Falcon LogScale Documentation

Repositories are containers for your data server logs and metrics, with their own sets of users, dashboards, saved queries, and parsers. Views allow you to search across multiple repositories, can restrict your results to a specific subset of data, or limit access based on your interests and security needs.

To access your repositories and views, click the Repositories and Views tab on the top left of your screen:

Figure 13. Repositories and Views

See the Repositories and Views documentation for much more information on how to create and use repositories.

Once you have data coming into your repositories, you can search that data through the LogScale Search UI page. Logscale's Search functionality allows for robust, fast regex searches of server logs and metrics in your repositories.

Figure 14. Search

See the Searching for Data page for instructions on how to search.

You can store often used searches in Dashboards, a significant component of the LogScale user interface. They are a great way to get an overview of your systems. Dashboards are composed of Widgets that you create to view server activities in the form of various graphs and tables of relevant data.

Figure 15. Dashboards

See the Dashboards and Widgets documentation pages for more information.

Alerts are stored, live queries that continuously run and are triggered when user-set parameters are met or exceeded and users want to be notified, or when action must be taken. No more relying on routine checks, or worrying about not immediately detecting a problem when it occurs.

Actions are modules that can perform functions like informing administrators of a potential server problem. Alerts can also be set to trigger Actions.

Scheduled Searches are static queries, set to run on a schedule. At a scheduled interval, the query will run. If there is a result, the scheduled search will trigger its associated actions.

They are all available from the Alerts UI page:

Figure 16. Alerts

Go to Alerts documentation page for information on how to create and manage these items.

When sending logs and metrics to LogScale for ingestion, they must be parsed before they are stored in a repository. This is the case for all but LogScale’s structured ingest endpoint, which stores data as-is. Parsers take text as input, and put extracted values into named fields.

You create and configure parsers through the Parsers UI page:

Figure 17. Parsers

See Parsers documentation for more information.

Files refers to .CSV files that are used for importing metadata, to both enrich and filter your results in LogScale using the match() query function.

Click the Files tab at the top of the UI to upload or create a new file.

Figure 18. Files

From within your repository, the Settings page enables you to configure key settings for your repository, as well as create and manage authentication tokens for ingesting data, or managing Packages.

Figure 19. Settings

Go to Repository Settings or View Settings for more information on what you can do from this page.

LogScale supports a number of keyboard shortcuts that make it easier to navigate around the user interface, and also make editing queries and text easier.

Among these, the Jump Panel allows jumping to any repositories or dashboards — from anywhere within the user interface, press Ctrl+O and start typing the item you want to filter:

Figure 20. The Jump Panel

For the full list of shortcuts you can use in LogScale, see the Keyboard Shortcuts dedicated documentation.

LogScale offers a range of global and account specific settings by clicking on your profile account icon in the top right corner:

Figure 21. Account and Settings

More specifically you can:

LogScale Collector Fleet Management allows you to monitor and manage a fleet of collector instances. To access these instances, click on the Fleet Management tab at the top of the screen.

Figure 22. Fleet Management

This page allows you to access: