIMIT
        • CORRELATE_LINK_VALUES_LIMIT
        • CORRELATE_LINK_VALUES_MAX_BYTE_SIZE
        • CORRELATE_MIN_ITERATIONS
        • CORRELATE_NUMBER_OF_TIME_BUCKETS
        • CORRELATE_QUERY_EVENT_LIMIT
        • CORRELATE_QUERY_LIMIT
        • CORS_ALLOWED_ORIGINS
        • CREATE_HUMIO_SEARCH_ALL
        • CS_ANALYTICS_URL
        • DAYS_BEFORE_TOMBSTONE_DELETION
        • DEBUG_AUDIT_REQUEST_TRACE
        • DEFAULT_ALLOW_REBALANCE_EXISTING_SEGMENTS
        • DEFAULT_ALLOW_UPDATE_DESIRED_DIGESTERS
        • DEFAULT_DIGEST_REPLICATION_FACTOR
        • DEFAULT_GRAPHQUERY_ITERATION_LIMIT
        • DEFAULT_GROUPS
        • DEFAULT_MIN_HOST_ALIVE_PERCENTAGE_TO_ENABLE_CLUSTER_REBALANCING
        • DEFAULT_PARSER_NAME
        • DEFAULT_PDF_RENDER_SERVICE_URL
        • DEFAULT_SEGMENT_REPLICATION_FACTOR
        • DEFAULT_USER_INPUT_REGEX_ENGINE
        • DELETE_BACKUP_AFTER_MILLIS
        • DELETE_DUPLICATED_NAME_VIEWS_AFTER_MERGING
        • DELETE_ON_INGEST_QUEUE
        • DIGEST_EXECUTOR_CORES
        • DIRECTORY
        • DISABLE_ANALYTICS_JOB
        • DISABLE_BUCKET_CLEANING_TMP_FILES
        • DISABLE_PERMISSION_CACHE
        • DISABLE_USER_TRACKING
        • DISABLE_VIEW_WITH_SAME_NAME_CLEANUP
        • DUMP_THREADS_SECONDS
        • ELASTIC_PORT
        • EMAIL_ACTION_DISCLAIMER
        • EMERGENCY_USERS
        • ENABLE_AGGREGATE_ALERTS
        • ENABLE_ALERTS
        • ENABLE_BEARER_TOKEN_AUTHORIZATION
        • ENABLE_EVENT_FORWARDING
        • ENABLE_FDR_POLLING_ON_NODE
        • ENABLE_FILTER_ALERTS
        • ENABLE_GLOBAL_JSON_STATS_LOGGER
        • ENABLE_INGEST_FEED
        • ENABLE_IOC_SERVICE
        • ENABLE_ORGANIZATIONS
        • ENABLE_PERSONAL_API_TOKENS
        • ENABLE_SANDBOXES
        • ENABLE_SCHEDULED_REPORT
        • ENABLE_SCHEDULED_SEARCHES
        • ENABLEINTERNALLOGGER
        • ENFORCE_AUDITABLE
        • EXTERNAL_URL
        • EXTRA_KAFKA_CONFIGS_FILE
        • FALCON_DATA_CONNECTOR_URL
        • FDR_MAX_NODES_PER_FEED
        • FDR_S3_FILE_SIZE_MAX
        • FDR_USE_PROXY
        • FDR_VISIBILITY_TIMEOUT
        • FEDERATED_SUBMISSION_TIMEOUT_MILLIS
        • FILE_REPLICATION_FACTOR
        • FILTER_ALERT_EMAIL_TRIGGER_LIMIT
        • FILTER_ALERT_MAX_THROTTLE_FIELD_VALUES_STORED
        • FILTER_ALERT_NON_EMAIL_TRIGGER_LIMIT
        • FILTER_ALERT_RESTART_HEAVY_LIVE_QUERY_WAIT_TIME_SECONDS
        • FILTER_ALERTS_MAX_CATCH_UP_LIMIT
        • FILTER_ALERTS_MAX_WAIT_FOR_MISSING_DATA
        • FLUSH_BLOCK_SECONDS
        • FORWARDING_BREAKER_EXP_BACKOFF_FACTOR
        • FORWARDING_BREAKER_FAILURES
        • FORWARDING_BREAKER_MAX_RESET
        • FORWARDING_BREAKER_RESET
        • FORWARDING_BREAKER_TIMEOUT
        • FORWARDING_MAX_CONCURRENCY
        • GC_KILL_THRESHOLD_MILLIS
        • GCP_ARCHIVING_ACCOUNT_JSON_FILE
        • GCP_ARCHIVING_BUCKET
        • GCP_ARCHIVING_ENCRYPTION_KEY
        • GCP_ARCHIVING_ENDPOINT_BASE
        • GCP_ARCHIVING_OBJECT_KEY_PREFIX
        • GCP_EXPORT_BUCKET
        • GCP_EXPORT_WORKLOAD_IDENTITY
        • GCP_RECOVER_FROM_BUCKET
        • GCP_RECOVER_FROM_REPLACE_BUCKET
        • GCP_RECOVER_FROM_REPLACE_ENCRYPTION_KEY
        • GCP_RECOVER_FROM_REPLACE_REGION
        • GCP_RECOVER_FROM_WORKLOAD_IDENTITY
        • GCP_STORAGE_ACCOUNT_JSON_FILE
        • GCP_STORAGE_BUCKET
        • GCP_STORAGE_CONCURRENCY
        • GCP_STORAGE_ENCRYPTION_KEY
        • GCP_STORAGE_ENDPOINT_BASE
        • GCP_STORAGE_MAX_CONCURRENT_DOWNLOADS
        • GCP_STORAGE_MAX_CONCURRENT_UPLOADS
        • GCP_STORAGE_OBJECT_KEY_PREFIX
        • GCP_STORAGE_PREFERRED_COPY_SOURCE
        • GCP_STORAGE_TRANSFER_THREAD_POOL_SIZE
        • GCP_STORAGE_USE_HTTP_PROXY
        • GCP_STORAGE_WORKLOAD_IDENTITY
        • GITHUB_OAUTH_CLIENT_ID
        • GITHUB_OAUTH_CLIENT_SECRET
        • GITHUB_OAUTH_USE_HTTP_PROXY
        • GITHUB_USER
        • GLOB_ALLOW_LIST_EMAIL_ACTIONS
        • GLOB_MATCH_LIMIT
        • GLOBAL_INITIAL_REPLICATION_FACTOR
        • GLOBAL_THROTTLE_PERCENTAGE
        • GOOGLE_OAUTH_CLIENT_ID
        • GOOGLE_OAUTH_CLIENT_SECRET
        • GOOGLE_OAUTH_USE_HTTP_PROXY
        • GRACE_PERIOD_BEFORE_DELETING_DEAD_EPHEMERAL_HOSTS_MS
        • GRACE_PERIOD_SECS_BEFORE_DELETING_LOCAL_SEGMENT_COPIES
        • GRACEFUL_SHUTDOWN_CONSIDERED_ALIVE_SECONDS
        • GRAPHQL_ALIAS_COUNT_LIMIT
        • GRAPHQL_DIRECTIVE_COUNT_LIMIT
        • GRAPHQL_MAX_ERRORS_COUNT
        • GRAPHQL_QUERY_ANALYSIS_DISABLED
        • GRAPHQL_QUERY_DEPTH_LIMIT
        • GRAPHQL_FRAGMENT_COUNT_LIMIT
        • GRAPHQL_FRAGMENT_DEPTH_LIMIT
        • GRAPHQL_OPERATION_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_ALIAS_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_DIRECTIVE_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_FRAGMENT_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_FRAGMENT_DEPTH_LIMIT
        • GRAPHQL_UNAUTHENTICATED_OPERATION_COUNT_LIMIT
        • GRAPHQL_UNAUTHENTICATED_QUERY_DEPTH_LIMIT
        • GRAPHQL_UNAUTHENTICATED_SELECTION_SIZE_LIMIT
        • HEALTH_CHECK__CLUSTER_TIME_SKEW__WARN_THRESHOLD_MS
        • HEALTH_CHECK__EVENT_LATENCY_P99__WARN_THRESHOLD_SEC
        • HEALTH_CHECK__GLOBAL_TOPIC_LATENCY_P50__WARN_THRESHOLD_MSEC
        • HEALTH_CHECK__PRIMARY_DISK_USAGE__WARN_THRESHOLD_PCT
        • HEALTH_CHECK__PRIMARY_DISK_USAGE__WARN_THRESHOLD_SEC
        • HEALTH_CHECK__SECONDARY_DISK_USAGE__WARN_THRESHOLD_PCT
        • HEALTH_CHECK__SECONDARY_DISK_USAGE__WARN_THRESHOLD_SEC
        • HTTP_PROXY_HOST
        • HTTP_PROXY_ALLOW_ACTIONS_NOT_USE
        • HTTP_PROXY_ALLOW_NOTIFIERS_NOT_USE
        • HTTP_PROXY_PASSWORD
        • HTTP_PROXY_PORT
        • HTTP_PROXY_USERNAME
        • HUMIO_AUDITLOG_DIR
        • HUMIO_DEBUGLOG_DIR
        • HUMIO_HTTP_BIND
        • HUMIO_KAFKA_TOPIC_PREFIX
        • HUMIO_LOG4J_CONFIGURATION
        • HUMIO_PORT
        • HUMIO_SOCKET_BIND
        • HUMIO_THREADNAME_PREFIX
        • IDLE_POLL_TIME_BEFORE_DASHBOARD_QUERY_IS_CANCELLED_MINUTES
        • INGEST_FEED_AWS_ACCESS_KEY_ID
        • INGEST_FEED_AWS_CREDENTIALS_PROVIDER_RENEWAL_BUFFER
        • INGEST_FEED_AWS_CREDENTIALS_PROVIDER_SESSION_ID_PREFIX
        • INGEST_FEED_AWS_CREDENTIALS_PROVIDER_USE_PROXY
        • INGEST_FEED_AWS_DOWNLOAD_MAX_OBJECT_SIZE_DEFAULT
        • INGEST_FEED_AWS_PROCESSING_DOWNLOAD_BUFFER_SIZE_DEFAULT
        • INGEST_FEED_AWS_PROCESSING_EVENT_BUFFER_SIZE_DEFAULT
        • INGEST_FEED_AWS_PROCESSING_EVENTS_PER_BATCH_DEFAULT
        • INGEST_FEED_AWS_REGION
        • INGEST_FEED_AWS_ROLE_ARN
        • INGEST_FEED_AZURE_CLIENT_ID
        • INGEST_FEED_AZURE_CLIENT_SECRET
        • INGEST_FEED_AZURE_CREDENTIAL_RETRIEVAL_TIMEOUT
        • INGEST_FEED_AZURE_TENANT_ID
        • INGEST_FEED_AZURE_USE_ENVIRONMENT_AUTH
        • INGEST_FEED_AZURE_USE_PROXY
        • INGEST_FEED_GOVERNOR_GAIN_PER_CORE_DEFAULT
        • INGEST_FEED_GOVERNOR_INGEST_DELAY_HIGH_DEFAULT
        • INGEST_FEED_GOVERNOR_INGEST_DELAY_LOW_DEFAULT
        • INGEST_FEED_GOVERNOR_INITIAL_RATE_PER_CORE
        • INGEST_FEED_JOB_SETTINGS_EXECUTION_INFO_INTERVAL
        • INGEST_FEED_JOB_SETTINGS_POLL_INTERVAL
        • INGEST_FEED_POLL_PERIOD
        • INGEST_FEED_SECRET_ACCESS_KEY
        • INGEST_OCCUPANCY_QUERY_PERMIT_LIMIT
        • INGEST_QUEUE_INITIAL_REPLICATION_FACTOR
        • INGEST_REQUEST_MAX_QUEUE_SECS
        • INITIAL_DISABLED_NODE_TASKS
        • INITIAL_FEATURE_FLAGS
        • IOC_CROWDSTRIKE_API_CLIENT_ID
        • IOC_CROWDSTRIKE_API_CLIENT_SECRET
        • IOC_CROWDSTRIKE_API_URL
        • IOC_UPDATE_SERVER_URL
        • IOC_USE_HTTP_PROXY
        • IP_FILTER_ACTIONS
        • IP_FILTER_IDP
        • IP_FILTER_NOTIFIERS
        • IP_FILTER_RDNS
        • IP_FILTER_RDNS_SERVER
        • IP_FILTER_ROOT_USERS
        • IPFIX_PEN_FILE
        • JOIN_DEFAULT_LIMIT
        • JVM_LOG_DIR
        • JVM_TMP_DIR
        • JWKS_REFRESH_INTERVAL
        • KAFKA_ADMIN_
        • KAFKA_CHATTER_CONSUMER_
        • KAFKA_CHATTER_PRODUCER_
        • KAFKA_CLIENT_RACK
        • KAFKA_CLIENT_RACK_ENV_VAR
        • KAFKA_COMMON_
        • KAFKA_EGRESS_CONSUMER_GROUP_PREFIX
        • KAFKA_EGRESS_EVENT_FORWARDER_TOPICS_TO_DISABLE
        • KAFKA_GLOBAL_CONSUMER_
        • KAFKA_GLOBAL_PRODUCER_
        • KAFKA_INGEST_QUEUE_CONSUMER_
        • KAFKA_INGEST_QUEUE_PRODUCER_
        • KAFKA_MANAGED_BY_HUMIO
        • KAFKA_SERVERS
        • LDAP_AUTH_PRINCIPAL
        • LDAP_AUTH_PRINCIPALS_REGEX
        • LDAP_AUTH_PROVIDER_CERT
        • LDAP_AUTH_PROVIDER_URL
        • LDAP_DOMAIN_NAME
        • LDAP_GROUP_BASE_DN
        • LDAP_GROUP_FILTER
        • LDAP_GROUP_SEARCH_BIND_FOR_LOOKUP
        • LDAP_GROUPNAME_ATTRIBUTE
        • LDAP_SEARCH_BASE_DN
        • LDAP_SEARCH_BIND_NAME
        • LDAP_SEARCH_BIND_PASSWORD
        • LDAP_SEARCH_DOMAIN_NAME
        • LDAP_SEARCH_FILTER
        • LDAP_USERNAME_ATTRIBUTE
        • LDAP_VERBOSE_LOGGING
        • LIVEQUERY_CANCEL_COST_PERCENTAGE
        • LIVEQUERY_CANCEL_TRIGGER_DELAY_MS
        • LOCAL_STORAGE_GLOBAL_SNAPSHOT_BOOT_TIMEOUT_SECONDS
        • LOCAL_STORAGE_MIN_AGE_DAYS
        • LOCAL_STORAGE_PERCENTAGE
        • LOCAL_STORAGE_PREFILL_PERCENTAGE
        • LOG_COLLECTOR_DOWNLOAD_ENDPOINTS_USE_HTTP_PROXY
        • LOG_COLLECTOR_FLEET_MANAGEMENT_URL
        • LOG_COLLECTOR_UPDATE_SERVER
        • LOG_COLLECTOR_UPDATE_SERVER_USE_HTTP_PROXY
        • LOGSCALE_SAML_IDP_REQUIRE_MATCHING_EMAIL_DOMAIN
        • MAPPER_JOB_QUEUE_LENGTH
        • MAX_ACCUMULATED_POLL_SECONDS
        • MAX_BUCKET_POINTS
        • MAX_CHARS_TO_FIND_TIMESTAMP
        • MAX_CONCURRENT_EXPORTS_PER_VIEW
        • MAX_CONCURRENT_QUERIES_ON_WORKER
        • MAX_DISTINCT_TAG_VALUES
        • MAX_EVENT_FIELD_COUNT
        • MAX_EVENT_FIELD_COUNT_IN_PARSER
        • MAX_EVENT_SIZE
        • MAX_FEDERATED_CONNECTION_TAGS
        • MAX_FEDERATED_CONNECTIONS
        • MAX_FILEUPLOAD_SIZE
        • MAX_GRAPHQUERY_ITERATION_LIMIT
        • MAX_HOURS_SEGMENT_OPEN
        • MAX_INGEST_DELAY_SECONDS
        • MAX_INGEST_EVENTS_PER_TIMEOUT
        • MAX_INGEST_REQUEST_SIZE
        • MAX_JITREX_BACKTRACK
        • MAX_JOIN_LIMIT
        • MAX_NUMBER_OF_GLOBALDATA_DUMPS_TO_KEEP
        • MAX_OFFSETS_AFTER_KAFKA_RESET
        • MAX_POLL_CONCURRENCY_AT_SOURCE
        • MAX_POLL_CONCURRENCY_AT_TARGET
        • MAX_POLLS_PER_SECOND
        • MAX_QUERY_POLLS_FOR_WORKER
        • MAX_REGEX_REPETITIONS
        • MAX_SECS_WAIT_FOR_SYNC_WHEN_CHANGING_DIGEST_LEADER
        • MAX_SERIES_LIMIT
        • MAX_SERIES_MEMLIMIT
        • MAX_WORLD_MAP_BUCKETS
        • MAXMIND_ACCOUNT_ID
        • MAXMIND_BASE_URL
        • MAXMIND_EDITION_ID
        • MAXMIND_IP_LOCATION_EDITION_ID
        • MAXMIND_LICENSE_KEY
        • MAXMIND_USE_HTTP_PROXY
        • MAX_TABLE_SIZE_BYTES
        • MERGE_TARGET_RETENTION_PERCENTAGE
        • METRIC_RETENTION_IN_DAYS
        • MIN_QUERY_PERMITS_FACTOR
        • MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING
        • MINISEGMENT_PREMERGE_MIN_FILES_WHEN_IDLE
        • MINIMUM_HUMIO_VERSION
        • MINISEGMENT_PREMERGE_MAX_BLOCKS
        • MINISEGMENT_PREMERGE_MIN_FILES
        • MULTI_PASS_DEFAULT_ITERATION_LIMIT
        • MULTI_PASS_MAX_ITERATION_LIMIT
        • NODE_ROLES
        • OIDC_AUDIENCE
        • OIDC_AUTHORIZATION_ENDPOINT
        • OIDC_CACHE_USERINFO_MS
        • OIDC_ENABLE_DIRECT_TOKEN_AUTH
        • OIDC_GROUPS_CLAIM
        • OIDC_JWKS_URI
        • OIDC_MULTI_ORG_CLAIM
        • OIDC_OAUTH_CLIENT_ID
        • OIDC_OAUTH_CLIENT_SECRET
        • OIDC_ORGANIZATION_CLAIM
        • OIDC_PROVIDER
        • OIDC_REGISTRATION_ENDPOINT
        • OIDC_REQUIRE_ISSUER_MATCH
        • OIDC_SCOPE_CLAIM
        • OIDC_SCOPES
        • OIDC_SERVICE_NAME
        • OIDC_SUBDOMAIN_FROM_REQUEST_URL
        • OIDC_TOKEN_ENDPOINT
        • OIDC_TOKEN_ENDPOINT_AUTH_METHOD
        • OIDC_USE_HTTP_PROXY
        • OIDC_USERINFO_ENDPOINT
        • OIDC_USERNAME_CLAIM
        • ONLY_CREATE_USER_IF_SYNCED_GROUPS_HAVE_ACCESS
        • PARSER_THROTTLING_ALLOC_FACTOR
        • PDF_RENDER_SERVICE_CALLBACK_BASE_URL
        • POSTMARK_FROM
        • POSTMARK_SERVER_SECRET
        • PRIMARY_STORAGE_MAX_FILL_PERCENTAGE
        • PRIMARY_STORAGE_PERCENTAGE
        • PROMETHEUS_METRICS_PORT
        • PROXY_PREFIX_URL
        • PUBLIC_URL
        • QUERY_CACHE_MIN_COST
        • QUERY_CACHE_STORAGE_MAX_USE_PERCENTAGE
        • QUERY_COORDINATION_PARTITIONS
        • QUERY_COORDINATOR_EXECUTOR_CORES
        • QUERY_COORDINATOR_START_RATE_LIMIT
        • QUERY_COORDINATOR_START_RATE_LIMIT_INTERVAL_MILLIS
        • QUERY_EXECUTOR_CORES
        • QUERY_SCHEDULER_QUERY_QUEUE_SIZE
        • QUERY_SPENT_FACTOR
        • QUERY_MAX_LENGTH
        • RDNS_DEFAULT_SERVER
        • READ_GROUP_PERMISSIONS_FROM_FILE
        • REGION_SELECT_CONFIG_URL
        • REJECT_INGEST_ON_PARSER_EXCEEDING_FRACTION
        • RUNTIME_KIND_NAME
        • S3_ACTION_ACCESSKEY
        • S3_ACTION_MAX_FILE_SIZE_BYTES
        • S3_ACTION_SECRETKEY
        • S3_ARCHIVING_ACCESSKEY
        • S3_ARCHIVING_CLUSTER_WIDE_DISABLED
        • S3_ARCHIVING_CLUSTER_WIDE_END_AT
        • S3_ARCHIVING_CLUSTER_WIDE_REGEX_FOR_REPO_NAME
        • S3_ARCHIVING_CLUSTER_WIDE_START_FROM
        • S3_ARCHIVING_ENDPOINT_BASE
        • S3_ARCHIVING_REQUIRE_ROLE
        • S3_ARCHIVING_SECRETKEY
        • S3_ARCHIVING_USE_HTTP_PROXY
        • S3_ARCHIVING_WORKERCOUNT
        • S3_EXPORT_USE_HTTP_PROXY
        • S3_NETTY_CLIENT
        • S3_NETTY_CONNECTING_TIMEOUT_SECONDS
        • S3_NETTY_CONNECTION_ACQUISITION_TIMEOUT_SECONDS
        • S3_NETTY_CONNECTION_IDLE_TIMEOUT_SECONDS
        • S3_NETTY_CONNECTION_TTL_SECONDS
        • S3_NETTY_READ_TIMEOUT_SECONDS
        • S3_NETTY_TCP_KEEP_ALIVE
        • S3_NETTY_THREAD_POOL_MAX_SIZE
        • S3_NETTY_WRITE_TIMEOUT_SECONDS
        • S3_RECOVER_FROM_BUCKET
        • S3_RECOVER_FROM_ENCRYPTION_KEY_SECRET_KEY
        • S3_RECOVER_FROM_ENCRYPTION_KEY_SECRET_NAME
        • S3_RECOVER_FROM_KMS_KEY_ARN
        • S3_RECOVER_FROM_REGION
        • S3_RECOVER_FROM_REPLACE_BUCKET
        • S3_RECOVER_FROM_REPLACE_REGION
        • S3_STORAGE_2_KMS_KEY_ARN
        • S3_STORAGE_ACCESSKEY
        • S3_STORAGE_BUCKET
        • S3_STORAGE_CONCURRENCY
        • S3_STORAGE_DISABLE_UPLOAD_DUPLICATE_CHECK
        • S3_STORAGE_ENCRYPTION_KEY
        • S3_STORAGE_ENDPOINT_BASE
        • S3_STORAGE_KMS_KEY_ARN
        • S3_STORAGE_MAX_CONCURRENT_DOWNLOADS
        • S3_STORAGE_MAX_CONCURRENT_UPLOADS
        • S3_STORAGE_OBJECT_KEY_PREFIX
        • S3_STORAGE_PREFERRED_COPY_SOURCE
        • S3_STORAGE_REGION
        • S3_STORAGE_SECRETKEY
        • S3_STORAGE_STREAM_IDLE_TIMEOUT_SECONDS
        • S3_STORAGE_TRANSFER_THREAD_POOL_SIZE
        • S3_STORAGE_USE_HTTP_PROXY
        • SAML_ALTERNATIVE_IDP_CERTIFICATE
        • SAML_DEBUG
        • SAML_GROUP_MEMBERSHIP_ATTRIBUTE
        • SAML_IDP_CERTIFICATE
        • SAML_IDP_ENTITY_ID
        • SAML_IDP_SIGN_ON_URL
        • SAML_METADATA_ENDPOINT_URL
        • SAML_USER_ATTRIBUTE
        • SANGRIA_LOG_SLOW_MILLIS
        • SCHEDULED_REPORT_MAX_RETRY_ATTEMPTS
        • SCHEDULED_SEARCH_BACKFILL_LIMIT
        • SCHEDULED_SEARCH_DESPITE_WARNINGS
        • SCHEDULED_SEARCH_MAX_NUMBER_OF_RERUNS
        • SCHEDULED_SEARCH_MAX_WAIT_FOR_MISSING_DATA
        • SEARCH_PIPELINE_MONITOR_QUERY
        • SECONDARY_DATA_DIRECTORY
        • SECONDARY_STORAGE_MAX_FILL_PERCENTAGE
        • SECRET_MANAGER_ENABLED
        • SEGMENT_READ_MAXIMUM_SIZE_KB
        • SEGMENTMOVER_EXECUTOR_CORES
        • SELFJOIN_LIMIT
        • SEND_USER_INVITES
        • SHARED_DASHBOARDS_ENABLED
        • SHUTDOWN_ABORT_FLUSH_TIMEOUT_MILLIS
        • SINGLE_USER_PASSWORD
        • SINGLE_USER_USERNAME
        • SLACK_POST_MESSAGE_URL
        • SMTP_HOST
        • SMTP_PASSWORD
        • SMTP_PORT
        • SMTP_SENDER_ADDRESS
        • SMTP_USE_STARTTLS
        • SMTP_USERNAME
        • STATIC_IMAGE_CONTENT_URL
        • STATIC_USERS
        • STREAMING_QUERY_KEEPALIVE_NEWLINES
        • STREAMING_QUERY_KEEPALIVE_NEWLINES_ON_NODES
        • STREAMING_QUERY_KEEPALIVE_TIMEOUT
        • TABLE_CACHE_MAX_STORAGE_FRACTION
        • TABLE_CACHE_MAX_STORAGE_FRACTION_FOR_INGEST_AND_HTTP_ONLY
        • TABLE_CACHE_MEMORY_ALLOWANCE_FRACTION
        • TAG_HASHING_BUCKETS
        • TCP_INGEST_MAX_TIMEOUT_SECONDS
        • THREAD_SIZE_LOGGING_INTERVAL_SECONDS
        • TLS_CIPHER_SUITES
        • TLS_CLIENT_ALIAS
        • TLS_CLIENT_AUTH
        • TLS_DEFAULT_ALIAS
        • TLS_DEFAULT_SERVER_ALIAS
        • TLS_HOSTNAME_VERIFICATION_FILTER
        • TLS_KEY_PASSWORD
        • TLS_KEYSTORE_LOCATION
        • TLS_KEYSTORE_TYPE
        • TLS_PROTOCOLS
        • TLS_SERVER
        • TLS_TRUSTSTORE_LOCATION
        • TLS_TRUSTSTORE_PASSWORD
        • TLS_TRUSTSTORE_TYPE
        • TOP_K_MAX_MAP_SIZE_HISTORICAL
        • TOP_K_MAX_MAP_SIZE_LIVE
        • TOPIC_MAX_MESSAGE_BYTES
        • UI_AUTH_FLOW
        • USE_AWS_SDK
        • USING_EPHEMERAL_DISKS
        • VALUE_DEDUP_LEVEL
        • VERBOSE_AUTH
        • WARN_ON_INGEST_DELAY_MILLIS
        • ZONE
      • Limits and Standards

 

    • Deployment Overview
    • Planning Your Deployment
      • System Requirements
      • Responsibilities Matrix
      • Capacity Planning
        • Capacity Vectors
          • Ingestion Capacity
          • Digest Capacity
          • Storage Capacity
          • Query Capacity
          • UI Performance
          • Configuring Specific Node Roles
        • Monitoring Capacity Metrics
        • Scenarios
      • Planning to install LogScale
    • Instance Sizing
    • Authentication and identity providers
      • SAML Authentication
          • Certificate Rotation
          • Certificate management best practices
        • Active Dir. Federation Svc.
        • Entra ID (formerly Azure Active Dir.)
        • Duo Security
        • Okta
        • PingOne
        • Google
        • Auth0
      • OpenID Connect
      • LDAP Authentication
      • OAuth Protocol
        • Authenticate with BitBucket sign-in
        • Authenticate with GitHub sign-in
        • Authenticate with Google sign-in
        • OAuth with Auth0
      • Proxy authentication
      • Other authentication methods
        • Single user
        • Root access
        • Emergency access
    • Storage Architecture
      • Primary Storage
      • Secondary Storage
      • Bucket Storage
        • Amazon Bucket Storage
          • IAM User Example Policy
          • Switch to a Fresh Bucket
          • Other options
          • Export to S3 Bucket with Amazon
        • Azure Bucket Storage
            • Other options
          • Migrate from S3Proxy to Azure Bucket Storage
        • Google Bucket
        • MinIO
        • Snapshot Uploads
      • Digest Node Storage
      • Digest Rules
      • Storage Rules
    • Installing Using Containers
      • Using humio-single-node-demo (Testing Only)
      • Using humio-core
        • Deploying a Kafka Cluster using Containers
        • Deploying a LogScale Cluster using Containers
    • Installing On Bare Metal or Cloud Instance
      • Preparing for Installation
      • Individual Node Configuration
      • Installing Native Kafka
      • Deploying Kafka using Amazon MSK
      • Installing LogScale
      • LogScale Launcher Script
    • Reference Architectures
      • Cluster Topologies
      • AWS Reference Architecture
        • Architecture Types
          • Basic
          • Ingress
          • Dedicated UI
          • Advanced
        • Requirements
        • Terraform Configuration
        • Terraform Modules
          • VPC (Virtual Private Cloud) Module
          • MSK (Amazon Managed Streaming for Kafka) Module
          • EKS (Elastic Kubernetes Service) Module
          • Pre-install Module
          • LogScale Module
        • Build Process
        • Maintaining
          • Upgrading LogScale
          • Scaling the Architecture
          • Kafka Node Pod Scaling
          • LogScale Kubernetes Pod Scaling
          • Scaling up infrastructure
          • Scaling Infrastructure Out
        • Disaster Recovery
          • Operations Guide
            • Requirements
            • Terraform Configuration
            • DR Failover
          • Technical Reference
            • Requirements
            • Lambda Function Internals
            • TLS CA Certificate Mismatch Fix
            • CloudWatch Alarm and SNS Configuration
            • Why nodePools = null on Standby
            • Troubleshooting
            • Security Details
            • IAM Permissions Reference
            • Deterministic S3 Bucket Naming
            • Terraform Backend Configuration
            • Global DNS Details
            • Lambda Configuration Details
            • S3 Storage for DR — Implementation Details
            • EKS Node Group Topology — DR Modes
            • Remote State Data Flow
            • Workspace Safety Validation
            • AWS DR Recovery Environment Variables
            • DNS Architecture — FQDN Locking Details
            • Known Limitations
            • End-to-End Request Flow
            • Network Considerations Checklist
      • Azure Reference Architecture
        • Architecture Types
          • Basic
          • Ingress
          • Dedicated UI
          • Advanced
        • Requirements
        • Instance Sizing
        • Terraform Modules
        • Build Process
          • Prerequisites Setup
          • Targeted Deployment
          • Post-Deployment
          • Performance Validation
          • Troubleshooting
          • Monitoring Best Practices
        • Maintaining
        • Disaster Recovery
          • Operations Guide
            • Requirements
            • Terraform Configuration
            • DR Failover
          • Technical Reference
            • Network Architecture
            • Traffic Manager Configuration
            • DNS Architecture
            • RBAC Permissions
            • Failover Function Security
            • TLS Certificate Configuration
            • Workspace and Validation Guards
            • Module Dependency Matrix
            • Module Dependency Graph
            • Cross-Region Storage Access
            • Environment Variables
            • Failover Timing Reference
            • Troubleshooting
      • Google Cloud Platform (GCP) Reference Architecture
        • Architecture Types
          • Basic
          • Dedicated UI
          • Advanced
        • Requirements
          • Prerequisites
          • Kubernetes Namespace Separation
          • Cluster Size Configuration
          • Bring Your Own Kafka
          • Targeted Terraform
        • Sizing
        • Terraform Configuration
          • Configure DNS
          • Configure Terraform Backend
          • Configure Variables
          • Set LogScale License
          • Set GCP Authentication
          • Comment Out Provider Conflicts
        • Terraform Modules
          • VPC (Virtual Private Cloud) Module
          • Google Kubernetes Engine (GKE) Module
          • GKE Cluster
          • Cloud Storage Buckets
          • Pre-install Module
          • LogScale Module
        • Build Process
          • Prerequisites
          • Deployment Steps
          • Getting Access to the GKE Cluster
        • Maintaining
          • Upgrading LogScale
          • Scaling the Architecture
          • Kafka Node Pod Scaling
          • LogScale Kubernetes Pod Scaling
          • Scaling Up Infrastructure
          • Scaling Infrastructure Out
        • Disaster Recovery
          • Operations Guide
            • Requirements
            • Architecture
            • Stage 1: DR Configuration Setup
            • Stage 2: Verification
            • Stage 3: Failover Testing
            • DR Failover Timing Summary
            • Troubleshooting
            • Initial Deployment
            • GCP DR Data Flow - Encryption Keys, GCS Buckets, Remote State
            • DR Post-Install Verification Checklist
            • Node Pool Topology
            • Variables Inventory
          • Technical Reference
            • Network Architecture
            • Traffic Routing During Failover
            • Failover Function Details
            • Cross-Region Storage Access
            • Environment Variables
            • Security Details
      • Kubernetes Reference Architecture
        • Architecture Types
          • Basic
          • Ingress
          • Dedicated UI
          • Advanced
        • Requirements
        • Terraform Configuration
        • Build Process
        • Maintaining
      • Oracle Cloud Infrastructure (OCI) Reference Architecture
        • Architecture Types
          • Basic
          • Ingress
          • Dedicated UI
          • Advanced
        • Cluster Sizing
        • Deployment Modes
        • OCI Components
        • Network Architecture
        • NVMe Storage Provisioning Architecture
        • Requirements
        • Terraform Configuration
        • Terraform Modules
          • Core Networking (module.oci-core)
          • Object Storage (module.oci-logscale-storage)
          • OCI Bastion Service (module.oci-bastion)
          • OKE Cluster (module.oke)
          • OKE Node Pool Topology
          • Pre-Install (module.pre-install)
          • LogScale Application (module.logscale)
          • cert-manager OCI Webhook (module.cert-manager-oci-webhook)
        • Build and Deployment Process
          • DR Module Deployment Matrix
          • Module Dependency Graph
          • Cluster Deployment
        • Kubernetes Access
          • Access Modes
          • Bastion Tunnel Mode (Production)
          • Public Endpoint Mode (Development)
          • Quick Access
          • Regenerating the Kubeconfig
          • Context and Port Reference
        • Disaster Recovery
          • Operations Guide
            • Proposal
            • Executive Summary
            • Architecture
            • Architecture Considerations
            • Terraform Sequence
            • Cluster Access
            • Certificate Management
            • Dynamic Secondary IP Lookup via Remote State
            • DR Deployment
            • DR Failover Timing
            • Quick Reference
            • Known Issues and Recommendations
            • Disaster Recovery Additional Resources
          • Technical Reference
            • Network Security Configuration
            • Troubleshooting Checklist
        • Additional Resources
    • Installing Load Balancers
      • Apache Reverse Proxy
      • Caddy Reverse Proxy
      • Nginx Reverse Proxy
      • HAProxy Reverse Proxy
        • Configuring HAProxy as a Service
    • Deploying Auxiliary Services
      • PDF Render Service
        • Deploying Single PDF Render Services
        • Deploying Multiple PDF Render Services
        • PDF Render Server Configuration Options
        • Adding PDF Render to LogScale Configuration
        • Monitoring Auxiliary PDF Service
    • Configuration Settings
      • Basic Configuration
      • Enabling Rack Awareness
      • Email Configuration
        • SMTP Server Configuration
        • Configure Postmark
      • Feature Flags
      • HTTP Proxy Client
      • IOC Configuration
      • IP Filter
      • JVM Configuration
      • MaxMind Configuration
      • TLS
      • Kafka Configuration
        • Kafka Usage
      • Long-Retention Tuning
    • Managing Your Deployment
      • Monitoring Tips
      • Adding and Removing Nodes
      • Switching Kafka
        • Switch Kafka and ZooKeeper
        • Switch Kafka using KRaft Mode
      • Updating LogScale
      • Replacing Hardware in a Cluster
      • License Installation
    • Testing Your Deployment
      • Cluster Admin/Ops
      • End User Functionality
      • Admin User Functionality
      • Operational Testing
      • Performance Testing

