Falcon LogScale Documentation

Figure 454. Create a Repository

Data sent to LogScale needs to be stored in a repository. Whether you are using a LogScale Community Edition account, LogScale Cloud or LogScale Self-Hosted account, you should create your own repository. That may seem like a bother, but it will give you some experience creating repositories.

To start, click on the rectangular button labeled, + Add Item (see cropped screenshot in Figure 1). That will open a screen with icons for choosing one of three options: a View, which is not what you want at this point; and Repository.

After choosing Repository, you'll be asked to give the repository a name and a description. Enter that information in the respective boxes and then click, + Create Repository. When that's finished, you'll see a screen with panels for administering the repository you just created. It's here that you'll generate authentication tokens that will be needed to receive data in your repository.

For your repository to receive data, you have to install some tools on your server to send that data to LogScale. We call these log shippers. You'll need to decide on which software you want to use on your server. There are several choices, depending on what you want to monitor in LogScale. Whichever ones you install, you'll also need to get an authentication token, also called an ingest token, from your LogScale Cloud account to add to the configuration of those log shippers. Let's make some assumptions and get that ready.

Figure 455. Generate Ingest Tokens

To generate an ingest tokens, go to your LogScale Cloud account and click on Settings in the top menu. On the screen that it reveals, click on API Tokens under Ingest. There you will see that a default token has been created already. You can also add more tokens. Let add two.

In the input box under the heading, New Ingest Token, enter the name of a new token and then click + Create Token. You can see in the screenshot in Figure 2 that we created two tokens: my_vector and my_rsyslog. Although it's not always necessary, we will use a separate token for each log shipper that we'll install in the Log Shippers of this tutorial. Incidentally, these ingest tokens are specific to the repository. If you create another repository, it will need its own authentication tokens.

When the data comes in, so that LogScale knows how to parse it properly, you set a parser to associate with the ingest token. In the screenshot here, you can see that we set my_vector to the accesslog parser, and the my_rsyslog to syslog. That's because on the next page of this tutorial, we'll install the vector and rsyslog utilities on our server: they'll be our log shippers.

When you've finished creating your repository and generating two ingest tokens, you're ready to go to the next page of this tutorial. To do that, click on the Next Page button here.