Falcon LogScale Documentation

It is safe to just delete any bloom5h1. files while the system is running, or in case the feature needs to be disabled.

MUST be enabled with BLOOMFILTER_ENABLED=true (Note! defaults to false in this release, which makes searches skip events they should not).

When enabled, this will write files along with the segment files with prefix bloom5h1., which add approximately 5% storage overhead.

The bloom filter files will be generated as part of digest work, and also generated for "old" segment files when Humio is otherwise idle. Thus, when the feature is initially enabled, it will be visible that the CPU load is higher for a period of time.

New experimental bloom filters that speed up searching for constant strings such as UUIDs and IP-addresses; the longer the search string, the bigger the speedup. The bloom filters also help regular expression searching, including case insensitive ones.