 

    • Humio Operator
    • Install Humio Operator on Kubernetes
    • Humio Operator Resource Management
    • Kafka Configuration Migration Guide
    • Humio Operator Version Matrix
    • Upgrading
      • Independently-Managed CRDs
      • Helm-Managed CRDs
      • Migrating from Helm-Managed CRDs
      • Troubleshooting
    • Operator Release Notes
      • Full Humio Operator Release Notes

 

    • Data Analysis Overview
    • LogScale Web Interface
      • System Tabs and Falcon Icon
      • Navigation Icons
        • Notifications
        • Releases and Release Notes
        • Help
        • Avatar icon
      • Informational Panels
      • Left-hand Navigation Panel
      • Table Components
      • Repositories and Views
        • Repositories and Views Menubar
        • Search Interface
        • Dashboards Interface
        • Automation Interface
        • Parsers Interface
        • Resources Interface
          • Asset Type Interface Elements
        • Settings Interface
      • All Dashboards
      • Data Ingest
    • Manage Repositories and Views
      • Create Repository or View
      • Repository and View Settings
      • Delete a Repository or View
      • Falcon LTR Repositories
      • Lookup Files
        • Supported File Types and Formats
        • Create a Lookup File
        • Manage Lookup Files
        • Lookup Files Operations with match()
    • Manage Your LogScale Account
    • Parse Data
      • Built-in Parsers
      • Custom Parsers
        • Create a Parser
        • Write a Parser
          • Example: Parsing Log Lines
          • Example: Parsing JSON
          • Parsers Validation Errors
          • Normalize and Validate Against CPS Schema
      • Manage Parsers
      • Ingest Tokens
      • Parser Errors
      • Removing Fields
      • Parsing Event Tags
      • Parsing Timestamps
    • Search Data
      • Query Editor
      • Event Fields
      • Display Fields
      • Manage Fields
      • Display Results and Events
      • Inspect Events
      • Copy Rows
      • Look Up Events
      • Show in Context
      • Format Columns
      • Column Properties
      • Field Data Types
      • Field Interactions
      • Choose Visualization
      • Highlight Filter Match
      • Change Time Interval
      • Set Time Zone
      • Save Results
      • Export Data
      • Search Status
      • Event List Interactions
      • Field Aliasing
        • Configuring Field Aliasing
        • Managing Field Aliasing
        • Searching with Field Aliasing
        • Understanding Field Mapping Requirements
        • Understanding Schema Requirements
    • Write Queries
      • Basic Query Principles
      • Returned Events
      • Query Management
        • Write a New Query
        • Save Searches
          • Create a Saved Search
          • Manage Saved Searches
          • Grant Permissions for Saved Queries
        • Use Saved Queries in Interactions
      • Common Queries
      • Statement Order for Better Queries
      • Query Readability and Better Usage
    • Query Language Syntax
      • Comments
      • Query Filters
      • Operators
      • Adding Fields to Events
      • User Parameters/Variables
      • Conditional Evaluation
      • Array Syntax
      • Expressions
      • Saved Searches (User Functions)
      • Function Syntax
      • Time Syntax
        • Supported Time Zones
        • Relative Time Syntax
      • Referencing Resources
      • Regular Expression Syntax
        • Regular Expression Engine V2 Syntax Patterns
        • Regular Expression Syntax Patterns
          • Unsupported Regular Expression Patterns
        • Regular Expression Flags
        • LogScale Regular Expression Engines
        • Differences from Other Regex Implementations
    • Query Joins and Lookups
      • Types of Join
      • Join Methods
      • Asset Resolution in Subqueries
      • Using Ad-hoc Tables
      • Using Lookup Files
        • Using the readFile() Function
        • Using the match() Function
      • Using join() or selfJoin()
        • Using the join() Function
        • Using the selfJoin() Function
        • Join Operation and Optimization
    • Query Functions
      • Aggregate Query Functions
      • Array Query Functions
      • Comparison Query Functions
      • Conditional Query Functions
      • Data Manipulation Query Functions
      • Event Information Query Functions
      • Filtering Query Functions
      • Formatting Query Functions
      • Geolocation Query Functions
      • Hash Query Functions
      • Join Query Functions
      • Query Debugging Functions
      • Math Query Functions
      • Network and Location Query Functions
      • Parsing Query Functions
      • Preamble Query Functions
      • Regular Expression Query Functions
      • Security Related Query Functions
      • Sequence Query Functions
      • Statistics Query Functions
      • String Query Functions
      • Time and Date Query Functions
      • Transformation Query Functions
      • Widget Query Functions
      • accumulate()
      • array:append()
      • array:contains()
      • array:dedup()
      • array:drop()
      • array:eval()
      • array:exists()
      • array:filter()
      • array:intersection()
      • array:length()
      • array:reduceAll()
      • array:reduceColumn()
      • array:reduceRow()
      • array:regex()
      • array:rename()
      • array:sort()
      • array:union()
      • asn()
      • avg()
      • base64Decode()
      • base64Encode()
      • beta:param()
      • beta:repeating()
      • bitfield:extractFlags()
      • bitfield:extractFlagsAsArray()
      • bitfield:extractFlagsAsString()
      • bucket()
      • callFunction()
      • cidr()
      • coalesce()
      • collect()
      • communityId()
      • concat()
      • concatArray()
      • copyEvent()
      • correlate()
      • count()
      • counterAsRate()
      • createEvents()
      • crypto:md5()
      • crypto:sha1()
      • crypto:sha256()
      • default()
      • defineTable()
      • drop()
      • dropEvent()
      • duration()
      • end()
      • eval()
      • eventFieldCount()
      • eventInternals()
      • eventSize()
      • explain:asTable()
          • Output Format
          • Time Measurement Details
          • Query Optimization Effects
      • fieldset()
      • fieldstats()
      • findTimestamp()
      • format()
      • formatDuration()
      • formatTime()
      • geography:distance()
      • geohash()
      • getField()
      • groupBy()
          • Grouping in groupBy()
          • Limits when using groupBy()
      • hash()
      • hashMatch()
      • hashRewrite()
      • head()
      • if()
      • in()
      • ioc:lookup()
      • ipLocation()
      • join()
      • json:prettyPrint()
      • kvParse()
      • length()
      • linReg()
      • lower()
      • lowercase()
      • match()
      • matchAsArray()
      • math:abs()
      • math:arccos()
      • math:arcsin()
      • math:arctan()
      • math:arctan2()
      • math:ceil()
      • math:cos()
      • math:cosh()
      • math:deg2rad()
      • math:exp()
      • math:expm1()
      • math:floor()
      • math:log()
      • math:log10()
      • math:log1p()
      • math:log2()
      • math:mod()
      • math:pow()
      • math:rad2deg()
      • math:sin()
      • math:sinh()
      • math:spherical2cartesian()
      • math:sqrt()
      • math:tan()
      • math:tanh()
      • max()
      • min()
      • neighbor()
      • now()
      • objectArray:eval()
      • objectArray:exists()
      • parseCEF()
      • parseCsv()
      • parseFixedWidth()
      • parseHexString()
      • parseInt()
      • parseJson()
      • parseLEEF()
      • parseTimestamp()
      • parseUri()
      • parseUrl()
      • parseXml()
      • partition()
      • percentage()
      • percentile()
      • range()
      • rdns()
      • readFile()
