Automation in LogScale

Learn how to automate queries, receive notifications, and schedule reports

Path 1

New to Automation?

Start with the concepts

Learn what automation is in LogScale and understand the complete landscape before implementing. Discover the four trigger types (Scheduled Search, Aggregate Alert, Filter Alert, Legacy Alert), explore all available action types (email, webhooks, Slack, OpsGenie, and more), and use the decision guide to choose the right trigger type for your needs. Perfect for those new to automation in LogScale.

  • What is Automation?
  • Triggers Overview: All Four Types
  • Decision Guide: Which Trigger Type to Choose
  • Actions Overview: Complete List
  • How Triggers and Actions Work Together
  • Scheduled PDF Reports Overview
Start Here Path 2

Ready to Create Triggers?

I understand automation concepts — show me how to create triggers

You understand automation concepts and are ready to create triggers. Follow the complete workflow: choose your trigger type, create and configure triggers with proper time windows and throttling, attach actions, manage and monitor trigger execution, and troubleshoot common issues.

  • Choose Your Trigger Type
  • Create and Configure Triggers
  • Configure Trigger Properties
  • Attach Actions to Triggers
  • Manage and Monitor Triggers
Get Started Path 3

Ready to Create Actions?

Configure automated responses and integrations

Create and configure actions for your triggers. Learn how to create actions from scratch or templates, configure message templates with variables, test actions before attaching to triggers, manage existing actions, and dive deep into specific action types like email, Slack, webhooks, OpsGenie, PagerDuty, and more.

  • Create Actions from Scratch or Templates
  • Configure Action Templates and Message Formatting
  • Test Actions
  • Manage Actions
  • Deep Dive: Specific Action Types
Get Started Path 4

Automate Dashboard Delivery

Schedule dashboard reports with automatic PDF delivery

Generate and deliver formatted dashboard reports automatically on a schedule. Learn when to use scheduled PDF reports versus triggers, create and configure scheduled reports, use cron templates for flexible scheduling, and manage your scheduled reports.

  • What are Scheduled PDF Reports?
  • Create and Configure Scheduled Reports
  • PDF Export Format and Options
  • Cron Schedule Templates
  • Manage Scheduled Reports
Get Started Path 5

Precompute Query Results

Store aggregated data for faster, repeated querying with persisted aggregations

Use persisted aggregations to precompute and store query results on a schedule, making repeated queries faster and more efficient. Learn what persisted aggregations are, create and configure them, define scheduling details, and manage existing aggregations.

  • What are Persisted Aggregations?
  • Create Persisted Aggregations
  • Configure Properties and Scheduling
  • Manage Persisted Aggregations
Get Started

Path 1: New to Automation?

Build a solid understanding of automation concepts before you create triggers or actions. Learn what automation is, explore all trigger types, discover available actions, and use the decision guide to choose the right approach for your needs.

1

What is Automation?

Learn what automation is in LogScale and how triggers, actions, and scheduled reports work together to monitor data and send notifications

Automation Overview

conceptbeginner

Introduction to LogScale's automation capabilities, including triggers, actions, scheduled reports, and persisted aggregations
2

Triggers Overview: All Four Types

Explore the four trigger types available in LogScale: Scheduled Search, Aggregate Alert, Filter Alert, and Legacy Alert. The overview presents each type in a dedicated tab. Understand when to use each type and how they differ

Scheduled Searches

conceptbeginner

Static queries run on a schedule against historical data; includes use cases for scheduled searches versus alerts

Aggregate Alerts

conceptbeginner

Live queries that aggregate data and trigger on results

Filter Alerts

conceptbeginner

Live queries that trigger on individual matching events

Legacy Alerts

conceptbeginner

Older alert type maintained for backward compatibility
3

Decision Guide: Which Trigger Type to Choose

Use the decision guide to select the appropriate trigger type based on query performance, ingest delay handling, notification speed, and aggregation requirements. Includes comparison table and decision diagram

What Trigger Type to Choose

guideintermediate

Detailed comparison and decision guide for selecting trigger types
4

Trigger Technical Fundamentals

Understand the technical concepts that control how triggers work: query types (static versus live), timestamp handling, throttling mechanisms to control notification frequency, and query execution models

General Information About Triggers

conceptintermediate

Fundamental concepts: queries, timestamps, throttling, and query models

Queries in LogScale

conceptintermediate

Understand static queries versus live queries

Timestamps for Triggers

conceptintermediate

Learn about @timestamp versus @ingesttimestamp

Throttling Mechanisms

conceptintermediate

Control alert frequency with throttling periods
5

Actions Overview: Complete List

Discover all available action types that triggers can activate: email, webhooks, Slack, OpsGenie, PagerDuty, S3 upload, file upload, VictorOps, Postmark, and LogScale repository forwarding

Actions Overview

conceptbeginner

Complete overview of all action types available in LogScale
6

Scheduled PDF Reports Overview

Learn about scheduled PDF reports for automated dashboard delivery. Understand how scheduled reports differ from triggers and when to use each approach

Schedule PDF Reports

conceptbeginner

Automatically generate and deliver PDF reports on a schedule

PDF Export Format

guidebeginner

Understand PDF formatting options for dashboards

Path 2: Ready to Create Triggers?

Follow the complete workflow for creating, configuring, and managing triggers. Create your first trigger, configure properties, attach actions, and monitor execution.

1

Choose Your Trigger Type

Review the trigger types and use the selector guide to choose the right trigger type for your use case before creating

What Trigger Type to Choose

guideintermediate

Decision guide with comparison table for trigger type selection
2

Create and Configure Triggers

Create triggers from the Triggers overview page or from the Search pag by following step-by-step instructions

Create Triggers

guideintermediate

Step-by-step guide to creating new triggers
3

Configure Trigger Properties

Configure general trigger properties that apply to all trigger types: name, query, time windows, throttling, timestamps, and permissions

Trigger Properties

referenceintermediate

Complete reference of all trigger properties by type

Throttling Configuration

guideintermediate

Configure throttling to control alert frequency
4

Configure Scheduled Search Properties

Configure properties specific to scheduled searches: scheduling intervals, cron expressions, UTC offsets, backfill limits, max wait times, and timestamp selection. Skip this step if creating alerts

Schedule Configuration

guideintermediate

Configure scheduling intervals for scheduled searches

Cron Scheduling with H Syntax

referenceintermediate

Use H to distribute scheduled search execution and balance system load

Timestamp Selection

guideintermediate

Choose between @timestamp and @ingesttimestamp
5

Attach Actions to Triggers

Select and attach existing actions to your triggers. Configure which actions execute when the trigger activates

Create Triggers (Actions Section)

guideintermediate

See the Actions section for selecting and attaching actions to triggers
6

Manage and Monitor Triggers

View, edit, duplicate, export, or delete triggers. Monitor trigger execution status, check last executed timestamps, and troubleshoot issues

Trigger Management

guideintermediate

Complete guide to managing triggers

Edit Triggers

guideintermediate

Modify trigger configuration and properties

Manage Triggers

guideintermediate

View, duplicate, export, or delete triggers

Monitor Triggers

guideintermediate

Check trigger execution status and timestamps

Path 3: Ready to Create Actions?

Create and configure actions for your triggers. Learn how to create actions from scratch or templates, configure message templates, test actions, and explore specific action types.

1

Create Actions from Scratch or Templates

Create new actions from the Actions page: start from scratch, use exported templates, or base actions on existing package definitions

Create Actions

guideintermediate

Step-by-step guide to creating actions
2

Configure Action Templates and Message Formatting

Configure message templates for actions using variables and formatting. Create dynamic messages that include query results and event data

Message Templates

guideintermediate

Use variables and formatting in action messages
3

Test Actions

Test actions with sample data before attaching them to triggers. Verify configuration, templates, and integration settings

Test Actions

guideintermediate

Verify actions work correctly before creating them; includes how to fix action error messages
4

Manage Actions

View all actions in the repository, filter by type or label, duplicate existing actions, export actions as templates, delete unused actions, and configure permissions

Manage Actions

guideintermediate

Complete guide to action management operations
5

Deep Dive: Specific Action Types

Explore detailed configuration for each action type: email, Slack, webhooks, OpsGenie, PagerDuty, S3 upload, file upload, VictorOps, Postmark, and LogScale repository forwarding

Email Action

guideintermediate

Configure email notifications with recipients and formatting

Slack Action

guideintermediate

Send notifications to Slack channels

Webhook Action

guideintermediate

Configure HTTP webhooks for custom integrations

OpsGenie Action

guideintermediate

Create OpsGenie alerts from triggers

PagerDuty Action

guideintermediate

Send incidents to PagerDuty

S3 Upload Action

guideintermediate

Upload query results to Amazon S3

Upload File Action

guideintermediate

Upload results as files to external systems

VictorOps Action

guideintermediate

Send alerts to VictorOps (Splunk On-Call)

Postmark Action

guideintermediate

Send transactional emails through Postmark

LogScale Repository Action

guideintermediate

Forward matching events to another repository

Path 4: Automate Dashboard Delivery

Generate and deliver formatted dashboard reports automatically on a schedule. Create scheduled reports, configure cron schedules, and manage report delivery.

1

What are Scheduled PDF Reports?

Learn what scheduled PDF reports are and how they automatically generate formatted dashboard reports and send them to recipients based on customizable time intervals. PDF reports are ideal for regular dashboard distribution and executive reporting, while triggers are best for event-driven notifications

Schedule PDF Reports

conceptbeginner

Introduction to scheduled PDF report generation and delivery
2

Create and Configure Scheduled Reports

Create scheduled reports from dashboards, configure recipients, set time intervals, customize PDF formatting, and configure email delivery settings. Scheduled reports use the same PDF formatting options available for manual dashboard exports

Create Scheduled Reports

guideintermediate

Step-by-step guide to creating scheduled PDF reports

PDF Export Format and Options

guidebeginner

Understand PDF layout, orientation, and formatting options used in scheduled reports
3

Cron Schedule Templates

Use cron expressions to define flexible scheduling for reports. This step is advanced and optional — basic report creation can use simple intervals. Learn to configure hourly, daily, weekly, monthly schedules with UTC time specifications and the H syntax for load distribution

Cron Scheduling

referenceintermediate

Complete reference for cron scheduling syntax and templates

Cron Scheduling with H Syntax for Reports

referenceintermediate

Use H to distribute scheduled report execution and balance system load
4

Manage Scheduled Reports

View all scheduled reports in the repository, edit report schedules and recipients, monitor report execution status, and delete reports when no longer needed

Manage Scheduled Reports

guideintermediate

View, edit, and manage scheduled report configurations

Path 5: Precompute Query Results

Use persisted aggregations to precompute and store query results on a schedule. Create and configure aggregations, define scheduling details, and manage existing aggregations.

1

What are Persisted Aggregations?

Learn what persisted aggregations are and how they precompute and store query results on a schedule, making repeated queries faster and more efficient

Persisted Aggregations

conceptbeginner

Introduction to persisted aggregations and how they work
2

Create Persisted Aggregations

Create persisted aggregations from the Search page or from the Persisted Aggregations overview page. Follow step-by-step instructions for both approaches

Create Persisted Aggregations

guideintermediate

Step-by-step guide to creating persisted aggregations from the Search page or overview page
3

Configure Properties and Scheduling

Configure persisted aggregation properties and define scheduling details including intervals, lookback period, offset, and backfill options

Configure Persisted Aggregation Properties

referenceintermediate

Complete reference of all persisted aggregation configuration properties

Scheduling Details

referenceintermediate

Configure intervals, lookback period, offset, and backfill for persisted aggregations
4

Manage Persisted Aggregations

View, edit, and delete persisted aggregations. Monitor execution status and update queries or scheduling as your needs change

Persisted Aggregation Management

guideintermediate

Overview of persisted aggregation management operations

Edit Persisted Aggregations

guideintermediate

Modify persisted aggregation queries and configuration

Manage Persisted Aggregations

guideintermediate

View, duplicate, and delete persisted aggregations