      • regex()
      • rename()
      • replace()
      • reverseDns()
      • round()
      • sample()
      • sankey()
      • select()
      • selectFromMax()
      • selectFromMin()
      • selectLast()
      • selfJoin()
      • selfJoinFilter()
      • series()
      • session()
      • setField()
      • setTimeInterval()
      • shannonEntropy()
      • slidingTimeWindow()
      • slidingWindow()
      • sort()
      • split()
      • splitString()
      • start()
      • stats()
      • stdDev()
      • stripAnsiCodes()
      • subnet()
      • sum()
      • table()
      • tail()
      • test()
      • text:contains()
      • text:editDistance()
      • text:editDistanceAsArray()
      • text:endsWith()
      • text:length()
      • text:positionOf()
      • text:startsWith()
      • text:substring()
      • text:trim()
      • time:dayOfMonth()
      • time:dayOfWeek()
      • time:dayOfWeekName()
      • time:dayOfYear()
      • time:hour()
      • time:millisecond()
      • time:minute()
      • time:month()
      • time:monthName()
      • time:second()
      • time:weekOfYear()
      • time:year()
      • timeChart()
      • tokenHash()
      • top()
      • transpose()
      • unit:convert()
      • upper()
      • urlDecode()
      • urlEncode()
      • wildcard()
      • window()
      • worldMap()
      • writeJson()
      • xml:prettyPrint()
    • Data Visualization
      • Dashboards
        • Step-by-Step Guide to Dashboards
        • Create Dashboards
        • Manage Dashboards
        • Customize Dashboards
        • Design the Dashboard Layout
          • Dashboard Sections
        • Work with Time on Dashboards
          • Shared Time Selector
          • Widget Time Selector
          • Section Time Selector
          • Live Dashboards
          • Time Zone Settings
          • Default Time Settings for Dashboards
        • Make your Dashboard Interactive
          • Apply Dashboard Filters
          • Work with Dashboard Parameters
          • Work with Dashboard Interactions
        • Share Dashboards
          • Disabling Access to Shared Dashboards
          • Restricting Access with IP Filters
        • Export Dashboards as PDF
          • PDF Export Options
        • Schedule PDF Reports
          • Scheduled Reports Security
          • Managing Scheduled Reports
          • Create Scheduled Reports
          • Edit Scheduled Reports
          • Scheduled Report Operation and Limitations
          • Scheduled Report Errors and Resolutions
      • Widgets
        • Create Widgets
        • Manage Widgets
          • Hint: Deselect Series in Widgets
          • Limitation: Widgets with Live join() Functions
          • Hint: Embedding iFrame Widgets
        • Widgets Gallery
        • Bar Chart Widget
          • Bar Chart Usage and Data Format
          • Bar Chart Examples Gallery
            • Event Detection Across Severity Levels
            • Failed and Successful Authentication Attempts
            • Threat Type Distribution
            • Alert Type Proportion in Detection Sources
            • Detection Counts with Severity Average
          • Bar Chart Property Reference
        • Event List Widget
          • Event List Usage and Data Format
          • Event List Property Reference
        • Gauge Widget
          • Gauge Usage and Data Format
          • Gauge Examples Gallery
            • Display Number of Errors
            • Display Query Memory
            • Display Small Multiple Charts
          • Gauge Property Reference
        • Heat Map Widget
          • Heat Map Usage and Data Format
          • Heat Map Examples Gallery
            • Github Push Events
            • Response Time
          • Heat Map Property Reference
        • Note Widget
            • Note Widget Property Reference
        • Parameter Panel Widget
        • Pie Chart Widget
          • Pie Chart Usage and Data Format
          • Pie Chart Examples Gallery
            • Distribution of Security Alert Severities
            • Authentication Methods Distribution
            • Malware Types by Infection Count (In Small Multiples)
            • Network Traffic by Protocol
          • Pie Chart Property Reference
        • Sankey Diagram Widget
          • Sankey Usage and Data Format
          • Sankey Examples Gallery
            • Network Traffic
            • Thread Usage
          • Sankey Property Reference
        • Scatter Chart Widget
          • Usage and Data Format
          • Scatter Chart Property Reference
        • Single Value Widget
          • Single Value Usage and Data Format
          • Single Value Examples Gallery
            • Displaying Number of Errors
            • Displaying Statistics from a Build
            • Displaying a Non-Numeric Value
            • Displaying a Trend with a Timechart
            • Displaying Values in a Grid
          • Single Value Property Reference
        • Table Widget
          • Table Usage and Data Format
          • Table Widget Interactions
          • Table Widget Examples Gallery
            • Display Different Statuses
            • Add Temporary Events and URLs
          • Table Property Reference
        • Time Chart Widget
          • Time Chart Usage and Data Format
          • Time Chart Examples Gallery
            • Charting Metric Data
            • Charting Log Levels
            • Charting Commits in GitHub
          • Time Chart Property Reference
        • World Map Widget
          • World Map Usage and Data Format
          • World Map Examples Gallery
            • IP-Based Geographic Distribution
            • Service Performance Monitorings
            • Geohash Performance Clustering
          • World Map Property Reference
    • Automation
      • Triggers
        • What Trigger Type to Choose
        • General Information About Triggers
        • Trigger Management
          • Create Triggers
          • Edit Triggers
          • Manage Triggers
        • Trigger Properties
          • General Properties
          • Configuration Properties
          • Actions Properties
          • Advanced Settings
          • Scheduled Search Properties
        • Monitor, Diagnose, and Troubleshoot Triggers
          • Monitor Triggers with humio-activity Repository
          • Aggregate Alert Errors and Solutions
          • Scheduled Search Errors and Solutions
          • Filter Alert Errors and Solutions
          • Legacy Alert Errors and Solutions
          • Errors when Using Live join() Functions
      • Actions
        • Create Actions
        • Manage Actions
        • Action Type: Email
        • Action Type: Falcon LogScale Repository
        • Action Type: OpsGenie
        • Action Type: PagerDuty
        • Action Type: S3
        • Action Type: Slack
        • Action Type: Lookup File
        • Action Type: VictorOps (Splunk On-Call)
        • Action Type: Webhooks
        • Send aggregate results to actions
        • Message Templates and Variables
      • Cron Scheduling
    • Template Language
      • Template Expressions
      • Template Variable Types
      • Template Examples
    • Keyboard Shortcuts
LogScale Self-Hosted (GA)
Falcon LogScale Documentation
/ Falcon LogScale Self-Hosted 1.229.0-1.244.0 (GA)
/ Reference Material
/ Configuration Variables

S3_RECOVER_FROM_BUCKET

OptionS3_RECOVER_FROM_BUCKET
Description S3 bucket name to recover data from.
Introduced Version1.235

Support
  • Twitter
  • LinkedIn
  • Youtube

© 2026 CrowdStrike All other marks contained herein are the property of their respective owners.

  • Related Configuration Variables

    • S3_RECOVER_FROM_ENCRYPTION_KEY_SECRET_KEY
    • S3_RECOVER_FROM_ENCRYPTION_KEY_SECRET_NAME
    • S3_RECOVER_FROM_REGION
    • S3_RECOVER_FROM_REPLACE_BUCKET
    • S3_RECOVER_FROM_REPLACE_REGION

Version Support

Available version: 1.235

Enter search term